PDPA Singapore: A Guide for Law Firms

PDPA Singapore obligations reach across a law firm, from client intake and conflict checks to evidence handling, recruitment and marketing. The practical task is to identify what personal data the firm handles, why it needs that data, which consent route or legal exception applies, and how the data will be kept accurate and protected.

PDPA Singapore: what law firms need to know

The Personal Data Protection Act 2012 (PDPA) is Singapore’s principal law governing how organisations collect, use and disclose personal data. It recognises both individuals’ interests in protecting their data and organisations’ legitimate need to handle it for appropriate purposes. The Act sets out obligations covering accountability, consent and notification, purpose limitation, access and correction, accuracy, protection, retention, overseas transfers and data-breach notification.

Client contact details, instructions, correspondence, witness accounts, employment records and billing information can all raise PDPA questions. The Act’s scope and exceptions matter: not every piece of information in a file is subject to every obligation. Business contact information, for example, has distinct treatment under the Act. A firm should identify the information and its intended use rather than assume that every record is governed in the same way.

The Personal Data Protection Commission (PDPC) can direct an organisation to pay a financial penalty of up to 10% of its annual Singapore turnover where that turnover exceeds S$10 million, or up to S$1 million in any other case (section 48J of the PDPA).

How the PDPA applies to a law firm’s files

A useful firm-wide data map separates people and activities instead of treating every file as one undifferentiated privacy problem.

• Clients and prospective clients: intake information, identity documents, instructions, conflict-check data, engagement records, invoices and communications.
• Employees and candidates: recruitment submissions, payroll and benefits information, performance records, emergency contacts and access logs.
• Matter participants: witnesses, experts, interpreters, insurers, mediators, service providers and court-facing contacts.
• Counterparties and opposing parties: contact information, pleadings, correspondence, evidence and transaction documents.

Counterparty data does not mean that a firm must obtain consent for every activity. Under section 13 of the PDPA, an organisation must not collect, use or disclose personal data unless the individual consents or is deemed to consent, or the activity without consent is required or authorised by the PDPA or another written law.

Identify the particular activity (such as checking a name for conflicts, preparing a witness statement, corresponding on a transaction or complying with an order) and record its purpose and applicable permission or exception. “The file is legal work” is not, by itself, a consent basis or statutory exception.

PDPA compliance also sits alongside professional confidentiality and legal professional privilege. A disclosure permitted under the PDPA may still be restricted by duties owed in a matter. Equally, treating material as confidential or privileged does not replace an assessment of how the firm collects, secures, retains or transfers personal data.

Consent, deemed consent and statutory exceptions

Consent is one route to handling personal data. Where a firm relies on it, the consent and accompanying notice should address the identified purpose. The PDPA also recognises deemed consent in specified circumstances; it is not a general licence for later, unrelated uses.

Under section 15(1), deemed consent based on voluntary provision depends on the purpose for which the individual provided the data and whether it was reasonable to provide it for that purpose. Piper, Martin v Singapore Kindness Movement [2025] SGHC 173; [2025] 5 SLR 293 illustrates the importance of identifying the purpose objectively rather than assuming that voluntary provision permits any subsequent use.

The Act separately provides for deemed consent connected with contractual necessity and, subject to its conditions, notification. It also addresses withdrawal of consent. A firm relying on one of these routes needs a process to record the basis, respond to withdrawal and assess whether another lawful basis permits continued handling of the data.

Use exceptions by activity, not by a blanket file label

Statutory exceptions can differ for collection, use and disclosure. Depending on the facts, provisions concerning legal advice or legal proceedings may be relevant, but their scope and conditions must be read in the applicable schedules to the PDPA. An exception for one activity should not be assumed to cover every subsequent activity.

A useful matter record identifies the data, activity, purpose and applicable consent route, exception or other written-law authorisation. That is more useful than a generic assertion of “legitimate legal interests”.

Purpose limitation and notification

Section 18 of the PDPA limits collection, use and disclosure to purposes a reasonable person would consider appropriate in the circumstances. The Act also contains a notification obligation: where it applies, the organisation must inform the individual of the purposes for collecting, using or disclosing personal data.

For a firm, purposes may include evaluating an engagement, checking conflicts, conducting a matter, communicating with relevant participants, billing and meeting legal requirements. The purpose should describe what the firm actually does; it should not be so broad that it obscures a materially different use.

A recruitment CV does not automatically become marketing data, transaction contacts should not automatically enter a general business-development list, and a litigation file should not be accessible to staff without a matter-related need. Each secondary use calls for its own purpose, notification and permission analysis.

Access, correction and accuracy

Individuals have PDPA access and correction rights, subject to statutory exceptions. A firm should provide a route for receiving requests, identify the records within its possession or control, review applicable restrictions and document its response. Requests should be handled within the Act’s requirements rather than left in an ordinary matter inbox.

Privilege may restrict access to particular information, but it does not automatically remove an entire legal file from the access regime. Review the information requested and the applicable exception before deciding what can be provided or corrected.

Section 23 of the PDPA requires reasonable efforts to ensure personal data is accurate and complete if it is likely to be used to make a decision affecting the individual, or disclosed to another organisation. Before such a use or disclosure, check relevant client, witness, employee or other personal data against the information available, and address material discrepancies.

Protection, retention and overseas transfers

Under section 24 of the PDPA, an organisation must make reasonable security arrangements to protect personal data in its possession or under its control. For a law firm, appropriate controls may include matter-based access, secure sharing, authentication, logging, device management, backup controls, supplier review and prompt removal of access when someone leaves a matter.

Section 25 requires an organisation to cease retaining documents containing personal data, or remove the means of associating the data with particular individuals, once it is reasonable to assume that retention no longer serves the collection purpose and is no longer necessary for legal or business purposes. A file-closure schedule should account for continuing legal or business needs, legal holds, archives and backups; storage capacity alone is not a retention policy.

Under section 26, transfers of personal data outside Singapore must meet the PDPA’s requirements for a comparable standard of protection. Cloud hosting, e-discovery, managed IT and collaboration tools can all warrant a transfer review. Identify where data goes, who can access it and what protections apply before a matter team uploads material.

Technology procurement should therefore include a data-flow review alongside security and matter-management decisions. For related operational considerations, see how midsize law firms scale with technology.

PDPA data breach notification: thresholds and timelines

A breach plan should separate detection, containment, assessment, determination and notification. The statutory deadline for notifying the PDPC follows a determination that a breach is notifiable; it is not simply three days from discovering an incident.

Under section 26B of the PDPA, a breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or is of significant scale. A breach affecting 500 or more individuals meets the significant-scale threshold. The firm should assess the nature of the data and likely harm as well as the number of people affected.

Section 26C requires a firm that has reason to believe a data breach has occurred to assess whether it is notifiable in a reasonable and expeditious manner. PDPC guidance expects organisations to take all reasonable steps to complete that assessment within 30 calendar days of first having reason to believe the breach occurred. A data intermediary, such as an IT or e-discovery provider processing data for the firm, must notify the firm without undue delay if it has reason to believe a breach has occurred.

Under section 26D, once an organisation determines that a breach is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days after the day of that determination. It must also notify affected individuals as soon as practicable after notifying the PDPC if the breach has resulted in, or is likely to result in, significant harm to them, subject to statutory exceptions and any applicable PDPC direction. Significant scale alone calls for PDPC notification, not notification to individuals. Exceptions to individual notification can apply, for example, where effective remedial action or protective technological measures make significant harm unlikely.

A law firm’s playbook should name decision-makers, preserve evidence, identify affected systems and individuals, involve matter counsel early and record the reasons for its notifiability decision. Assess client communication, confidentiality and any separate contractual duties alongside the PDPA analysis, not instead of it.

DPO and Do Not Call duties in brief

Under section 11 of the PDPA, an organisation must designate at least one individual to be responsible for ensuring its compliance and make the designated individual’s business contact information available to the public. The data protection officer (DPO) needs a workable route to coordinate practice teams, IT, HR, finance and supplier management, not merely an inbox.

Part 9 of the PDPA governs specified marketing messages sent to Singapore telephone numbers through its Do Not Call Registry requirements. These are not a general ban on communications needed to conduct a legal matter. Before sending marketing calls, texts or faxes, a firm should assess the applicable register-check or consent requirements and ensure its messages carry the required sender and contact information.

A practical compliance check for a law firm

1. Inventory: map personal data across matters, HR, finance, marketing, systems, archives, backups and suppliers.
2. Document purpose and permission: record the purpose and applicable consent route, statutory exception or other written-law authorisation for recurring activities.
3. Review notices: align client intake, recruitment, website and event notices with actual practices.
4. Check accuracy: verify relevant client, witness, employee or other personal data before using it to make a decision affecting that person or disclosing it to another organisation.
5. Control access and retention: apply matter-level permissions, file-closure rules, legal holds and secure disposal processes.
6. Review suppliers and transfers: assess cloud, e-discovery, managed IT and collaboration providers, including overseas data flows.
7. Maintain breach readiness: test escalation, containment, assessment, documentation and notification workflows, including data-intermediary escalation.
8. Keep DPO details current: publish the required business contact information and give the DPO a route to act across the firm.

This is general information about Singapore law as at 6 November 2026, not advice on a particular matter. Apply the current legislation and relevant professional duties to the facts of each case.

Next step: explore Lexi for AI-native legal technology for law firms, litigators and in-house teams.