Designate a Data Protection Officer
Appoint a Data Protection Officer (DPO) — this can be an existing staff member, including an owner wearing multiple hats, as long as they take on the DPO responsibilities.
Appoint a Data Protection Officer (DPO) — this can be an existing staff member, including an owner wearing multiple hats, as long as they take on the DPO responsibilities. You must also make the DPO's business contact details available to the public, for example on your website, at the premises, or on request.
The PDPA has no small-business exemption — every organisation, regardless of size or turnover, has to comply, and the PDPC can issue financial penalties for breaches, including for not having a designated DPO with published contact details.
Who this is for
Every organisation, including a single-site café or bar with no dedicated admin staff.
What you’ll hold
- DPO name and business contact details, published (website/premises/on request)
Watch out for
- Assuming a small F&B operator is exempt because of its size — it isn't, PDPA applies to every organisation with no small-business carve-out.
- Naming a DPO internally but never publishing their contact details — the obligation includes making the DPO's business contact information available to the public, not just deciding who holds the role.
- Never revisiting the appointment — if the DPO leaves or changes role, the published contact details need updating too.
Sources
- PDPC — Appoint a Data Protection Officer checked 2026-09-08
- PDPC — The Openness Obligation, advisory guidelines checked 2026-09-08
See also
This is item 6 of 36 in the free Singapore Launch Checklist. See the whole list →