The short version
If you’re the only director, you can be your company’s data protection officer, the person responsible for making sure it follows Singapore’s personal data law. DPO is the short name for a data protection officer in Singapore.
Registering the officer with the Personal Data Protection Commission (PDPC), the government body that oversees and enforces that law, is optional. But a way to reach the officer, such as a work email address, must be public.
To register, use PDPC’s online DPO Registration Form. The form says filling it in takes about 10 minutes. The steps further down cover the login you need first.
- Every company needs a DPO, whatever its size. The Accounting and Corporate Regulatory Authority (ACRA), the government body that registers businesses, says “All organisations are required to appoint” one. PDPC adds that the law applies to organisations that handle personal data “regardless of size”.
- The only director can be it. The law asks for “one or more individuals”. PDPC’s guidelines say the person need not be an employee. Ideally, they’re in senior management or report to it.
- The contact must be public. Regulations under the law name two ways that count as making it public. Since 1 September 2026, the first is a public list of DPOs on PDPC’s website. The second is an easy-to-find page on the company’s own website.
- Registering is voluntary. PDPC’s form says so. But a company with no website can use only the first way: registering.
- DPO details filed before December 2024. Bizfile, the website where companies file with ACRA, stopped taking DPO details on 1 December 2024. If your company’s DPO was filed there, check whether it shows on PDPC’s list.
- If a company has no DPO. PDPC can order it to follow the rule. If the company broke the rule deliberately or carelessly, PDPC can also make it pay a financial penalty. For a company with S$10 million or less of yearly sales in Singapore, the penalty can be up to S$1 million. Above S$10 million, it can be up to 10% of the company’s total yearly sales in Singapore.
This post is for company owners and directors, not for people looking for DPO jobs. Every rule here links to the official page or law it comes from, all read on 21 October 2026.
- Why a one-person company still needs a data protection officer
- Who can be the DPO when you’re the only director
- Which contact details must be public
- The two ways to make the contact public, and the 1 September 2026 change
- How to register your DPO with PDPC, step by step
- What a DPO does in a company of one
- What happens if a company has no DPO
Why a one-person company still needs a data protection officer
ACRA’s guide for new local companies says: “All organisations are required to appoint a Data Protection Officer (DPO) under the Personal Data Protection Act 2012.” That Act is the PDPA, Singapore’s personal data law.
Section 11(3) sets the duty: “An organisation must designate one or more individuals to be responsible for ensuring that the organisation complies with this Act.” To designate someone is to name them for the role.
A company is an organisation under the Act. Section 2(1) says an organisation “includes any individual, company, association or body of persons”. The definition sets no size and no number of staff.
Section 4(1) says the Act’s data protection duties don’t apply to four groups:
- individuals acting in a personal or domestic capacity
- employees acting in the course of their employment
- public agencies
- any other organisations, or kinds of personal data, named in regulations made under the Act
A company is none of the first three. And none of the regulations made under the Act (listed on Singapore Statutes Online) names any group for the fourth.
PDPC has a page for organisations and their DPOs, Kickstart Your Data Protection Journey. It says: “Every organisation in Singapore that handles personal data must appoint at least one DPO.” Section 11(3), quoted above, doesn’t limit the duty to organisations that handle personal data.
Personal data is data about a person who can be identified from it (section 2(1)). Data also counts if a person can be identified from it together with other information the organisation has or is likely to have access to.
ACRA’s guide lists the DPO among the steps to complete “before you start operations”. Section 11(3) itself sets no deadline.
PDPC calls appointing a DPO “your mandatory first step in complying with the PDPA”. It’s one of the tasks in the first-year calendar in this site’s post on company registration.
Who can be the DPO when you’re the only director
The Act asks a company to designate “one or more individuals” (section 11(3)). An individual is “a natural person”, a human being rather than a company (section 2(1)). The Act names no job title or rank for the role.
In my own company, I registered myself as the data protection officer.
PDPC’s Advisory Guidelines on Key Concepts in the PDPA say what it expects of the person, in paragraph 21.5. They should be “sufficiently skilled and knowledgeable”, with enough authority for the role, “although they need not be an employee of the organisation”. Ideally they’re “a member of the organisation’s senior management team”, or report directly to it.
Nothing in section 11 of the Act or in the guidelines’ part on appointing a DPO stops a company’s only director from taking the role.
PDPC’s step-by-step guide shows its registration form asking whether the person filing is the DPO. The first answer reads “I am the DPO of the organisation” (page 6). So the person filing can name themselves.
Paragraph 21.5 of the guidelines also says: “Organisations should ensure that individuals appointed as a DPO are trained and certified.” That’s PDPC’s guidance, a “should”, not a rule in the Act, which sets no qualification. Its footnote gives one example, the “Practitioner Certificate for Personal Data Protection (Singapore)”.
PDPC’s Kickstart page also points to its free tools and resources, among them the Notice Generator described below.
The DPO can pass the work on: the Act lets a designated person “delegate to another individual” the responsibility (section 11(4)). Either way, the company stays responsible. Naming a DPO “does not relieve the organisation of any of its obligations” (section 11(6)).
PDPC’s guidelines add that the DPO “may also be the primary contact point” for the company’s data protection matters (paragraph 21.6).
The role can also go outside the company. PDPC’s Kickstart page says “The DPO can be an employee or an external service provider.” The Act still asks for individuals, so the company names a person at the provider.
Which contact details must be public
What must be public is what the Act calls business contact information. It means a person’s name, job title, work phone number, work address, work email, work fax or similar details (section 2(1)). Details a person gives “solely for his or her personal purposes” don’t count.
A company must make business contact information public for at least one person it designates. The Act says it “must make available to the public” that information (section 11(5)), but not which details. PDPC’s guidelines add two points, both worded “should”:
- A written channel. At least one detail should be “a mailing address (e.g. the office address) or an electronic mailing address”, meaning a postal or email address. It’s for answering written requests to see or correct personal data (the guidelines’ note 85).
- Reachable from Singapore. The contact “should be readily accessible from Singapore, operational during Singapore business hours”. Any phone number given should be a Singapore number (paragraph 21.7).
On PDPC’s registration form, two details are required and two are optional. The DPO’s name and business email (a work email) are required, while office and mobile numbers are optional (PDPC’s guide, page 7). So a DPO can register with a name and a work email, and no phone number.
The guide says “The name and contact details provided will be published on PDPC’s website”, so a phone number entered there is published too. The form also asks for the DPO’s position in the company, which it calls their designation, and their main job role, each from a list. Those two “will not be published” (page 8).
The two ways to make the contact public, and the 1 September 2026 change
The Act lets regulations made under it name ways to publish the contact. A company that uses one is treated as meeting the duty (section 11(5A)).
The Personal Data Protection Regulations 2021 name two. The Act doesn’t rule out other ways, but only these two are sure to count. For a company with no website, that leaves registering.
| Way | What the Regulations say | What it takes |
|---|---|---|
| PDPC’s DPO registry, its public list of DPOs | “a record relating to the organisation that is made available on the Internet website of the Commission” (regulation 1A(1)(a)) | Registering on PDPC’s form, set out below; PDPC publishes the DPO’s name and contact details |
| The company’s own website | “a readily accessible part of the organisation’s official website” (regulation 1A(1)(b)) | A public website where the company tells people about itself, with the contact easy to find; keeping it correct is the company’s job |
Both the place to register and the law have changed since 2024. What follows matters most to a company whose DPO’s details were filed on Bizfile.
ACRA’s notice of 20 November 2024 said: “Starting 1 December 2024, Data Protection Officer (DPO) registration on ACRA’s BizFile+ will be unavailable until further notice.” So Bizfile, written BizFile+ in the notice, took DPO details until 30 November 2024, and PDPC’s online form has taken them since.
The law changed later: since 1 September 2026, the Regulations name PDPC’s website, not Bizfile. Until 31 August 2026, the first way was a record on Bizfile’s website, for a company registered with ACRA (Part 1A as it stood then).
By then, the registration had already moved from Bizfile to PDPC’s form. In my own company, that change was easy to miss.
Take an example company, with an invented date: a one-person private limited company incorporated on 15 July 2024, whose director is its only shareholder. When it was incorporated, it could file its DPO’s details on Bizfile. The Regulations then named Bizfile’s record or the company’s own website.
A company incorporated now registers on PDPC’s form, if it registers at all. Since 1 September 2026, the Regulations name PDPC’s website or the company’s own.
Where a company’s DPO contact goes, then and now
- 15 July 2024The example company is incorporatedIts DPO’s details could be filed on Bizfile
- Until 30 November 2024Bizfile takes DPO detailsThe Regulations name Bizfile’s record or the company’s own website
- From 1 December 2024PDPC’s online form takes themBizfile no longer does; the Regulations still name Bizfile’s record until 31 August 2026
- From 1 September 2026The Regulations changeThey name a record on PDPC’s website (its DPO registry) or the company’s own website
From ACRA’s notice and the Personal Data Protection Regulations 2021, linked in the text; the 15 July 2024 date is the example company’s, and invented. Checked on 21 October 2026.
Pages written before these changes may still send readers to Bizfile. Even PDPC’s guidelines still say the contact “may be provided on BizFile⁺ for companies that are registered with ACRA” (paragraph 21.7). They were last revised on 29 April 2026, before the Regulations changed.
If a company filed its DPO’s details on Bizfile before December 2024, check whether they show in PDPC’s DPO registry. It can be searched by the company’s full name or its Unique Entity Number (UEN), the number the company uses with government agencies. If the details aren’t there, publish the contact in one of the two ways: since 1 September 2026, a Bizfile record isn’t one of them.
How to register your DPO with PDPC, step by step
Registering is optional: the form says “Registration is voluntary.” PDPC’s Kickstart page still calls it the “Most effective way to meet the requirement” of making the DPO’s contact public. The details “go straight into the DPO Registry”, it says.
The steps below follow PDPC’s step-by-step guide, because the form’s later screens open only after a corporate login. If you’re filing for someone else in the company, see the note after the steps.
- Get Corppass access to “DPO Registration”. Corppass is the system that controls who can act for a company on government digital services. The person filing needs Corppass access to the “DPO Registration” service. Corppass’s list puts that service under IMDA, the Info-communications Media Development Authority, which the Act names as PDPC (section 5). On Corppass’s page, that access “is assigned and managed by the entity’s Corppass Administrator or Corppass Sub-Administrator”. An earlier post explains who can be a Corppass Administrator, and how a director who has never used Corppass can become one. To use PDPC’s form for my own company, I first gave myself access to ‘DPO Registration’ in Corppass.
- Open the form and log in. Go to PDPC’s DPO Registration Form. It needs a corporate login, which it calls Singpass (Corporate). You log in with your own Singpass, as Corppass users do; PDPC’s guide calls this logging in “using your Corppass credentials”.
- Enter the company’s name and UEN. The guide asks that the name match the one registered under the UEN.
- Say who the DPO is, and verify. If you’re the DPO, choose “I am the DPO of the organisation” and enter your name and business email; phone numbers are optional. Click “Verify”, enter the PIN sent to that email, or by SMS to a mobile number if you give one, and click “Verify” again. The PIN is “valid only for 30 minutes”, and any mobile number you give is published (page 7).
- Give the DPO’s designation and role. The form asks for them, but PDPC’s guide says they “will not be published on PDPC’s website”. It also asks whether you agree to marketing messages from PDPC and its partners; “I/ We do not consent” is one answer. Either way, the form’s opening page says “All registered DPOs will be automatically added to our mailing list for regulatory updates from the PDPC.”
- Declare and submit. Tick the declaration that the details are correct and click “Submit Now”. Keep the confirmation email, “Confirmation of the DPO Information Submission”, as the guide asks.
Filing for someone else in the company. At step 4, choose “I am submitting the DPO information on behalf of my organisation”, then “Register a new DPO” (page 14). Enter the DPO’s name and business email (page 15), and later your own name and email (page 18). The PIN goes to your email, and it’s valid for 30 minutes too.
After you submit. The DPO registry is “a publicly accessible directory”, searchable by the company’s name or UEN. To update or remove a DPO, use the same form: “Changes will be reflected in the registry the next day upon successful completion.” The guide asks companies to keep “at least one active DPO at all times”.
A company can register up to five DPOs, up to two in each submission, the form says.
A corporate service provider, a firm a company can hire to file for it, can also file the form for a client company. That’s the provider filing, not the provider being the DPO.
The company first gives the provider Corppass access to “DPO Registration” (the earlier post explains how). The provider then chooses “I am submitting the DPO information on behalf of my client” (PDPC’s guide, pages 6 and 47).
What it costs. For registering, PDPC’s pages and the form’s opening page name no fee. Registering my company’s DPO with PDPC cost nothing.
What a DPO does in a company of one
PDPC’s page on data protection obligations names the duties the Act places on a company, from asking for consent to reporting breaches. Its Kickstart page sums up the DPO’s part in four duties:
- “Ensuring Compliance”: developing and putting in place policies that meet the Act
- “Handling Inquiries”: answering requests about personal data from customers and employees
- “Managing Risk”: finding and reducing data protection risks
- “Liaising with PDPC”: being the main contact with PDPC
If the only director is also the DPO, all of this is one person’s job. The Act’s section 12 says what the policy work involves. A company must:
- develop and put in place the policies and practices it needs to meet the Act
- “develop a process to receive and respond to complaints”
- tell its staff about those policies
- make information about the policies and the complaint process available on request
A data protection notice. That’s the statement that tells people how a company manages their personal data. With some exceptions, a company must tell people why it’s collecting their personal data, on or before collecting it (section 20).
PDPC’s free Notice Generator produces a basic notice for customers, employees or job applicants. Each questionnaire “should take no more than 30 minutes”, and the result downloads as a Word file.
PDPC adds that using the tool “does not mean that an organisation will be in compliance” with the Act. Writing a notice also means first working out what personal data the company collects, and why.
Requests to see data. On request, a company must show a person their personal data (PDPC’s obligations page). It must also say how the data was used or disclosed in the year before the request. The page notes that exceptions may apply.
PDPC’s Kickstart page adds: “if a customer asks to see the personal data your organisation has collected about him/her, the DPO will manage the request.”
A data breach. That’s the Act’s term for personal data being accessed, collected, used, disclosed, copied, changed or disposed of without authorisation (section 26A). The company must assess a breach reasonably and quickly, “in a reasonable and expeditious manner” (section 26C(2)).
The company must tell PDPC if the breach is likely to cause significant harm or affects 500 or more people. The report is due as soon as it can be made.
The deadline is “no later than 3 calendar days after the day the organisation makes that assessment” (section 26D(1)). That assessment is its finding that the breach must be reported.
If the breach is likely to cause significant harm to the people affected, the company must also tell them. It tells them after telling PDPC, or at the same time (PDPC’s breach page). The page adds that exceptions may apply.
Do Not Call checks. Before a marketing message goes to a Singapore phone number, the sender must check the number isn’t on the Do Not Call Registry (section 43). That’s the register where people can add their own Singapore numbers (section 40).
No check is needed if the number’s user gave clear consent, kept on record. PDPC’s online service does the check, for fees its page lists. Its results are “valid for 21 days from the date the check was conducted”.
What happens if a company has no DPO
Naming a DPO is a duty in Part 3 of the Act. Two of PDPC’s powers apply when a company breaks a Part 3 duty (Part 9C):
- Directions (orders). If a company “has not complied or is not complying” with Part 3, PDPC can give it “any direction that the Commission thinks fit” to make it follow Part 3 (section 48I).
- A financial penalty. If the company broke the duty intentionally or negligently, meaning on purpose or through carelessness, PDPC can also require it to pay a financial penalty (section 48J(1)).
The penalty has a ceiling, set by the company’s yearly sales in Singapore. The Act calls them its “annual turnover in Singapore” (section 48J). They’re taken from “the most recent audited accounts” available when the penalty is imposed.
Regulation 10A of the Enforcement Regulations sets the ceiling:
| Yearly sales in Singapore | The most the penalty can be |
|---|---|
| S$10 million or less | S$1 million |
| More than S$10 million | 10% of all those yearly sales |
PDPC’s Kickstart page gives the same rule in one line: “fines of up to S$1 million or 10% of their annual Singapore turnover (for turnover exceeding S$10million), whichever is higher”. So for a company with yearly sales of S$10 million or less, the penalty can’t be more than S$1 million.
Neither section 48J nor regulation 10A says which yearly sales figure counts for a company that has no audited accounts.
A company with no DPO has two steps to take. First, name one. Then make the contact public in one of the two named ways: register the DPO with PDPC, or put the contact on the company’s website.
Where these facts came from
Every page below was read on 21 October 2026, and the Act and the Regulations are quoted as they stood that day. The pages’ own dates run from 3 April 2023 to 19 October 2026. PDPC’s form and Notice Generator show none, and its step-by-step guide prints none (its file name says 28 February 2025).
| What | Pages |
|---|---|
| The duty to designate one or more individuals; delegating; the company staying responsible; making the contact public, and that a named way counts (section 11); policies, a complaints process, telling staff and information on request (section 12); what “individual”, “organisation”, “personal data” and “business contact information” mean, and whom the duties leave out (sections 2 and 4); IMDA as PDPC (section 5); telling people why their data is collected, with its exceptions (section 20); no regulation naming a fourth group | Personal Data Protection Act 2012: sections 11 and 12, Part 1, section 5, Part 4, its subsidiary legislation |
| The two ways that count, since 1 September 2026 and until 31 August 2026 | Personal Data Protection Regulations 2021, Part 1A: now and as at 31 August 2026 |
| The person: skilled, with authority, need not be an employee, ideally senior management; trained and certified, and the example certificate; the primary contact point; a mailing or email address; reachable from Singapore in its business hours, with Singapore phone numbers; Bizfile still named | PDPC: Advisory Guidelines on Key Concepts in the PDPA, chapter 21 (revised 29 April 2026) |
| ACRA, the government body that registers businesses; Bizfile, where companies file with ACRA; the UEN, the number a company uses with government agencies | ACRA: Overview of ACRA, Registering a local company via Bizfile |
| Every organisation that handles personal data appoints a DPO, and the PDPA applies “regardless of size”; the “mandatory first step”; the two options; the four duties and the access-request example; an employee or an external provider; free tools; the penalty line; the DPO among the steps “before you start operations” | PDPC: Kickstart Your Data Protection Journey; ACRA: Post-registration guide: Local company |
| Bizfile’s DPO registration unavailable from 1 December 2024, and PDPC’s online form instead | ACRA: Updated Process in DPO Registration |
| What PDPC is; registering voluntary; up to five DPOs, up to two per submission; the corporate login; 10 minutes; what PDPC publishes; the mailing list; the steps, the answers for filing for someone else or for a client, the required and optional details, the PIN valid 30 minutes and a mobile number given being published, designation, the marketing question, what isn’t published and the confirmation email; a provider filing for a client; the registry, its search and changes the next day; at least one active DPO; “DPO Registration” under IMDA, who gives access and the Singpass login | PDPC: DPO Registration Form, A Step-by-Step Guide on Managing DPO Information (PDF), DPO Registry for Organisations; Corppass: Digital Service List |
| The obligations and access requests in the year before, with exceptions; a data breach, 500 people, the assessment and three calendar days; telling the people affected, with exceptions; Do Not Call checks, their consent exception, their fees and 21 days; the Notice Generator, its 30 minutes and its caution | PDPC: Data Protection Obligations, Report Your Organisation’s Data Breach, How To Check Numbers Against Do Not Call (DNC) Registry, Data Protection Notice Generator; the Act: Part 6A, Part 9; Personal Data Protection (Notification of Data Breaches) Regulations 2021, regulation 4 |
| Directions; financial penalties for intentional or negligent breaches; the ceiling of S$1 million, or 10% of yearly sales in Singapore when those are above S$10 million, from the most recent audited accounts available when the penalty is imposed, with nothing said for a company that has none | The Act: Part 9C; Personal Data Protection (Enforcement) Regulations 2021, regulation 10A |
Rules and pages change. If something here has gone out of date, tell me and I’ll correct it and note when it was corrected.
What this post is not
I’m not a lawyer or a data protection professional, and nothing here is advice about your company’s situation. It sets out the rules on data protection officers as the Act, the Regulations, PDPC and ACRA state them.
It’s written for a private limited company with one director, and it quotes no providers’ prices. It leaves out the full process for a data breach, Do Not Call checks in detail and sending personal data overseas. PDPC’s breach page, Do Not Call page and obligations page cover each.
This post was drafted with AI assistance and checked by me against the sources above. No link here is an affiliate link, the kind where a seller pays the site a fee if a reader buys something through it. Nobody paid for a mention, and the page on how this site is paid for says the rest.