PDPA Compliance Checklist for SMEs: IT Security

Quick answer The PDPA's Protection Obligation requires "reasonable security arrangements" for personal data. For a typical SME that means MFA on every account, encrypted and patched devices, email and endpoint security, tested backups, least-privilege access, logging, secure disposal and staff training. If a breach is likely to cause significant harm or affects 500 or more people, you must notify the PDPC within 3 calendar days of determining it's notifiable.

The PDPA obligations, and which ones are IT's job

The Personal Data Protection Act sets out a series of obligations. Some are about policy and customer communication. Several land squarely on whoever runs your systems.

Obligation	What it means	IT's role
Consent, Purpose, Notification	Collect and use data only with consent, for stated purposes	Low: forms and CRM settings
Accuracy	Keep data accurate when it's used for decisions	Low
Protection	Reasonable security arrangements against unauthorised access and loss	High: this is the core IT obligation
Retention Limitation	Don't keep data longer than needed	High: retention settings and secure deletion
Transfer Limitation	Data sent overseas must get comparable protection	Medium: cloud regions and vendor contracts
Access and Correction	Individuals can request their data	Medium: being able to find it
Data Breach Notification	Assess and report notifiable breaches	High: detection, logs and evidence
Accountability	Appoint a DPO, have policies and practices	Medium: documented controls

The PDPA IT security checklist

"Reasonable" is judged against the sensitivity of the data and the size of your organisation. A clinic holding medical records is held to a higher bar than a café with a mailing list. These are the controls we'd expect any Singapore SME handling client or employee personal data to have in place.

1. Accounts and access

MFA on every account, especially email and admin accounts. Stolen passwords are behind a large share of breaches. See our MFA guide.
Named admin accounts, separate from day-to-day accounts. No shared "admin@" logins.
Least privilege. Staff access only the folders and systems their role needs.
Same-day offboarding. Leavers lose access on their last day, not when someone remembers.

2. Devices

Full-disk encryption (BitLocker or FileVault) on every laptop. A lost unencrypted laptop with client data is a likely notifiable breach; an encrypted one usually isn't.
Automatic patching of operating systems and browsers.
Endpoint protection with anti-ransomware, centrally monitored.
Remote wipe for laptops and phones that access company data, through a tool such as Microsoft Intune.

3. Email and files

Advanced email filtering for phishing and malicious attachments. Native filtering alone misses targeted attacks, as we explain in the truth about Microsoft 365 email security.
Misdirected email controls. Sending personal data to the wrong recipient is one of the most common incidents in PDPC enforcement decisions. Use recipient warnings and, for sensitive files, password-protected links instead of attachments.
Sharing controls on OneDrive and SharePoint, so "anyone with the link" sharing is restricted or expires.

4. Backup and recovery

Independent, immutable backups of Microsoft 365 and any servers. Microsoft's native retention isn't a backup; see is Microsoft 365 backed up?
Tested restores, at least quarterly, with the results recorded.

5. Monitoring and evidence

Sign-in and audit logging switched on and retained. Without logs, you can't tell the PDPC what was accessed, and you may have to assume the worst.
Alerting on risky sign-ins, mass downloads and mailbox forwarding rules.

6. People and disposal

Security awareness training at onboarding and at least yearly. Our training guide covers what works.
Secure disposal of old laptops, drives and printers, with a record of what was wiped.
Retention rules that delete data you no longer need. Data you don't have can't be breached.

Shortcut: the controls above overlap heavily with CSA Cyber Essentials. Getting certified gives you an independent, documented baseline you can point to if the PDPC, a client or an insurer asks what "reasonable" looked like in your business. Try our free Cyber Essentials self-assessment to see where you stand.

Data breach notification: the timeline

Since February 2021, data breach notification has been mandatory in Singapore. The rules, per the PDPC's guidelines, work like this:

From discovery to notification

A breach is notifiable if it:

results in, or is likely to result in, significant harm to the individuals affected, for example exposure of NRIC numbers with financial or medical details, bank account information or login credentials; or
is of significant scale, meaning it involves the personal data of 500 or more individuals.

If your IT provider or another vendor processes data on your behalf (a "data intermediary"), they must tell you without undue delay when they discover a breach. Check that your contracts say so.

What's at stake

10%

of annual Singapore turnover, the maximum fine for organisations above S$10m turnover

S$1m

maximum fine for other organisations

3 days

to notify the PDPC once a breach is assessed as notifiable

Fines aren't the only cost. PDPC decisions are published with the organisation's name, and many decisions point to missing basics: no MFA, unpatched systems, misconfigured cloud storage or weak password practices. Those are exactly the controls in the checklist above.

Don't forget the Data Protection Officer

Every organisation covered by the PDPA, however small, must appoint at least one Data Protection Officer and make their business contact details available. The DPO doesn't have to be technical, but they need a direct line to whoever runs your IT, because the first question after any incident will be "what did the logs show?".

Where to start if you've done nothing yet

Turn on MFA for every Microsoft 365 account.
Confirm BitLocker or FileVault is on every laptop.
Put independent backup in place for Microsoft 365.
Switch on and retain audit logs.
Appoint a DPO and write a one-page breach response plan with names and phone numbers.

Those five steps close most of the gaps we see in Singapore SME assessments, and they cost far less than a single notifiable breach.

This article is general guidance on IT controls, not legal advice. For specific PDPA obligations, refer to the PDPC's official guidelines or a qualified adviser.

FAQ

Questions, answered

What does the PDPA require from an IT perspective?

The PDPA's Protection Obligation requires organisations to make reasonable security arrangements to protect personal data in their possession or control against unauthorised access, collection, use, disclosure, copying, modification, disposal and loss. In practice this means access control and MFA, encryption, patching, endpoint and email security, backups, logging, secure disposal and staff training, proportionate to the sensitivity of the data.

When must a data breach be reported to the PDPC?

A breach must be notified to the PDPC if it results in, or is likely to result in, significant harm to affected individuals, or if it involves the personal data of 500 or more individuals. Once an organisation determines a breach is notifiable, it must notify the PDPC as soon as practicable and no later than 3 calendar days. Affected individuals must also be notified where significant harm is likely, unless an exception applies.

What is the maximum PDPA fine?

Since 1 October 2022, the PDPC can impose a financial penalty of up to 10% of an organisation's annual turnover in Singapore if that turnover exceeds S$10 million, or up to S$1 million otherwise, whichever is higher.

Does a small business need a Data Protection Officer?

Yes. Every organisation subject to the PDPA, regardless of size, must designate at least one Data Protection Officer and make that person's business contact information available. The DPO role can be held by an existing employee or outsourced.

Is CSA Cyber Essentials enough to comply with the PDPA?

Cyber Essentials is a strong, independently verified baseline of cybersecurity controls and covers much of the technical side of the Protection Obligation. It does not cover the PDPA's other obligations such as consent, purpose limitation and retention, so treat it as one part of your compliance programme rather than all of it.

PDPA compliance for SMEs: the IT side, explained