One year on from Singapore's DPO Mandate and other recent developments

Administrative changes

Previously companies were required to register a DPO using the BizFile+ portal (the Singapore equivalent of the UK's Companies House). From 1 December 2024, the BizFile+ portal option was no longer available and organisations must now use the PDPC’s online form found on PDPC's website.

There is no requirement in Singapore that the DPO must be based locally. However, the DPO’s contact information must be easily accessible and operational during Singapore business hours. If the DPO is not physically based in Singapore, the organisation should ensure that the contact information provided (for example, email or phone) allows individuals in Singapore to reach the DPO effectively during local business hours.

Failure to appoint a DPO

While appointing a DPO is mandatory under the PDPA, there is no deadline to register the DPO. Failure to appoint a DPO may result in enforcement actions taken by the PDPC. What enforcement actions PDPC will take depend on the circumstances of the data breach incident, the organisation’s non-compliance with the PDPA and its response to rectify the situation. We have noted that where there has been a data breach incident and where the PDPA has investigated and found that the organisation had failed to appoint a DPO, additional penalties were issued, regardless of whether the appointment of a DPO would have made a difference to the scale of the data breach incident. Enforcement outcomes could comprise warnings, directions or financial penalty. Therefore, it is crucial for organisations to comply with the requirement to appoint a DPO, as mandated by the PDPA, and ensure proper data protection governance.

Role and expectations of the DPO

The DPO plays a central role in ensuring an organisation’s compliance with the PDPA. Key responsibilities include:

• Ensuring PDPA compliance
• Fostering a data protection culture
• Responding to data protection queries from individuals and regulators
• Alerting management on data protection risks and obligations
• Developing and implementing internal data protection policies
• Liaising with the PDPC on regulatory matters

The DPO should ideally be a member of the senior management or have direct reporting line to senior management; and sufficiently skilled, knowledgeable and empowered to drive data protection policies and practices in the organisation. It is good practice for the DPO to be positioned in a way that enables effective oversight and influence across the organisation.

Importantly, the DPO role is increasingly viewed as a critical component of broader risk management strategy and will likely help organisations to:

• Mitigate reputational and operational risks
• Strengthen internal governance
• Build trust with clients and stakeholders

Recent enforcement actions

If the PDPC finds that an organisation has breached any of the PDPA provisions, it will direct the organisation to take steps to ensure compliance such as:

• Stop collecting, using or disclosing personal data in contravention of the Act
• Destroy personal data collected in contravention of the Act
• Provide access to or correct the personal data
• Pay a financial penalty

Recent enforcement actions have focused on data protection failures, such as:

• Weak password policies and lack of multi-factor authentication for privileged accounts
• Inadequate vendor management practices
• Failure to implement reasonable security arrangements
• Failure to designate data protection officer

Some of these enforcement actions were not directly tied to the DPO appointment requirement but rather to overall PDPA compliance. Some enforcement outcomes have included remedial undertakings to strengthen governance and the DPO function as part of broader compliance improvements.

Additional considerations for insurers

Given the sensitivity of personal data handled by insurers, insurers may wish to be mindful of additional responsibilities under the PDPA and the DPO mandate:

• Handling sensitive data: ensuring heightened data protection measures to guard against cyber threats and ensure confidentiality.
• Cross-border data transfers: compliance with PDPC requirements on cross-border data transfers, including implementing adequate safeguards such as contractual clauses.
• Alignment with MAS regulations: coordinate with compliance teams managing MAS requirements to ensure cohesive governance.
• Data breach incident response: establish clear processes for responding to data breaches, including timely notification to the PDPC and affected individuals. The DPO plays a crucial role in coordinating breach management, liaising with cybersecurity teams, and ensuring compliance with notification obligations.

Conclusion: The evolving role of the DPO

As Singapore continues to position itself as a global leader in data governance and digital innovation, the role of the DPO is expected to expand significantly. No longer viewed solely as a compliance function, the DPO is increasingly recognised as an enabler of innovation, a strategic advisor who helps organisations navigate complex data ecosystems responsibly.

With the rise of artificial intelligence, cross-border data flows, and privacy-enhancing technologies, DPOs are increasingly encouraged to:

• Collaborate across departments to embed privacy into product design and digital transformation initiatives
• Advise on ethical data use, especially in AI applications and automated decision-making
• Support innovation by ensuring that data governance frameworks are flexible yet robust
• Build public trust by promoting transparency, accountability, and responsible data practices

These expectations represent emerging best practices rather than binding regulatory mandates. The PDPC’s ongoing initiatives, such as the Model AI Governance Framework; the Global AI Assurance Sandbox; and the international recognition of the Data Protection Trustmark, reflect Singapore’s broader direction toward responsible and innovative data use.

Organisations that empower their DPOs with the right authority, resources, and visibility will be better equipped to manage risk and meet evolving regulatory expectations.