Singapore PDPA vs GDPR: Key Differences Every Business Must Know (2026)

If your business operates in Singapore and serves customers in the European Union — or vice versa — you likely face two of the world's most influential data protection regimes: Singapore's Personal Data Protection Act (PDPA) and the EU's General Data Protection Regulation (GDPR). While both frameworks aim to protect individuals' personal data, their scope, obligations, and penalties differ in ways that materially affect how you build processes, write privacy notices, and respond to incidents.

This guide breaks down the practical differences between PDPA and GDPR so Singapore businesses, cross-border startups, and compliance teams can confidently map their obligations under both laws.

What Is Singapore's PDPA?

The Personal Data Protection Act 2012 is Singapore's primary data protection law, administered by the Personal Data Protection Commission (PDPC). It governs the collection, use, disclosure, and care of personal data by private sector organisations in Singapore. Major amendments took effect in 2021, introducing mandatory data breach notification, expanded consent exceptions (such as legitimate interests and business improvement), and significantly higher financial penalties.

The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of where the organisation is formed or based. It coexists with Singapore's Do Not Call (DNC) provisions, which regulate marketing messages to Singapore telephone numbers.

What Is the GDPR?

The General Data Protection Regulation (EU) 2016/679 is the European Union's omnibus data protection law, enforced since 25 May 2018. It is enforced by national data protection authorities (DPAs) in each EU member state and overseen by the European Data Protection Board (EDPB). GDPR is widely considered the global benchmark for privacy regulation and has inspired similar laws in Brazil (LGPD), California (CCPA/CPRA), and beyond.

GDPR applies to any organisation processing personal data of individuals located in the EU/EEA, even if that organisation has no physical presence in Europe — a concept known as extraterritorial scope.

PDPA vs GDPR: Side-by-Side Comparison

The table below summarises the most important structural differences between the two regimes.

Dimension	Singapore PDPA	EU GDPR
Effective date	2 July 2014 (amended 2021)	25 May 2018
Territorial scope	Organisations collecting/using/disclosing personal data in Singapore	Controllers/processors in EU, or targeting/monitoring EU data subjects
Definition of personal data	Data about an identifiable individual, whether true or not	Any info relating to an identified or identifiable natural person
Lawful bases	Consent-centric, with exceptions (legitimate interests, business improvement, etc.)	Six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests)
Sensitive data category	No formal "special category" (but higher care expected for NRIC, health, finance)	Explicit "special categories" with stricter conditions
Data Protection Officer	Mandatory for all organisations	Mandatory only in specific cases (public authority, large-scale monitoring, etc.)
Breach notification	Within 3 calendar days (to PDPC) if significant harm or ≥500 individuals affected	Within 72 hours to DPA; without undue delay to individuals if high risk
Maximum fine	Up to SGD 1 million or 10% of annual Singapore turnover (whichever higher)	Up to €20 million or 4% of global annual turnover (whichever higher)
Data subject rights	Access and correction	Access, rectification, erasure, restriction, portability, objection, automated decisions
Cross-border transfers	Comparable protection standard required	Adequacy decisions, SCCs, BCRs, or derogations

Scope and Extraterritoriality

Both laws reach beyond their home borders, but in different ways.

PDPA's Reach

PDPA applies to organisations that carry out data activities in Singapore, even if the organisation itself is overseas. For example, a US-based SaaS company collecting data from Singapore users is subject to PDPA. Government agencies are explicitly excluded (they fall under the Public Sector Governance Act).

GDPR's Reach

GDPR applies when you have an establishment in the EU or when you offer goods/services to, or monitor the behaviour of, people in the EU. A Singapore e-commerce brand shipping to France and running retargeting pixels on French visitors is squarely within GDPR scope — and may need to appoint an EU representative.

Consent and Lawful Bases

This is where day-to-day operational differences bite hardest.

PDPA: Consent-First, With Expanding Exceptions

Historically PDPA has centred on consent, including deemed consent by notification. The 2021 amendments added:

Legitimate Interests Exception — allows processing without consent where benefits outweigh adverse effects, after a documented assessment.
Business Improvement Exception — permits using personal data to improve products, services, and operations.
Deemed consent by contractual necessity — where data sharing is reasonably necessary to fulfil a contract.

GDPR: Six Equal Lawful Bases

Under GDPR, consent is just one of six lawful bases and is often not the best choice because it can be withdrawn at any time. Most business-to-business processing relies on legitimate interests or contract necessity. Consent under GDPR must be freely given, specific, informed, unambiguous, and as easy to withdraw as to give — a notably higher bar than PDPA's deemed consent models.

Data Subject Rights

GDPR grants significantly broader rights to individuals than PDPA.

Rights Under PDPA

Right of access — individuals can request what data you hold and how it has been used/disclosed in the past year.
Right of correction — individuals can request corrections to inaccurate data.
Right to withdraw consent at any time.
Right to data portability — enacted in the 2020 amendments but not yet operationally in force at the time of writing.

Rights Under GDPR

Right of access
Right to rectification
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object (including to direct marketing and profiling)
Rights related to automated decision-making and profiling

Notably, PDPA does not include a general right to erasure. Organisations must still cease retention when the purpose is fulfilled and no legal retention is required, but individuals cannot demand deletion in the same sweeping manner as GDPR.

Data Protection Officer (DPO)

Under PDPA, every organisation — regardless of size — must appoint at least one DPO and publish their business contact details. This is one of the most frequently overlooked PDPA obligations by small businesses in Singapore.

Under GDPR, a DPO is only mandatory if you:

Are a public authority;
Carry out large-scale, regular, and systematic monitoring of individuals; or
Process special categories of data on a large scale.

Breach Notification Timelines

Both regimes require breach notification, but the triggers and timing differ.

PDPA

You must notify the PDPC as soon as practicable, and in any case within 3 calendar days, if a breach:

Results in, or is likely to result in, significant harm to affected individuals; or
Affects 500 or more individuals.

Affected individuals must also be notified if significant harm is likely — unless an exception applies (e.g. remedial action taken, data was encrypted).

GDPR

Controllers must notify the supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in risk to individuals. If the breach is high-risk for individuals, they too must be notified without undue delay.

Penalties and Enforcement

Both regulators have shown increasing willingness to issue high-impact fines.

PDPA: As of 1 October 2022, maximum penalties rose to SGD 1 million or 10% of annual turnover in Singapore (for organisations with turnover exceeding SGD 10 million), whichever is higher.
GDPR: Two tiers of fines — up to €10 million or 2% of global turnover for administrative breaches, and up to €20 million or 4% of global turnover for serious violations such as unlawful processing or infringing data subject rights.

GDPR fines are generally much larger in absolute terms, but PDPA's 10% local turnover ceiling is significant for Singapore-centric businesses.

Cross-Border Data Transfers

PDPA requires that overseas recipients provide a standard of protection comparable to PDPA. This is typically achieved through contractual clauses, binding corporate rules, or certifications such as APEC CBPR.

GDPR is stricter. Transfers outside the EEA require one of:

An adequacy decision from the European Commission (Singapore does not have adequacy status);
Standard Contractual Clauses (SCCs) with a Transfer Impact Assessment post-Schrems II;
Binding Corporate Rules; or
A narrow derogation (e.g. explicit consent, contract necessity).

Practical Compliance Steps for Dual-Jurisdiction Businesses

If your business must comply with both PDPA and GDPR, don't build two parallel programmes. Build one strong baseline aligned to the stricter standard, then overlay local nuances.

Map your data flows. Document what personal data you collect, where it lives, who processes it, and where it moves cross-border.
Appoint a DPO. Mandatory under PDPA regardless of size; required under GDPR for specific triggers. One DPO can often serve both roles.
Choose lawful bases carefully. For each processing activity, document the PDPA basis (consent, legitimate interests, business improvement exception) and the GDPR lawful basis.
Write layered privacy notices. Include region-specific sections for Singapore and EU data subjects.
Operationalise data subject requests. Build intake forms, identity verification, and response templates that meet the tighter GDPR timeline (one month).
Implement breach response playbooks. A single incident could trigger both 72-hour GDPR and 3-day PDPA clocks.
Review vendor contracts. Include GDPR Article 28 processor clauses and PDPA-equivalent protection clauses.
Minimise and secure. Use pseudonymisation, encryption, and least-privilege access controls. Even link-sharing tools should be chosen with privacy in mind — for example, when sharing campaign or marketing URLs, using a privacy-respecting shortener like Lunyb helps avoid unnecessary data leakage through third-party analytics.

Common Myths About PDPA and GDPR

"PDPA is just a lighter version of GDPR"

Not exactly. PDPA has unique features (mandatory DPO for all organisations, 3-day breach notification, Do Not Call provisions) that are stricter or absent in GDPR.

"If I comply with GDPR, I automatically comply with PDPA"

Largely true at a technical level, but you still need PDPA-specific artefacts: a Singapore DPO, PDPC breach notification processes, DNC registry checks for marketing calls/SMS, and NRIC handling rules under the PDPC's NRIC advisory guidelines.

"GDPR only applies to EU companies"

False. GDPR's extraterritorial reach is one of its defining features. Any Singapore business targeting EU customers or monitoring EU users is in scope.

For more on choosing privacy-conscious tooling for your marketing stack, see our honest review of the privacy-first URL shortener Lunyb and our breakdown of Rebrandly vs Lunyb in 2026.

Frequently Asked Questions

Does Singapore's PDPA apply to foreign companies?

Yes. PDPA applies to any organisation collecting, using, or disclosing personal data in Singapore, regardless of whether the organisation is formed or resident in Singapore. A foreign e-commerce platform with Singapore customers must comply.

Is consent always required under PDPA?

No. Since the 2021 amendments, organisations can rely on exceptions such as legitimate interests, business improvement, and deemed consent by contractual necessity — provided they document assessments and inform individuals appropriately.

How quickly must I report a data breach under PDPA vs GDPR?

Under PDPA, within 3 calendar days to the PDPC if the breach causes significant harm or affects 500+ individuals. Under GDPR, within 72 hours to the relevant supervisory authority unless the breach is unlikely to result in risk to individuals.

Do I need separate DPOs for Singapore and the EU?

Not necessarily. One qualified individual can serve as DPO for both jurisdictions, provided they have the expertise, resources, and independence required. Many multinationals appoint a global DPO supported by regional privacy leads.

What's the biggest practical difference between PDPA and GDPR for a small business?

The breadth of data subject rights. GDPR gives individuals rights to erasure, portability, and objection that PDPA does not fully replicate. Small businesses serving EU customers must be ready to delete data on request — something PDPA-only organisations typically aren't set up to do.

Final Thoughts

PDPA and GDPR share the same DNA — transparency, accountability, purpose limitation, and data minimisation — but diverge in meaningful operational detail. Singapore businesses expanding into Europe (or EU businesses entering Singapore) should treat compliance as a unified programme with jurisdiction-specific overlays, not two separate silos. Done right, strong privacy practices become a competitive advantage, building trust with customers in both markets and reducing the risk of regulatory action that can cost millions.

Start with a data map, appoint your DPO, align your lawful bases, and pressure-test your breach response. Everything else — consent flows, vendor clauses, data subject request workflows — builds on that foundation.