Yes, the Personal Data Protection Act applies to a small service business. It covers any organisation in Singapore that collects, uses or discloses personal data, whatever its size, and an enquiry form, a WhatsApp thread or a folder of site photos all fall inside it.
In practice it asks for six things: tell people why you are collecting their details, and ask where you need to; appoint and publish a Data Protection Officer; keep data only while you have a reason to; protect it reasonably; report serious breaches against a fixed clock; and check the Do Not Call Registry before promotional messages. Most of that is a few hours of writing things down. Each is covered below, with the PDPC page it comes from.
Does the PDPA apply to a small service business?
It does. The PDPC says plainly that the PDPA applies to all organisations in Singapore that handle personal data, regardless of size. Its list of obligations and its Do Not Call guide are where the six above come from.
Personal data is data about an individual who can be identified from it, or from it combined with other information you have or are likely to have, as the PDPC's Key Concepts guidelines put it. For a renovation or interior design business that means names, mobile numbers, email addresses and the address of the property, which together identify a homeowner, plus quotation records and chat history.
Site photos are the less obvious case. A photo of a bare wall is not personal data on its own. A photo that shows a person, or that you file against a named homeowner and an address, can be, because the test includes other information you hold. The guidelines also exclude business contact information, details given in a business capacity rather than solely for personal purposes, from the data protection rules.
Do I need consent before I keep an enquirer's details?
Usually you need consent, or the situation has to count as deemed consent, and in both cases the person must know what you will use the details for. The PDPC's obligations are notification, consent and purpose limitation: tell people the purposes, collect and use data only for those purposes, and only for purposes a reasonable person would consider appropriate.
Someone who fills in your enquiry form has volunteered their details, and the Key Concepts guidelines recognise deemed consent by conduct where the purpose is objectively obvious. Their taxi example is useful by analogy: a caller who gives a name and number to book a taxi is deemed to agree to being contacted about that booking, but not to being marketed a limousine service. Replying to an enquiry is the first case. Adding that person to a promotions list is the second.
The practical step is a short notice on your enquiry form and website saying what you collect and why. The PDPC offers a free Data Protection Notice Generator for a basic version.
Does a small business really need a Data Protection Officer?
Yes. The PDPC states that every organisation in Singapore that handles personal data must appoint at least one DPO, and that the DPO can be an employee or an external service provider. The role can sit alongside an existing job.
You must also make the DPO's business contact details publicly available. The PDPC gives two routes: submit them for the PDPC's DPO Registry, or publish them on your own website, in which case keeping them accurate is your responsibility. The DPO's job is to oversee compliance, handle requests and complaints, and be the contact point with the PDPC. The accountability obligation also expects you to make information about your data protection policies, practices and complaints process available on request.
How long can I keep customer details, and how do I protect them?
You can keep them for as long as the purpose they were collected for is still being served or you have a legal or business reason, and no longer. The PDPC's guidelines say the Retention Limitation Obligation does not set a fixed period. It is judged on reasonableness, and data should not be kept “just in case” for purposes you never told the person about. As one illustration of a legal reason, the same guidance notes that contract claims fall under the Limitation Act and that an organisation may wish to keep contract records for seven years after the contract ends. That is an example, not a rule.
Write your own rule per kind of record, such as completed contracts and enquiries that never went ahead.
Protection means “reasonable security arrangements”, which the PDPC says has no one-size-fits-all form. Its own examples are within a small firm's reach: confidentiality terms in employment agreements, holding only the amount of personal data you need, need-to-know access, access controls and stronger authentication where appropriate, screen locks, disposing of data on devices before they are recycled or sold, and checking that your IT providers can meet the standard.
Using a cloud provider does not move the responsibility. The PDPC says the organisation remains accountable even when the provider acts as a data intermediary, and recommends a clear contract that spells out the provider's part.
What do I have to do if customer data leaks?
Assess it quickly, and if it is notifiable, tell the PDPC within three calendar days of deciding that it is. The PDPC's guide on managing and notifying data breaches sets out the sequence.
Once you have credible grounds to believe a breach has happened, you must take reasonable and expeditious steps to assess whether it is notifiable, within 30 calendar days, and document those steps. A breach is notifiable if it is likely to cause significant harm to the individuals affected, or if it involves the personal data of 500 or more individuals. Then you must notify the PDPC as soon as practicable and in any case within three calendar days, counted from the day after you determine that it is notifiable. Where significant harm is likely you must also notify the affected individuals, at the same time as or after the PDPC. The PDPC's notification page repeats the three-day rule and carries the reporting form.
Take a hypothetical firm whose office manager loses a phone holding customer WhatsApp chats. Who decides whether that is notifiable, and who files the report, should be settled beforehand, not on the day.
Can I WhatsApp past customers about a promotion?
Only after checking the Do Not Call Registry or holding clear consent. The PDPC's guide to the DNC provisions says that before sending a marketing message to a Singapore number you must check the Registry within the 21 days before sending, unless the recipient has given valid consent. The advisory guidelines on the DNC provisions say the rules apply to any data application, naming WhatsApp, that uses a Singapore telephone number.
Two details matter for service businesses. Consent must be a positive action that relates specifically to those messages, not something buried in general terms and conditions. And the ongoing-relationship exception covers things like a membership or subscription: the PDPC says one-off transactions are not enough. A finished renovation is closer to a one-off, so do not assume an old client may be messaged freely.
Messages strictly about the relationship, like an appointment reminder or billing notice, need no check, but adding a promotion makes one a marketing message. Honour an opt-out within 21 days.
What should a small business do this month?
- Appoint a DPO and register their details with the PDPC or publish them on your website.
- List where personal data lives: enquiry inbox, WhatsApp, quotation files, site photo folders, accounting software, and who has access to each.
- Add a short notice to your enquiry form saying what you collect and why.
- Write a retention rule for each kind of record, and delete or archive what has no purpose left.
- Close the obvious security gaps: shared logins, former staff with access, unlocked phones and laptops.
- Write a one-page breach plan: who assesses, who reports, where the three-day clock is recorded.
- Set a marketing rule: no promotional WhatsApp without a Registry check or ticked, specific consent.
When you do not need to buy anything
For most owner-managed firms none of this needs consultants or software. The PDPC offers free tools, including the PDPA Assessment Tool for Organisations (PATO), the notice generator and a free e-learning course that it says takes about 60 minutes, all linked from its DPO starter guide. Money is better spent once a real gap appears, such as personal data scattered across five systems nobody can list.
This is a practical starting point, not legal advice. The PDPC says non-compliance can bring a fine of up to S$1 million or 10% of annual Singapore turnover for turnover above S$10 million, whichever is higher, so for anything unusual, ask a lawyer or the PDPC.
When we build an enquiry form, a quotation tool or an automated follow-up, these obligations are design questions settled at the start: what each field is for, where the data sits and who can reach it. Our Launch Site (S$2,800, two to three weeks) includes the enquiry form and domain deployment, and our automations run on accounts in your business's name, so the data stays yours. We are not lawyers; for anything unusual, the PDPC or a lawyer is the right call.
