Personal Data Protection Act 2012
Assess first, then notify the PDPC within 3 days once the breach is determined notifiable. Affected individuals notified where the threshold is met.
← All jurisdictions
Jurisdiction record
Singapore
A mature regime with an existing whole-of-government DLP deployment. The GenAI channel is the gap it does not cover.
Orientation only, not legal advice. Every fact carries its own review date.
Market-prerequisite record
No product licence prerequisite recordedNo product licence prerequisite. A service licence under the Cybersecurity Act (CSSP) would only be required if a managed-monitoring offering were added, which is not in v1 scope.
Sourced facts
Instruments and current record
Personal Data Protection Act 2012 MAS Technology Risk Management Guidelines (2021) Government ICT&SS standards Cybersecurity Act 2018, as amended 2024
Separately labelled interpretation Bounded product mapping
This path describes content governance; it does not represent certified legal compliance.
MAS Technology Risk Management Guidelines (2021)
Technology risk governance for financial institutions, read with the FSM-N notice series.
Government ICT&SS standards
The control catalogue formerly known as IM8, including DP-1 data residency. Public SSP and control catalogue.
Cybersecurity Act 2018, as amended 2024
Critical information infrastructure obligations. Key amended provisions in force 31 October 2025.
Product mapping
Detector-pack direction
NRIC / FIN — 9 characters, prefix-weighted checksum with distinct letter tables per series.
This maps deterministic detector content; it is not a claim of complete legal compliance.
Run browser demonstrationInterpretation
Classification mapping
Two orthogonal axes. Security classification: Official (Open), Official (Closed), Restricted, Confidential, Confidential (Cloud-Eligible), Secret. Sensitivity: Non-Sensitive, Sensitive Normal, Sensitive High. Government DLP rule matrices key off axis combinations — which is the design validation for our action ladder.
Customers should confirm applied policy with qualified counsel and security owners.
Watch items
Not treated as current fact
- ESCI and FDI commencement dates
- MAS AI Risk Guidelines — final text
Validate the mapping in evaluation
Confirm current primary sources, applicability, and product maturity before selecting test cases.