M cenaly.ru
🇸🇬 Singapore · Customers

DPO Appointment + PDPA Privacy Notice

Combined Data Protection Officer (DPO) appointment record and PDPA privacy notice — under section 11(3) of the Personal Data Protection Act (PDPA), EVERY organisation must appoint at least one DPO, with no size threshold, and must notify individuals of data-collection purposes.

All templates
Country
🇸🇬 Singapore
Category
Customers
Language of the text
EN
Version
1

⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.

This template has no optional clauses: the text is the same for everyone. Field placeholders are shown as labels — on the site the template is read-only, values are entered inside the system.

Document

DATA PROTECTION OFFICER (DPO) APPOINTMENT AND PDPA PRIVACY NOTICE

Organisation name (UEN Organisation UEN) Notice version date: Notice version date

PART A — DPO APPOINTMENT

1. APPOINTMENT 1.1. Under section 11(3) of the Personal Data Protection Act (PDPA), every organisation must designate at least one individual to be its Data Protection Officer (DPO) — there is no exemption based on organisation size. 1.2. Designated DPO: Designated DPO, appointed on DPO appointment date. 1.3. Public business contact information: DPO public business contact. This contact is made publicly available and has been filed with the Personal Data Protection Commission (PDPC) using its online DPO registration form. 1.4. Duties of the DPO include: developing and implementing data protection policies, handling data subject requests, staff training/briefing, and responding to data breach incidents.

PART B — PDPA PRIVACY NOTICE

2. WHAT WE COLLECT 2.1. Personal data collected

3. WHY WE COLLECT IT 3.1. Purposes of collection, use, and disclosure 3.2. In accordance with the Notification Obligation and the Purpose Limitation Obligation, we notify individuals of these purposes before or at the point personal data is collected.

4. DISCLOSURE TO THIRD PARTIES 4.1. Disclosure to third parties

5. OVERSEAS TRANSFER 5.1. Overseas transfer of personal data

6. RETENTION AND SECURITY 6.1. Retention period and security measures

7. YOUR RIGHTS 7.1. Individual rights: access, correction, withdrawal of consent

Questions about this notice, or requests to exercise your rights, may be directed to the DPO at DPO public business contact.

— — — ⚠️ This is a boilerplate template, not legal advice. Singapore's Employment Act, CPF, PDPA, and MOM/SFA/PDPC compliance regimes are subject to near-term and phased changes — including the Workplace Fairness Act (commencing end of 2027), the SAFE food-safety framework (phasing in from 19 January 2026, with the Food Safety and Security Act 2025 phasing in through 2028), the Local Qualifying Salary rising to S$1,800/month (or S$10.50/hour) on 1 July 2026, and CPF contribution-rate and work-pass policy updates — have this template reviewed and adapted by a lawyer before use, and confirm the current rules and thresholds at mom.gov.sg, pdpc.gov.sg, and sfa.gov.sg on the date of use.

Fields of the document

Fields that belong to a switched-off clause are dimmed — they are not asked for.

  • Organisation nametextrequired
  • Organisation UENtextrequired
  • Designated DPOtextrequired

    Can be the owner, a staff member with other duties, or an outsourced DPO

  • DPO appointment datedaterequired
  • DPO public business contacttextrequired

    Must be made publicly available (e.g. on the website or this notice) and filed with the PDPC via its online form (since December 2024, replacing the earlier ACRA BizFile route)

  • Personal data collectedlong textrequired

    e.g. bookings, loyalty programme, online orders, CCTV, Wi-Fi logs

  • Purposes of collection, use, and disclosurelong textrequired
  • Disclosure to third partieslong textoptional

    e.g. POS provider, food delivery aggregators, payment processors

  • Overseas transfer of personal datalong textoptional

    Transfer Limitation Obligation under the PDPA

  • Retention period and security measureslong textrequired
  • Individual rights: access, correction, withdrawal of consentlong textrequired
  • Notice version datedaterequired

In Cenaly this template fills itself in

0 of 12 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.