PDPA Data Protection Officer Duties for SMEs With No IT Department

Every organisation in Singapore must appoint at least one data protection officer and make that person's business contact information publicly available. There is no small-business exemption, no headcount threshold, and no carve-out for companies without an IT department. If you have five staff and a customer list in a spreadsheet, the Personal Data Protection Act applies to you in the same terms it applies to a bank. The practical difference is not whether you must comply, but that you have to do it without a compliance team — which means the job has to be small, written down, and owned by a named person rather than assumed by everybody.

Who should be the data protection officer in a company with no IT staff?

The DPO does not have to be a lawyer, a technologist, or a full-time hire. The role can sit with an existing employee — an operations manager, an office manager, a finance lead — and one person can hold it alongside their day job. It can also be outsourced to an external provider.

What matters more than the title is authority. The DPO needs enough standing to stop a process, ask a vendor an awkward question, and escalate to the owner on the same day. In a 15-person company that usually rules out the most junior administrator, however capable, and it often rules out the owner too — not for lack of authority, but because the owner is the person least likely to have an uninterrupted hour to work through an incident.

One practical point commonly missed: the requirement is to publish business contact information, not a named individual. A role-based address such as [email protected] on your website footer and privacy policy satisfies the requirement and survives staff turnover. You can also file your DPO contact details with ACRA through BizFile, which is worth doing because it is the record a regulator will check first.

What does the DPO actually have to do each quarter?

Stripped of consultancy language, the recurring work is four things:

• Maintain a data inventory. A single sheet listing what personal data you hold, where it sits, who can see it, and how long you keep it. For most SMEs this is under thirty rows: accounting system, CRM or WhatsApp history, HR files, CCTV, email, and whatever sits in shared cloud folders.
• Keep the policies current. A customer-facing privacy policy and an internal data protection policy. These are not one-time documents; they go stale the moment you change payroll provider or start using a new booking tool.
• Handle requests. Individuals can ask what data you hold about them and ask for corrections. You need a route for those requests that does not depend on one person reading one inbox.
• Run the breach process. Assess, decide, notify, document. This is the part with legal deadlines, and the part almost nobody has rehearsed.

Realistically this is two to four hours a quarter when nothing is wrong — and a very bad week when something is.

What counts as a notifiable data breach in Singapore?

Not every incident is notifiable. A breach must be reported to the Personal Data Protection Commission if it meets either of two tests.

The first is significant harm: the breach involves prescribed categories of personal data where exposure is likely to cause real damage — full identification numbers combined with other personal details, financial account information, health and medical data, and similar. The second is significant scale: the breach affects 500 or more individuals, regardless of how sensitive the data is.

There are narrow exceptions. If the data was encrypted to the point of being unusable, or if you took remedial action before any likely harm occurred, notification to affected individuals may not be required. Do not treat these as escape hatches — they are conditions you must be able to evidence afterwards.

A note for anyone using outsourced IT, a payroll bureau or a cloud vendor: those providers are data intermediaries, and they are obliged to inform you of a breach without undue delay. Your obligations then start running. Check whether your service agreements actually say this. Many older SME contracts do not.

How fast must a breach be reported?

There are two clocks and people routinely confuse them.

The first is the assessment clock. Once you become aware of a potential breach, you must assess it expeditiously — the Commission's guidance points to completing that assessment within 30 days. You are expected to document why it took as long as it did.

The second is the notification clock. Once you have assessed a breach as notifiable, you must notify the PDPC within three calendar days. Not three business days. A breach confirmed on the Friday before a long weekend is still due on the Monday. Affected individuals must be notified as soon as practicable where significant harm is likely.

Three calendar days is not enough time to work out who owns the decision, find the vendor contract, and identify which customers were in the affected export. That work has to exist beforehand, which is the entire argument for treating the DPO appointment as an operational task rather than a paperwork one.

What does it cost to get this wrong?

Financial penalties under the PDPA reach up to S$1 million, or 10% of annual turnover in Singapore for organisations with turnover above S$10 million — whichever is higher. Smaller enforcement outcomes are far more common than headline figures, but published decisions are public and searchable, which for a B2B supplier is frequently the more expensive consequence.

The pattern in enforcement decisions is consistent and instructive: the penalty rarely turns on the sophistication of the attack. It turns on whether the organisation had reasonable security arrangements, whether anyone was actually accountable, and how the company behaved in the days after discovery. A documented process that was followed imperfectly reads very differently from no process at all.

What should a 15-person company put in place this month?

Six items, none of which require a consultant to start:

1. Name the DPO in writing and tell the whole team who it is.
2. Publish dpo@ on your website and privacy policy, and file the contact details with ACRA.
3. Build the one-page data inventory. Timebox it to ninety minutes; an imperfect inventory beats none.
4. Write a one-page breach response sheet: who assesses, who decides, who notifies, and the phone numbers of your IT provider and, if relevant, your insurer.
5. Review your three largest vendor contracts for breach notification clauses.
6. Run a fifteen-minute staff briefing on what to do in the first hour — which in practice means: report it, do not delete anything, do not attempt a quiet fix.

If you want external validation afterwards, IMDA's Data Protection Essentials scheme is designed for exactly this size of business and is considerably cheaper than a full certification track.

Frequently asked questions

Can the business owner be the DPO?

Yes, and in very small companies it is common. The risk is availability rather than eligibility — the owner is usually the person with the least uninterrupted time during an incident, and the three-day notification window does not pause. If the owner takes the role, name a deputy who can act when the owner is travelling or on leave.

Do we need a DPO if we only hold employee data and no customer data?

Yes. Employee personal data falls within the PDPA, and the obligation to appoint a DPO applies to the organisation, not to a category of data. A company with no consumer customers still holds NRIC numbers, bank details and emergency contacts for its own staff — which is precisely the data that triggers the significant-harm test if it leaks.

What happens if we discover a breach that occurred months ago?

The clock runs from when you become aware of it, not from when it happened. Assess it expeditiously, notify within three calendar days of concluding that it is notifiable, and document the timeline honestly, including the delay in discovery. Late self-reporting with a clear record is a materially better position than a breach a regulator learns about from a complainant.

Appointing a DPO is a ten-minute decision. Being able to act within three days is the part that takes preparation — and the preparation is a single afternoon, done once, before you need it.