A PDPA checklist for your business website
If your website has a contact form, a newsletter sign-up, a booking page or analytics, it handles personal data. Singapore's Personal Data Protection Act (PDPA) sets the rules. This is a practical checklist from the build side. It is not legal advice; have your lawyer or your data protection officer approve the wording.
1. Know what you collect
List every place the site collects personal data: contact forms, newsletter boxes, checkout, booking tools, live chat, analytics and advertising pixels. You cannot protect or disclose what you have not listed.
2. Say why, at the point of collection
Next to each form, say in plain words what you will use the data for. "We use your details to reply to this enquiry" is clearer than a link to a 12-page policy.
3. Get consent where you need it
Do not pre-tick marketing consent boxes. If you want to send newsletters, ask separately from the enquiry itself.
4. Publish a privacy notice
Keep it short, current, and linked in the footer. State who to contact to access or correct data.
5. Check your analytics and tags
Review what Google Tag Manager, GA4, ad pixels and chat widgets actually load. Tags added by past agencies are often still running.
6. Limit access and keep it secure
Use strong, unique logins, turn on two-step verification, and remove access for people who have left. Do not email spreadsheets of customer data around.
7. Decide how long you keep data
Set a retention period for enquiries and delete on schedule. Keeping everything forever is a liability.
8. Know who is responsible
Name someone in the business who handles data questions and breach reports. The PDPC publishes current guidance on what to do if something goes wrong.
Where we fit in
We build forms, consent banners and tracking setups with these points in mind. The wording and the legal decisions stay with you. If you want a site reviewed, send us a brief.