PDPA (Singapore): What It Means for Shops and Loyalty Programs

By Alva Chew · Updated 2026-11-05

Definition The PDPA, or Personal Data Protection Act 2012, is Singapore's general data protection law. It governs how any organisation collects, uses and discloses personal data, so a shop that records customer emails for a loyalty program is covered. PDPC can fine an organisation up to S$1 million or 10% of its annual turnover in Singapore, whichever is higher, where turnover exceeds S$10 million.

What is the PDPA in Singapore?

The Personal Data Protection Act 2012 (PDPA) is the law that governs how organisations in Singapore collect, use and disclose individuals’ personal data. It was first enacted in 2012 and revised in 2020. The Personal Data Protection Commission (PDPC) promotes awareness and administers and enforces it.

The Act has two halves. The Data Protection Provisions set the rules for handling personal data. The Do Not Call Provisions in Parts 9 and 9A cover marketing messages to Singapore telephone numbers.

What counts as personal data?

The PDPA defines it as data, true or not, about an individual who can be identified from that data, or from that data and other information the organisation has or is likely to have access to. PDPC says the term is not meant to be read narrowly and covers electronic and paper records.

For a shop, that includes a customer’s name, email address and phone number. It also includes a purchase history once it is tied to a member. A points balance linked to a named member is personal data.

Who has to comply?

Every organisation, unless it falls in an expressly excluded category. PDPC’s guidelines say “organisation” covers individuals, companies and unincorporated bodies such as associations. A one-outlet café is covered in the same way as a chain.

Section 11(3) requires you to designate at least one individual to be responsible for compliance, often called the DPO. They need not be an employee, and the business stays legally responsible.

What are the main obligations?

PDPC’s guidelines list ten. These are the ones a loyalty program touches most.

Obligation	PDPA section	In plain words
Consent	13 to 17	Get consent for the purpose before you collect, use or disclose data
Purpose Limitation	18	Collect only for purposes a reasonable person would find appropriate
Notification	20	Tell people the purposes on or before collection
Access and Correction	21, 22, 22A	Give members their data on request and fix errors
Protection	24	Keep reasonable security arrangements
Retention Limitation	25	Stop keeping data once it is no longer needed
Data Breach Notification	26A to 26E	Assess a breach and notify where required
Accountability	11 and 12	Have data protection policies and make information about them public

Source: PDPC, Advisory Guidelines on Key Concepts in the PDPA, revised 29 April 2026. We could not open Singapore Statutes Online from our tools, so section numbers are as PDPC cites them.

Our guide on loyalty programs and the PDPA applies each of these to sign-up, consent, withdrawal and retention.

What are the Do Not Call rules?

The Do Not Call Registry comprises three separate registers kept by PDPC under section 39, covering telephone calls, text messages and faxes. People may register Singapore numbers on one or more of them. Organisations have obligations before sending certain marketing messages to those numbers. Check PDPC’s separate Do Not Call guidelines before you text or call members for marketing.

What is the penalty for breaching the PDPA?

PDPC’s Guide on Active Enforcement (revised 1 October 2022) gives the cap.

Item	Figure
Maximum financial penalty, section 48J	Up to S$1 million or 10% of annual turnover in Singapore, whichever is higher
Where the 10% limb applies	Annual turnover in Singapore above S$10 million
Cap in force from	1 October 2022

Source: PDPC, Guide on Active Enforcement, revised 1 October 2022, Part III.

The guide also says PDPC first considers whether directions without a financial penalty will remedy the breach. It considers a penalty when one is needed to reflect the seriousness of the breach.

How does a points program keep PDPA work small?

The less personal data you hold, the less you have to notify, correct, secure and eventually delete. A points-based program can run on an email address and a purchase record. A schedule for points expiry gives you a natural moment to review inactive accounts under the retention rule.

This page is a plain-language summary and not legal advice. Check the current Act and PDPC guidance before you write your member notice.

How Gimify fits

Gimify members join with an email address through a QR code, with no form or app download. The business running the program decides what it tells members about why it holds that email.

Questions owners ask

What does PDPA stand for in Singapore?

Personal Data Protection Act 2012. It is administered and enforced by the Personal Data Protection Commission (PDPC).

Does the PDPA apply to a small café or shop?

Yes. PDPC's guidelines say every organisation must comply for activities involving personal data in Singapore unless it falls in an expressly excluded category. The term organisation covers individuals, companies and unincorporated bodies.

Do I need a Data Protection Officer?

Section 11(3) requires an organisation to designate one or more individuals responsible for compliance. That person need not be an employee, and legal responsibility stays with the business.

Is an email address personal data?

Usually yes. The PDPA defines personal data as data about an individual who can be identified from it, or from it plus other information the organisation has or is likely to have.

Does the PDPA ban marketing messages?

No. Marketing to Singapore phone numbers is governed by the Do Not Call provisions in Parts 9 and 9A, which set up three registers for calls, text messages and faxes.

Does the PDPA apply outside Singapore?

PDPC's guidelines say an organisation is covered whether or not it is formed under Singapore law or has an office in Singapore, for personal data activities in Singapore. If you serve customers elsewhere, other local laws may also apply.