The 10-obligation mental map
When faced with a scenario, identify the data, the actor, the activity and the applicable obligation.
1 · AccountabilityBe responsible for personal-data protection and governance.
2 · ConsentConsider whether consent is required and whether an alternative basis or exception applies.
3 · Purpose LimitationUse/disclose data only for appropriate purposes under the PDPA framework.
4 · NotificationInform individuals of relevant purposes as required.
5 · Access & CorrectionHandle requests subject to statutory exceptions and requirements.
6 · AccuracyTake reasonable steps where accuracy matters for decisions/disclosures.
7 · ProtectionPut reasonable security arrangements in place.
8 · Retention LimitationDo not retain personal data when no longer necessary for business/legal purposes.
9 · Transfer LimitationOverseas transfers must meet the applicable comparable-protection requirements.
10 · Breach NotificationAssess breaches and notify when the statutory notification threshold is met.
Numbers to memorise
30calendar days to assess whether a suspected data breach is notifiable.
3calendar days to notify PDPC after determining a breach is notifiable.
1 yearpreceding year of use/disclosure information relevant to an access request.
1+DPO: an organisation must designate at least one individual.
31 Dec 2026current deadline for organisations to cease using NRIC numbers for authentication.
Scenario decision tree
1. Personal data?
Can an individual be identified?
Can an individual be identified?
2. What activity?
Collect · Use · Disclose
Collect · Use · Disclose
3. What purpose?
Is it appropriate and properly notified?
Is it appropriate and properly notified?
4. What basis?
Consent, deemed consent, legitimate interests or another applicable exception?
Consent, deemed consent, legitimate interests or another applicable exception?
5. Controls?
Accuracy · protection · retention · transfer
Accuracy · protection · retention · transfer
6. Incident/request?
Access · correction · breach · DNC
Access · correction · breach · DNC
High-yield exam traps
“We have consent, so everything is compliant.”
No. Consent does not remove the need to consider the other obligations.
No. Consent does not remove the need to consider the other obligations.
“All overseas transfers are prohibited.”
No. The Transfer Limitation Obligation is about ensuring comparable protection.
No. The Transfer Limitation Obligation is about ensuring comparable protection.
“Every data breach must be reported to PDPC.”
No. First assess whether the breach is notifiable.
No. First assess whether the breach is notifiable.
“Three days to assess a breach.”
No. Think 30 days to assess; if notifiable, 3 calendar days to notify PDPC after determination.
No. Think 30 days to assess; if notifiable, 3 calendar days to notify PDPC after determination.
“DPO personally carries the organisation’s liability.”
No. The organisation remains accountable for its compliance.
No. The organisation remains accountable for its compliance.
“Personal data means only electronic records.”
No. It can exist in electronic and non-electronic form.
No. It can exist in electronic and non-electronic form.
Quick glossary
| Term | Exam meaning |
|---|---|
| Personal data | Data about an individual who can be identified from the data alone or together with information the organisation has or is likely to have access to. |
| Data intermediary | An organisation that processes personal data on behalf of another organisation, subject to the PDPA framework. |
| Purpose limitation | Consider whether collection, use or disclosure is for an appropriate purpose and within the applicable notification/consent framework. |
| Protection obligation | Reasonable security arrangements appropriate to the circumstances and risks. |
| Retention limitation | Stop retaining personal data when retention is no longer necessary for legal or business purposes. |
| Transfer limitation | Overseas transfers must satisfy requirements designed to ensure comparable protection. |
| Data breach | Unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data, or loss of a storage medium containing personal data. |
Section 1: 50 tricky questions
Core PDPA obligations in tricky scenarios.
Answer each question. Order is shuffled on every load. A revision note appears after each answer.
Section 2: Ultimate hard
50 very hard questions around the PDPA: overlapping laws, GDPR and cross-border regimes, anonymisation, AI, governance and edge cases.
Answer each question. Order is shuffled on every load. A revision note appears after each answer.
Revision note
This is an educational revision aid, not legal advice. PDPA requirements and PDPC guidance can change. For an exam, use your course materials and the current PDPC legislation/guidance as the authoritative sources.
Built as a revision aid · Singapore PDPA · September 2026