Data Controller Agreement Template for Singapore

A Data Controller Agreement is a critical legal document that governs the relationship between organizations that jointly process personal data in Singapore. Under the Personal Data Protection Act 2012 (PDPA), when two or more parties collaborate in determining how personal data is collected, used, or disclosed, they must establish clear responsibilities and compliance frameworks to protect individual privacy rights.

When do you need this document?

You need a Data Controller Agreement when your organization partners with other entities to process personal data for shared purposes. This includes joint marketing campaigns where customer databases are combined, shared customer service platforms operated by multiple companies, collaborative research projects involving personal data collection, or outsourcing arrangements where both parties retain control over data processing decisions. The agreement is also essential when establishing data-sharing partnerships with overseas entities, as it ensures compliance with Singapore's cross-border transfer requirements under the PDPA.

Key legal considerations

The agreement must clearly define each party's role as either a primary or secondary data controller, specify the scope of data processing activities, and establish mechanisms for managing data subject requests such as access, correction, or deletion. You must include detailed breach notification procedures that comply with PDPC requirements, outline data security measures that meet PDPA standards, and specify how liability will be allocated between parties in case of non-compliance. The document should also address data retention periods, deletion procedures, and protocols for handling regulatory investigations. Cross-border transfer provisions are crucial if data will be shared internationally, requiring compliance with APEC Cross-Border Privacy Rules or adequate protection standards.

Legal requirements in Singapore

Under Singapore's PDPA, joint data controllers must ensure that all Data Protection Provisions are met collectively. This includes obtaining proper consent for data collection, limiting use to specified purposes, implementing reasonable security arrangements, and providing individuals with access to their personal data. The agreement must comply with the PDPA Regulations 2021, particularly regarding mandatory breach notification to the Personal Data Protection Commission within 72 hours of discovery. You must also ensure that any cross-border transfers comply with Section 26 of the PDPA, which requires either consent or adequate protection in the receiving jurisdiction. The document should reference PDPC Advisory Guidelines and incorporate requirements for data protection impact assessments where applicable.