Singapore is a favourite APAC base for startups because its rules are clear and its regulators publish practical guidance. The Personal Data Protection Act (PDPA) is principles-based but backed by penalties of up to 10% of Singapore turnover. AI is governed through voluntary frameworks and testing tools rather than a statute.
Fintech and digital-asset startups face the Monetary Authority of Singapore (MAS), and platforms face a growing online safety regime, including an Online Safety Commission operating since June 2026.
- Core data law
- Personal Data Protection Act 2012 (amended 2020)
- Regulator
- Personal Data Protection Commission (PDPC)
- AI
- Voluntary: Model AI Governance Framework (incl. GenAI), AI Verify
- Online safety
- Online Safety Commission from 29 Jun 2026
- Fintech & crypto
- MAS: Payment Services Act, technology risk guidelines
- Maximum PDPA penalty
- 10% of Singapore turnover (above S$10m) or S$1m
Who needs to comply
Any organisation collecting personal data in Singapore
The PDPA applies to private-sector collection, use and disclosure of personal data in Singapore, including by foreign organisations.
Businesses sending marketing messages
The PDPA’s Do Not Call provisions and the Spam Control Act govern calls, SMS and email marketing.
Payments, wallets and digital-token businesses
The Payment Services Act requires licences for payment and digital payment token services; MAS technology risk rules apply.
Social and UGC platforms
The Online Safety Act framework and the Online Safety (Relief and Accountability) Act create duties and victim remedies.
AI companies selling to enterprise and government
Buyers increasingly expect alignment with the Model AI Governance Framework and AI Verify testing.
The laws, in detail
01Personal Data Protection Act (PDPA)
Consent, purpose limitation, notification, access and correction, protection, retention, transfers, breach notification and data portability.
When it applies
Organisations collecting, using or disclosing personal data in Singapore.
What you must do
- Obtain consent or rely on exceptions such as legitimate interests and business improvement
- Notify purposes; allow access and correction
- Reasonable security arrangements
- Notify the PDPC within 3 calendar days of assessing a notifiable breach
- Transfer limitation: comparable protection for overseas transfers
- Appoint a Data Protection Officer and publish their contact details
Regulator
PDPC
Penalties
Up to 10% of annual Singapore turnover for organisations above S$10 million, otherwise up to S$1 million.
02Do Not Call provisions & Spam Control Act
Telemarketing and unsolicited commercial electronic messages.
When it applies
Sending marketing calls, SMS or emails to Singapore numbers and addresses.
What you must do
- Check the DNC Registry before calling or texting
- Include unsubscribe facilities
- Do not use dictionary attacks or address harvesting
Regulator
PDPC; IMDA
Penalties
Financial penalties and offences.
03Payment Services Act & MAS rules
Licensing of payment and digital payment token (DPT) services; technology risk and outsourcing.
When it applies
Providing payment services or DPT services in or from Singapore.
What you must do
- Obtain the right licence (money-changing, standard or major payment institution)
- AML/CFT controls, including the Travel Rule for DPT
- MAS Technology Risk Management Guidelines and incident reporting
Regulator
Monetary Authority of Singapore
Penalties
Criminal and civil penalties; licence action.
04Online safety laws
Codes of practice for platforms, and a statutory route for victims of online harms.
When it applies
Online communication services and platforms accessible in Singapore.
What you must do
- Respond to user reports promptly
- Act on Online Safety Commission directions
- Meet IMDA codes of practice where designated
Regulator
IMDA; Online Safety Commission
Penalties
Directions, blocking orders and penalties for non-compliance.
05Cybersecurity Act 2018 (amended 2024)
Critical information infrastructure and certain foundational digital infrastructure.
When it applies
Designated CII owners and some cloud and data centre providers.
What you must do
- Incident reporting
- Codes of practice and audits
Regulator
Cyber Security Agency of Singapore
Penalties
Fines and offences under the Act.
06AI governance frameworks (voluntary)
Model AI Governance Framework, its 2024 generative AI edition and the AI Verify testing toolkit.
When it applies
Voluntary for all; expected by many enterprise and public-sector buyers.
What you must do
- Accountability and human oversight
- Transparency and incident reporting practices
- Testing and assurance
Regulator
IMDA; PDPC
Penalties
None directly; PDPA and sector rules still apply.
Compliance checklist
01 · Before you launch
- Appoint a DPO and publish contact details
- Map purposes, consents and exceptions
- Check whether you need an MAS licence
- Set up DNC Registry checks for marketing
02 · At launch
- Breach plan with the 3-day PDPC notification clock
- Transfer clauses for overseas processing
- Unsubscribe in every marketing message
- User reporting tools for UGC
03 · As you scale
- Align AI governance with the Model Framework and AI Verify
- MAS technology risk programme if licensed
- Annual PDPA programme review
Key dates
- 1 Feb 2021PDPA amendments: mandatory breach notification
- 1 Oct 2022Higher PDPA penalties (10% of turnover)
- May 2024Model AI Governance Framework for Generative AI
- 29 Jun 2026Online Safety Commission begins operations
Common mistakes
- Assuming consent is always needed; Singapore has useful exceptions, but they must be documented.
- Missing the 3-day breach notification window.
- Launching token or wallet features without checking the Payment Services Act.
FAQs
Does the PDPA apply to foreign companies?
Yes, to organisations that collect, use or disclose personal data in Singapore, whether or not they are based there.
Is there an AI law in Singapore?
No. AI is governed through voluntary frameworks, sector guidance and existing laws such as the PDPA.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.