Fortify your operations.
Protect your data.

The answer is yes. The deadline to file your Data Protection Officer (DPO) information with the PDPC via ACRA BizFile+ (bizfile.acra.gov.sg) was 30 September 2024. It is mandatory for all organisations to appoint a DPO and make their business contact information public under the PDPA.

As long as your company is active. All organisations, including sole proprietorships, are required to designate at least one person, a DPO, to be responsible for ensuring that the organisation complies with the PDPA.

Although there is no penalty if you miss the deadline, the PDPC may take action against organisations that cannot demonstrate compliance with the PDPA to appoint a DPO, including making the DPO's business contact information available to the public. As the appointed DPO, there are responsibilities expected of the individual and failure to meet them won't be good for your organisation.

A DPO is responsible for ensuring your organisation complies with Singapore's Personal Data Protection Act (PDPA). Their key duties include developing and reviewing data protection policies, conducting staff training, handling data breach incidents and notifications to the PDPC, responding to data access and correction requests from individuals, and serving as the primary point of contact for all data protection matters. Think of the DPO as your organisation's internal watchdog for all things related to personal data.

Any individual can be appointed as a DPO. It does not have to be a dedicated role and can be an existing employee taking on the additional responsibility. However, the DPO must have sufficient knowledge of data protection practices and the PDPA. For smaller businesses, this is often where the challenge lies. The appointed person may lack the expertise to handle data breach incidents, draft policies, or advise on compliance matters confidently. This is why many businesses choose to outsource the DPO role to specialists like Zavior.

Registration is done through the ACRA BizFile+ portal at bizfile.acra.gov.sg. You will need to provide the DPO's name, business email address, and business contact number. This information will be made publicly available so that individuals can reach out to your DPO for data protection matters. If you appoint an outsourced DPO provider like Zavior, we will provide you with the relevant contact details to register.

Yes, absolutely. The PDPA allows organisations to appoint an outsourced DPO. The role does not need to be fulfilled by an employee. An outsourced DPO brings immediate expertise, established processes, and hands-on experience handling incidents across multiple organisations. This is especially valuable for SMEs who may not have the internal resources to train and maintain an in-house compliance function.

Yes. If your DPO changes or their contact details are updated, you are required to update the information on ACRA BizFile+ promptly. Keeping this information current is part of your compliance obligations under the PDPA, outdated or incorrect DPO contact details could put your organisation at risk if a complaint or data breach notification is missed.