Singapore PDPA + AI governance checklist (2026)

Using AI on customer data in Singapore? Here is what PDPA and IMDA guidance ask for.

What you need to know

• PDPA breach notification: tell PDPC no later than 3 calendar days after you assess a breach is notifiable.
• Fines up to 10% of Singapore turnover (if turnover is above S$10m) or S$1m.
• PDPC's AI advisory guidelines: explain AI use in notices; consider AI Verify for testing.
• IMDA Model AI Governance Framework for Agentic AI (Jan 2026, voluntary): bound agent risks, keep humans accountable, log and approve sensitive actions.
• Start with an inventory of every AI system and the personal data it uses.

First step: list your AI systems and the data they use

Every one of these laws is easier with a written inventory. Our free AI register template gives you one in minutes.

Get the free register

Free edition. Paid plans are optional. Built originally for the EU AI Act; the Southeast Asia mapping is in this guide, not yet inside the app.

Official sources

• https://sso.agc.gov.sg/Act/PDPA2012
• https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/other-guides/guide-on-managing-and-notifying-data-breaches-under-the-pdpa-15-mar-2021.pdf
• https://www.imda.gov.sg/assets/63438074-73f6-4dcc-a281-030f42642cf4.pdf

Checked 13 Oct 2026. General information, not legal advice. Team Unadhi.