The rule
The PDPA asks every organisation to "designate one or more individuals to be responsible for ensuring that the organisation complies with this Act" (section 11(3)). That person is usually called the data protection officer, or DPO.
Two more parts of section 11 matter:
- Their business contact details must be public. At least one designated person's business contact information has to be made "available to the public" (section 11(5)).
- Naming someone doesn't move the duty. The business stays responsible for the PDPA either way (section 11(6)).
PDPC's own page calls appointing a DPO "your mandatory first step in complying with the PDPA". Its FAQ says every organisation in Singapore that handles personal data must appoint at least one.
Who can be your DPO
For a one-person business, it can be you. For a team of five, it's usually the owner or whoever runs the office. The Act asks for an individual, and PDPC's FAQs fill in the rest:
| Question | PDPC's answer |
|---|---|
| Must the DPO be an employee? | No. "The DPO need not be an employee of the organisation." It can be an external service provider |
| Must they be Singaporean or based here? | No. "The PDPA does not prescribe the nationality of a DPO and where he/she should be based" |
| Can you name more than one? | Yes. Section 11(3) says "one or more individuals" |
PDPC's guidance also says the contact details should be reachable from Singapore during Singapore business hours, and that a phone number should be a Singapore number (Key Concepts guidelines, page 153).
Where their details go, since 1 September 2026
From 1 September 2026, the regulations name two places that meet section 11(5): a record about your business on PDPC's website, which PDPC calls registering your DPO, or a readily accessible part of your own website, such as the contact page (Personal Data Protection Regulations 2021, regulation 1A(1), as amended by S 580/2026).
Before that date, the first route was a record on ACRA's BizFile. Older guides, including PDPC's own Key Concepts guidelines from April 2026, still mention BizFile+, so read them with the date in mind.
What the job looks like in a small business
The Act doesn't list the DPO's tasks one by one. In a small business, the job is whatever keeps the business inside the PDPA, and most of it lands on the DPO's phone. These are the moments it shows up:
- A customer asks who can answer questions about their details. Section 20(1)(c) says you give them that person's business contact information on request.
- A customer asks what you hold on them, or asks you to correct it. Our guide to old customer records covers what to send and when.
- Someone says stop. Their withdrawal has to reach everyone who messages customers, the same day if you can manage it.
- A phone or a spreadsheet goes missing. The DPO decides whether it's a notifiable breach, and our breach guide walks through how.
- A new form or a new list goes out. The DPO checks the purpose is told and the consent boxes start unticked.
PDPC and IMDA also run Data Protection Essentials, a framework for SMEs to reach a basic level of data protection. PDPC says that if a breach happens, it "may consider an organisation's implementation of the DPE framework favourably" when it decides what to do.
Answering customers' questions from the record
Most DPO questions come down to one customer and one question: what did they agree to, and what do we hold? In Palby CRM, both sit on the customer's record. Consent for WhatsApp, email and calls shows with when and how it was given, and each change goes into the record's history with its date. You choose who on your team sees each pipeline, so fewer people can download the list. When a customer asks, you can download the pipeline as a spreadsheet or delete them. There's no one-tap request form yet.
30 minutes. You choose the day and the time.
Book a walkthroughKeep reading
- Security in Palby CRM
Questions about data protection officers
Yes, if it handles personal data. Section 11 asks every organisation to name at least one person responsible for the PDPA and to publish their business contact details.
Yes. The Act asks for one or more individuals, and nothing stops that being the owner.
Yes. PDPC says the DPO need not be an employee and can be an external service provider. The business stays responsible either way.
Since 1 September 2026, either in a record on PDPC's website or in a readily accessible part of your own website. Before that, the first option was ACRA's BizFile.
No. PDPC says the PDPA doesn't set a nationality or a location. Its guidance asks for contact details that work from Singapore during business hours.
Sources
- PDPA 2012 s11(3) to (6) and s20(1)(c) (sso.agc.gov.sg/Act/PDPA2012, current version as at 2 Nov 2026), read 2 Nov 2026
- Personal Data Protection Regulations 2021, reg 1A, amended by S 580/2026 with effect from 1 Sep 2026, and the version in force 2 Mar to 31 Aug 2026 (sso.agc.gov.sg/SL/PDPA2012-S63-2021), read 2 Nov 2026
- PDPC "Getting started as a data protection officer" page and PDPC FAQs (pdpc.gov.sg), read 2 Nov 2026
- PDPC Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, page 153, read 2 Nov 2026
- PDPC "Data Protection Essentials" page (published 27 Mar 2026), read 2 Nov 2026