10%
Annual turnover exposure
For serious breaches, financial penalties can reach up to 10% of annual turnover under applicable Singapore rules.
Singapore data protection advisory
PDPA compliance, made practical.
Data is your business's lifeblood. Mismanage it and you face investigations, penalties, and lost customer trust. Lee & Lim Advisory turns Singapore's PDPA into clear policies, workable consent language, and a response plan your team can follow.
Policies, consent, and breach readiness for Singapore businesses.
Compliance snapshot
Know where your data sits.
Data inventory
Consent language
Breach response
A useful programme gives people decisions to make, owners to contact, and deadlines to meet.
Why it matters
The cost of non-compliance is operational.
Privacy compliance affects budgets, customer conversations, incident response, and the decisions your directors must make. A policy that stays in a folder will not protect the business.
3 days
Breach notification window
A notifiable breach may require notification to the PDPC within three days of assessment.
Trust is difficult to rebuild.
Customers notice unclear consent, repeated marketing messages, and silence after an incident. Personal data protection needs an owner, a record, and a process that works under pressure.
A practical response
Reduce risk before an investigator calls.
- Map the personal data your teams collect, use, retain, and share.
- Give staff plain instructions for consent, access requests, and escalation.
- Prepare a breach playbook with decision points and reporting responsibilities.
What we do
Our data protection services
Choose a focused engagement or build a complete PDPA advisory programme around your existing people and systems.
PDPA Gap Analysis
We audit your current practice against the 11 PDPA obligations, then rank the issues by impact and urgency.
Review your gapsPrivacy Policy & Consent
We draft website privacy notices, cookie consent wording, collection notices, and internal consent procedures.
Clarify your consent policyDPO Support
An acting DPO service gives your business a dependable contact for staff questions, records, reviews, and regulator correspondence.
Plan DPO supportBreach Response Plan
Set out containment steps, evidence handling, notification decisions, customer communications, and regulatory reporting.
Prepare your playbookStaff Training
Short workshops and e-learning modules show teams how to handle requests, avoid common mistakes, and report incidents early.
Train your teamCross-Border Transfers
We assess ASEAN and EU transfer arrangements, vendor terms, safeguards, and the records needed for international data flows.
Assess overseas transfersA clear plan
Your compliance roadmap
Most programmes become manageable once ownership and timing are visible. We can start with the first month.
Month 1
Map and assess
Inventory personal data, vendors, systems, and gaps against the PDPA.
Month 2
Draft and implement
Put policies, consent language, retention rules, and request workflows in place.
Month 3
Train and assign
Train staff, appoint a DPO, and make escalation routes known across the business.
Ongoing
Test and review
Run breach simulations and review the programme each year or after major change.
Case study
Post-breach recovery for a Singapore e-commerce firm
The challenge. A customer database was exposed, and a PDPC investigation was imminent.
The action. We helped contain the incident, assess notification duties, prepare the required communications, and put a DPO and new internal policies in place.
The result. The PDPC accepted undertakings without a financial penalty, while the company gave customers a clear account of the steps taken.
Useful answers
PDPA FAQs
The right answer depends on what your business collects, why it collects it, and who can access it.
Does PDPA apply to my small business?
Yes. The PDPA generally applies to organisations in Singapore that collect, use, or disclose personal data, regardless of their headcount. The controls should match your actual risk and operations.
What counts as personal data?
Personal data is information about an identifiable individual, whether the person can be identified from that information alone or together with other information your organisation has access to.
Do I need a DPO?
Organisations are required to designate at least one person to handle data protection responsibilities. We can help define the role or provide acting DPO support.
How do I respond to a data access request?
Verify the requester, locate the relevant records, check applicable exceptions, and respond within the required timeframe. A documented workflow prevents missed deadlines.
Can I transfer data overseas without consent?
Overseas transfer rules focus on ensuring comparable protection. The right contractual safeguards, assessment, and records depend on the destination and the receiving organisation.
What should I do after a data breach?
Contain the incident, preserve evidence, assess the harm and scale, decide whether notification is required, and record each decision. Contact counsel early when the facts are still developing.
Turn data protection into a competitive advantage.
Start with a focused PDPA health check. Lee & Lim Advisory will identify the decisions, documents, and ownership your business needs next.
Start Your PDPA Health Check