Last Updated on October 26, 2026 by Narendra Sahoo
A privacy policy on your website says little about whether you comply with the Personal Data Protection Act 2012 (PDPA). What counts is whether people, systems and vendors follow it. The stakes are real: the PDPC can impose penalties of up to S$1 million, or 10% of annual Singapore turnover where that exceeds S$10 million, whichever is higher.
A structured PDPA audit helps you find those gaps before a complaint or incident does. Each of the 12 areas below shows what to review, why it matters, the evidence to gather and one action. Work through it with your DPO, scoring each item met, partly met or not met.
What Is a PDPA Compliance Audit?
A PDPA compliance audit checks how your organisation collects, uses, discloses, protects, retains and disposes of personal data against the Act and its regulations. It’s not a document count: it samples records, checks system settings and talks to the people handling the data.
You can run it internally, usually led by your DPO, or bring in an independent assessor. Internal reviews suit routine checks; independent ones add objectivity when your board or customers want assurance.
Either way, it isn’t a government certification. For certification, look to the Data Protection Trustmark, now Singapore Standard SS 714:2025, issued by certification bodies under Singapore Accreditation Council oversight.
PDPA Audit Checklist for Singapore Businesses
Obligations depend on your role. Public agencies are outside them, and a data intermediary acting for another organisation under a written contract mainly has protection and retention duties, plus reporting breaches to that organisation (s 4). Exceptions can apply too (PDPC’s summary). Tags cite the Act and 2021 Regulations; “Good practice” isn’t a legal requirement.
Identify personal data collected and processed
Good practice
Review: what personal data you hold, where it flows and why.
Why: you can’t protect data you haven’t found.
Evidence: data inventory, data flow maps.
Action: map one high-volume process end to end.
Review consent and notification practices
s 13–17, 20
Review: each collection point and the consent or exception it relies on.
Why: you generally must state the purpose on or before collection.
Evidence: privacy notices, consent and withdrawal records.
Action: check live forms against your notice.
Verify the DPO’s appointment and responsibilities
s 11
Review: who’s designated, their written duties and whether contact details are public.
Why: it’s mandatory. Under the amended Regulations (1 September 2026), a PDPC DPO Registry listing or your official website meets the publication rule.
Evidence: appointment letter, Registry entry.
Action: confirm your listed contact is current.
Examine policies and accountability measures
s 12
Review: policies, a complaints process, staff communication and availability on request.
Why: section 12 requires all four.
Evidence: approved policies, complaints log.
Action: give each policy an owner and review date.
Assess access controls and security safeguards
s 24
Review: access provisioning and removal, encryption, logging, patching, backups.
Why: the Act requires reasonable security arrangements, not a fixed control list.
Evidence: access reviews, penetration test reports.
Action: review user access on your most sensitive system.
Review third-party vendors and data processors
s 4(3), 26C(3)
Review: which vendors process personal data for you.
Why: you carry the same obligations as if you processed it yourself.
Evidence: vendor register, contracts.
Action: confirm contracts require prompt breach notification to you.
Check overseas personal data transfers
s 26; Regs 10–12
Review: what data leaves Singapore and on what basis.
Why: you must generally ensure recipients are bound to comparable protection. Since 2 March 2026, Global CBPR and (for data intermediaries) Global PRP certifications also count.
Evidence: transfer register, contract clauses.
Action: record each offshore provider’s transfer basis.
Examine data retention and secure disposal
s 25
Review: your retention schedule and whether systems and backups follow it.
Why: data no longer needed for its purpose, or for legal or business reasons, must go or be anonymised.
Evidence: deletion logs, disposal certificates.
Action: test one dataset past its retention date.
Review access and correction request procedures
s 21–22; Regs 3–5
Review: how requests are received, verified, logged and answered.
Why: you must tell the applicant in writing within 30 days if you need longer, and when you’ll respond.
Evidence: dated request log.
Action: time a test request.
Assess breach response and notification readiness
s 26A–26E
Review: whether your plan covers the notifiability tests, including the 500-person threshold.
Why: assess within 30 calendar days, per PDPC’s guide, then, if it’s notifiable, notify the PDPC within 3 calendar days of that assessment.
Evidence: breach register, assessment records.
Action: run a tabletop exercise.
Evaluate employee awareness and training
Supports s 12(c)
Review: induction and refresher training by role.
Why: you must communicate policies to staff; training records show you have.
Evidence: training records, acknowledgements.
Action: add HR and customer service scenarios.
Document findings and build a remediation plan
Good practice
Review: whether each finding has an obligation, risk rating, owner and date.
Why: unowned findings are hard to close.
Evidence: findings register, management sign-off.
Action: take top risks to senior management.
Common PDPA Audit Gaps Businesses Should Check
These are illustrative issues worth testing for, not statistics about how often they occur:
- •Outdated privacy notices that no longer match how data is used, for example after a new analytics tool goes live.
- •Incomplete personal data inventories that cover core systems but miss spreadsheets, shared drives, backups and SaaS tools.
- •Weak vendor oversight that ends once the contract is signed.
- •Unclear retention procedures, where the policy sets periods but systems never delete anything.
- •Thin incident response documentation that can’t show how notifiability was assessed or how the 3-day deadline was met.
One gap can point to another. A notice that doesn’t match current processing suggests the inventory behind it needs checking too.
How Often Should Singapore Businesses Conduct a PDPA Audit?
The PDPA’s accountability provisions don’t set an audit cycle, so frequency is a risk decision. Weigh the volume and sensitivity of your personal data, how often your systems, vendors and processes change, and whether sector rules or customer contracts set their own requirements. A yearly review is a sensible baseline for many organisations, with targeted reviews after a breach, a major system change, a new offshore vendor or an acquisition, and before applying for DPTM.
How VISTA Infosec Supports PDPA Audit Readiness
For an outside view, VISTA Infosec runs PDPA gap assessments, privacy compliance reviews, data protection control assessments and documentation reviews for Singapore organisations, and turns the findings into practical remediation recommendations. We test controls against evidence rather than taking documents on trust, and as a CREST-accredited firm we can test the technical safeguards behind the Protection Obligation ourselves.
Singapore engagements are contracted through VISTA Infosec Pte. Ltd. We don’t issue PDPA certificates and we aren’t a DPTM certification body. You can read more about our PDPA audit and compliance consulting services in Singapore.
Frequently Asked Questions
Is a PDPA audit mandatory for every business in Singapore?
Not as a stand-alone requirement. Sections 11 and 12 require a DPO and policies that meet your obligations, but don’t prescribe a periodic audit. An audit checks those measures work.
What documents are needed for a PDPA compliance audit?
Data inventory, privacy notices, consent records, policies, DPO appointment, vendor contracts, transfer records, retention schedule, request log, breach plan and training records.
How long does a PDPA audit take?
It depends on scope. One entity with a few systems is a far smaller job than a multinational group. Agree scope first; the timeline follows.
Can a PDPA consultant help identify compliance gaps?
Yes. A consultant brings independence, tests controls against evidence and helps prioritise fixes. They can’t certify compliance, and legal questions need a lawyer.
Putting the Checklist to Work
A checklist only helps if it changes something. Work through these 12 areas with your DPO, gather the evidence as you go and be honest about what’s only partly met. Fix the highest-risk gaps first, then repeat the review whenever systems, vendors or the business change.
Narendra Sahoo (PCI QSA, PCI SSFA, CISSP, CISA, CRISC, 27001 LA) is the Founder and Director of VISTA InfoSec, a global information security consulting firm. With 21 years of experience in information security consulting, assessment and compliance services, Narendra has helped organizations address complex cybersecurity and regulatory requirements across global markets.
