Is Your Website PDPA-Compliant? Forms, Cookies and Privacy Policies for Singapore Businesses

If your website collects names, emails, phone numbers or any other personal data, the Personal Data Protection Act (PDPA) applies to it. A PDPA-compliant website tells visitors clearly why their data is collected, gets proper consent, protects what it stores and lets people reach your Data Protection Officer. Here is what that looks like in practice for contact forms, cookies, newsletters and privacy policies.

Why Your Website Is Your Biggest PDPA Touchpoint

For most Singapore SMEs, the website is where personal data enters the business: enquiry forms, quotation requests, appointment bookings, newsletter sign-ups, live chat and online checkouts. Every one of these is covered by the Personal Data Protection Commission (PDPC)‘s rules on how organisations collect, use and disclose personal data.

The stakes are real. For breaches from 1 October 2022, the PDPC can impose a financial penalty of up to S$1 million or 10% of an organisation’s annual turnover in Singapore, whichever is higher [2]. Beyond penalties, a data incident damages the trust that brought customers to your website in the first place.

PDPA Obligations and What They Mean for Your Website

How to Make Your Website PDPA-Compliant

1. Contact and Enquiry Forms

Collect only what you need to respond. If you only need an email address to answer a question, don’t make NRIC numbers, home addresses or dates of birth mandatory. Add a short notice beside the submit button explaining how the data will be used, with a link to your privacy policy. If you want to send marketing later, ask for that separately with an unticked checkbox.

2. Newsletter Sign-Ups and Marketing Messages

Marketing consent should be clear and specific. If you send marketing messages to Singapore phone numbers by call, SMS or WhatsApp, you also need to follow the PDPA’s Do Not Call provisions, which generally means checking numbers against the DNC Registry unless you have clear and unambiguous consent. Make it easy to unsubscribe from every email.

3. Cookies and Tracking Tools

Analytics, advertising pixels and chat widgets can collect personal data through cookies. Use a clear cookie notice that explains what you use and why, and give visitors a way to manage non-essential cookies. The PDPC’s advisory guidelines discuss when consent is needed for cookies; your web developer should configure your tags so they match what your notice says.

4. Security of Stored Data

Form submissions often sit in your website’s database or inbox for years. Protect them with HTTPS, strong admin passwords and two-factor authentication, limit who can access submissions, and keep your CMS, theme and plugins up to date. Proactive website maintenance and secure Singapore web hosting remove many common risks. Websentials itself holds the Cyber Essentials mark, so we apply the same security discipline to client websites.

5. A Privacy Policy People Can Actually Read

Your privacy policy should explain, in plain language, what data you collect, why, who you share it with, how long you keep it and how to contact your Data Protection Officer. Link to it from your footer and from every form.

6. A Plan for Data Breaches

Decide in advance who assesses an incident, who contacts the PDPC and how affected customers will be informed. Once you determine that a breach is notifiable, the PDPC must be notified as soon as practicable and no later than 3 calendar days [1].

Frequently Asked Questions

Does the PDPA apply to small businesses?

Yes. The PDPA applies to organisations of all sizes that collect, use or disclose personal data in Singapore, including sole proprietors and SMEs. A simple enquiry form is enough to bring your website into scope.

Do I need a Data Protection Officer?

Yes. Organisations must designate at least one person to be responsible for PDPA compliance and make that person’s business contact information publicly available, for example on your website’s privacy policy or contact page.

Can I collect NRIC numbers through my website?

Generally, organisations should not collect full NRIC numbers unless the law requires it or it is necessary to verify identity to a high degree of fidelity. For most website enquiries, a name and contact details are enough. Check the PDPC’s advisory guidelines on NRIC numbers before collecting them.

Make Your Website PDPA-Ready with Websentials

A PDPA-ready website protects your customers and your business. At Websentials, we build secure forms, sensible data retention and clear consent flows into our web development projects, and we can review your current site.

1. Audit your forms and data flows: we’ll map where personal data enters and where it goes.
2. Fix the gaps: consent wording, cookie settings, security and retention.
3. Stay protected: keep your website secure with ongoing maintenance.

Contact the Websentials team today to review your website’s data protection.

This article is general information, not legal advice. Refer to the PDPC’s guidelines or seek legal advice for your specific situation.

References

1. PDPC: Guide on Managing and Notifying Data Breaches under the PDPA
2. PDPC: Advisory Guidelines on Enforcement of the Data Protection Provisions
3. Personal Data Protection Commission: pdpc.gov.sg