External Privacy Notice Template for Singapore

An External Privacy Notice is a legally required document under Singapore's Personal Data Protection Act 2012 (PDPA) that organizations must provide to inform data subjects about how their personal data is collected, used, disclosed, and protected. This notice serves as your organization's primary communication tool for transparency and compliance with Singapore's data protection framework.

When do you need this document?

You need an External Privacy Notice if your organization collects, uses, or discloses personal data in Singapore. This includes businesses with websites collecting user information, retail stores gathering customer details, healthcare providers maintaining patient records, or financial institutions processing client data. The notice must be prominently displayed on your website, provided at points of data collection, and made readily accessible to all data subjects. Organizations operating across multiple jurisdictions should ensure their Singapore notice specifically addresses PDPA requirements and local regulatory expectations.

Key legal considerations

Your External Privacy Notice must include specific mandatory elements under the PDPA. These include clearly identifying the purposes for data collection, describing the types of personal data collected, explaining consent mechanisms, detailing third-party disclosures, outlining data retention policies, and providing information about data subject rights including access and correction. The notice must be written in clear, understandable language and avoid legal jargon that could confuse ordinary consumers. You must also include contact details for data protection inquiries, procedures for withdrawing consent, and information about data breach notification processes. Organizations must regularly review and update their notices to reflect changes in data processing activities or legal requirements.

Legal requirements in Singapore

Under Singapore's PDPA and the Personal Data Protection Regulations 2021, your External Privacy Notice must comply with specific notification obligations. The notice must be provided before or at the time of data collection, unless exemptions apply under the Act. Organizations must ensure the notice is easily accessible, prominently displayed on websites, and available in languages appropriate for your target audience. The PDPC's Advisory Guidelines emphasize that notices should be layered, with summary information upfront and detailed information readily accessible. You must also comply with data breach notification requirements under the Personal Data Protection (Notification of Data Breaches) Regulations 2021, including procedures for notifying affected individuals. For marketing communications, ensure compliance with the Do Not Call Registry Regulations and include appropriate opt-out mechanisms in your privacy notice.