PDPA compliance for websites
In Singapore, silence is not consent.
Singapore’s PDPA lets some cookies run without asking, but advertising cookies need the visitor’s consent, and a visitor who simply ignores your banner has not given it. ConsentBit asks clearly, acts on the answer, and keeps the record.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
Accept and Reject, in one clear choice.
Advertising waits. Login and security keep working.
Singapore’s privacy law, enforced by the PDPC.
The Personal Data Protection Act 2012 (PDPA) governs how organisations collect, use and disclose personal data in Singapore. The Personal Data Protection Commission (PDPC) enforces it, and it applies to organisations of any size, including small businesses.
Maximum financial penalty
10% of turnover
of annual Singapore turnover above S$10 million, or S$1 million, whichever is higher.
In effect since
2 July 2014, with the higher penalties from 1 October 2022
Default model
Eleven obligations, including consent, notification, access and correction, and breach notification
Five things the PDPA expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
What PDPA requires
Tell visitors what you collect and why, before you collect it
How ConsentBit handles it
The banner names each category and what it is used for, as soon as a visitor lands.
What PDPA requires
Get consent before advertising cookies
How ConsentBit handles it
Marketing scripts stay blocked until the visitor agrees.
What PDPA requires
Don’t treat silence as agreement
How ConsentBit handles it
Nothing in the Marketing category runs until someone actually chooses.
What PDPA requires
Let visitors withdraw consent
How ConsentBit handles it
A preferences link reopens the panel, and the new choice applies straight away.
What PDPA requires
Keep a record of what was agreed
How ConsentBit handles it
Every choice is logged with the date and time, ready to export.
Section 16 of the PDPA says a visitor can withdraw consent at any time, and that you have to stop using the data once they do.
What a visitor sees, step by step
The banner asks once, and the answer sticks until the visitor changes it.
They land on your site
The banner explains what is collected. Cookies for login, security and the basics of the site keep working. Everything else waits.
They choose
Accept all, Reject all, or pick categories in the preferences panel.
The choice takes effect
Advertising scripts run only if the visitor allowed Marketing. Ignoring the banner is not agreement, so they stay blocked.
They can change their mind
A preferences link reopens the panel. The new choice applies immediately, as section 16 requires.
WHAT SINGAPORE ASKS FOR, AND WHAT IT DOESN’T
Singapore asks for less than Europe, but not for nothing.
The PDPC has published specific guidance on cookies. It is more flexible than the EU’s rules in places, and firmer in one that matters: a visitor who never touches your banner has not agreed to anything.
The PDPC’s position comes from its Advisory Guidelines for Selected Topics, chapter 7. Guidelines are not the statute, but they are the regulator describing how it reads the law.
Asked for, or asked about
Only the cookies your site cannot work without keep running. Everything else waits for an answer.
Stricter than Singapore asks for
The PDPC says cookies supporting activities the visitor clearly requested, such as authentication, security and remembering preferences, don’t need separate consent. ConsentBit still holds Preferences and Analytics until the visitor chooses, which is the safer side of the line.
The penalty scales with your turnover
Since October 2022 the PDPC can fine up to 10% of annual Singapore turnover for organisations above S$10 million, or S$1 million for everyone else, whichever is higher.
Selling into Europe as well? See what GDPR requires →
Add a PDPA-ready banner to your site, free.
Records
A record of every consent, ready if the PDPC asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
The log matters most when consent is withdrawn, because section 16 expects you to act on it and to be able to show that you did.
FAQ
Singapore privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to organisations that collect, use or disclose personal data in Singapore, whatever their size, and it reaches organisations outside Singapore when they do so there. There is no revenue or headcount threshold, so a small website is covered in the same way as a large one.
The PDPA doesn’t name cookie banners. It requires consent before you collect personal data through advertising cookies, and the PDPC says a visitor who ignores a banner has not consented, so a banner is the practical way to ask and to keep the proof.
Cookies that collect personal data for purposes the visitor didn’t ask for, advertising being the clearest example. Cookies supporting something the visitor clearly requested, such as logging in, security, remembering preferences, network management or streaming, can run without separate consent.
Yes, up to a point. The PDPC says a visitor who configures a browser to accept some cookies and reject others may be taken to have consented to the ones they accepted. It also says the opposite does not follow: leaving browser settings untouched is not consent.
Since 1 October 2022, up to 10% of annual turnover in Singapore for organisations with turnover above S$10 million, or S$1 million for everyone else, whichever is higher. The PDPC can also issue directions to stop collecting data or to destroy it.
Yes. Every organisation handling personal data has to appoint at least one DPO and make their contact details publicly available, either by registering them with the PDPC or by publishing them on your website. The DPO can be an employee or an outside provider.
Both are consent-based, and both give people rights over their data. The PDPA is more flexible about cookies the visitor clearly asked for, it allows browser settings to stand in for consent, and its fines are measured against Singapore turnover rather than global revenue. It also requires every organisation to name a DPO, which GDPR only asks of some.
See what GDPR requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Ask once, act on the answer, keep the proof
ConsentBit holds advertising scripts until a visitor agrees, honours a withdrawal straight away, and records every choice.
This page is a general overview of Singapore’s Personal Data Protection Act, not legal advice. The PDPA covers far more than cookies, including access and correction requests, overseas transfers, breach notification and the Do Not Call registry, which sit outside what a consent banner handles.