Singapore-based BeeX used its ALPHA underwater drone to place explosive charges on a moored sea mine and a swinging steel target and then destroy both during a closed-door mine countermeasures demonstration in the United Kingdom, the company said on Oct. 27. The one-day event, held on Sept. 17 and hosted by British defense consultancy Copper […]Last Updated on October 26, 2026 by Narendra Sahoo
A privacy policy on your website says little about whether you comply with the Personal Data Protection Act 2012 (PDPA). What counts is whether people, systems and vendors follow it. The stakes are real: the PDPC can impose penalties of up to S$1 million, or 10% of annual Singapore turnover where that exceeds S$10 million, whichever is higher.
A structured PDPA audit helps you find those gaps before a complaint or incident does. Each of the 12 areas below shows what to review, why it matters, the evidence to gather and one action. Work through it with your DPO, scoring each item met, partly met or not met.
A PDPA compliance audit checks how your organisation collects, uses, discloses, protects, retains and disposes of personal data against the Act and its regulations. It’s not a document count: it samples records, checks system settings and talks to the people handling the data.
You can run it internally, usually led by your DPO, or bring in an independent assessor. Internal reviews suit routine checks; independent ones add objectivity when your board or customers want assurance.
Either way, it isn’t a government certification. For certification, look to the Data Protection Trustmark, now Singapore Standard SS 714:2025, issued by certification bodies under Singapore Accreditation Council oversight.
Obligations depend on your role. Public agencies are outside them, and a data intermediary acting for another organisation under a written contract mainly has protection and retention duties, plus reporting breaches to that organisation (s 4). Exceptions can apply too (PDPC’s summary). Tags cite the Act and 2021 Regulations; “Good practice” isn’t a legal requirement.
Good practice
Review: what personal data you hold, where it flows and why.
Why: you can’t protect data you haven’t found.
Evidence: data inventory, data flow maps.
Action: map one high-volume process end to end.
s 13–17, 20
Review: each collection point and the consent or exception it relies on.
Why: you generally must state the purpose on or before collection.
Evidence: privacy notices, consent and withdrawal records.
Action: check live forms against your notice.
s 11
Review: who’s designated, their written duties and whether contact details are public.
Why: it’s mandatory. Under the amended Regulations (1 September 2026), a PDPC DPO Registry listing or your official website meets the publication rule.
Evidence: appointment letter, Registry entry.
Action: confirm your listed contact is current.
s 12
Review: policies, a complaints process, staff communication and availability on request.
Why: section 12 requires all four.
Evidence: approved policies, complaints log.
Action: give each policy an owner and review date.
s 24
Review: access provisioning and removal, encryption, logging, patching, backups.
Why: the Act requires reasonable security arrangements, not a fixed control list.
Evidence: access reviews, penetration test reports.
Action: review user access on your most sensitive system.
s 4(3), 26C(3)
Review: which vendors process personal data for you.
Why: you carry the same obligations as if you processed it yourself.
Evidence: vendor register, contracts.
Action: confirm contracts require prompt breach notification to you.
s 26; Regs 10–12
Review: what data leaves Singapore and on what basis.
Why: you must generally ensure recipients are bound to comparable protection. Since 2 March 2026, Global CBPR and (for data intermediaries) Global PRP certifications also count.
Evidence: transfer register, contract clauses.
Action: record each offshore provider’s transfer basis.
s 25
Review: your retention schedule and whether systems and backups follow it.
Why: data no longer needed for its purpose, or for legal or business reasons, must go or be anonymised.
Evidence: deletion logs, disposal certificates.
Action: test one dataset past its retention date.
s 21–22; Regs 3–5
Review: how requests are received, verified, logged and answered.
Why: you must tell the applicant in writing within 30 days if you need longer, and when you’ll respond.
Evidence: dated request log.
Action: time a test request.
s 26A–26E
Review: whether your plan covers the notifiability tests, including the 500-person threshold.
Why: assess within 30 calendar days, per PDPC’s guide, then, if it’s notifiable, notify the PDPC within 3 calendar days of that assessment.
Evidence: breach register, assessment records.
Action: run a tabletop exercise.
Supports s 12(c)
Review: induction and refresher training by role.
Why: you must communicate policies to staff; training records show you have.
Evidence: training records, acknowledgements.
Action: add HR and customer service scenarios.
Good practice
Review: whether each finding has an obligation, risk rating, owner and date.
Why: unowned findings are hard to close.
Evidence: findings register, management sign-off.
Action: take top risks to senior management.
These are illustrative issues worth testing for, not statistics about how often they occur:
One gap can point to another. A notice that doesn’t match current processing suggests the inventory behind it needs checking too.
The PDPA’s accountability provisions don’t set an audit cycle, so frequency is a risk decision. Weigh the volume and sensitivity of your personal data, how often your systems, vendors and processes change, and whether sector rules or customer contracts set their own requirements. A yearly review is a sensible baseline for many organisations, with targeted reviews after a breach, a major system change, a new offshore vendor or an acquisition, and before applying for DPTM.
For an outside view, VISTA Infosec runs PDPA gap assessments, privacy compliance reviews, data protection control assessments and documentation reviews for Singapore organisations, and turns the findings into practical remediation recommendations. We test controls against evidence rather than taking documents on trust, and as a CREST-accredited firm we can test the technical safeguards behind the Protection Obligation ourselves.
Singapore engagements are contracted through VISTA Infosec Pte. Ltd. We don’t issue PDPA certificates and we aren’t a DPTM certification body. You can read more about our PDPA audit and compliance consulting services in Singapore.
Not as a stand-alone requirement. Sections 11 and 12 require a DPO and policies that meet your obligations, but don’t prescribe a periodic audit. An audit checks those measures work.
Data inventory, privacy notices, consent records, policies, DPO appointment, vendor contracts, transfer records, retention schedule, request log, breach plan and training records.
It depends on scope. One entity with a few systems is a far smaller job than a multinational group. Agree scope first; the timeline follows.
Yes. A consultant brings independence, tests controls against evidence and helps prioritise fixes. They can’t certify compliance, and legal questions need a lawyer.
A checklist only helps if it changes something. Work through these 12 areas with your DPO, gather the evidence as you go and be honest about what’s only partly met. Fix the highest-risk gaps first, then repeat the review whenever systems, vendors or the business change.
The post PDPA Audit Checklist for Singapore Businesses: 12 Essential Checks appeared first on Information Security Consulting Company - VISTA InfoSec.
Workato opens AI agent building in Singapore with 50,000 free starting credits, giving Asian developers and businesses access to automation tools.
The post Workato Brings AI Agent Builder to Singapore With 50,000 Free Credits appeared first on TechRepublic.
Workato opens AI agent building in Singapore with 50,000 free starting credits, giving Asian developers and businesses access to automation tools.
The post Workato Brings AI Agent Builder to Singapore With 50,000 Free Credits appeared first on TechRepublic.
Formula 1’s lengthy 2026 season is entering its final stretch. The sport took to the floodlit streets of Singapore on Sunday night, but Saturday saw action, too; this Grand Prix weekend was also the final of six sprints this year. The night race might be one of modern F1’s greatest spectacles. From overhead shots, the track becomes a bright, illuminated ribbon among the looming darkness of the city-state’s overpasses and skyscrapers. At ground level, the cars shower glittering sparks from their titanium skid blocks as the drivers flirt with how close they can get to the walls. As tracks go, the 90-degree turns and concrete barrier-lined streets were a world away from the abrasive tarmac and ample runoff of Malaysia last time out. But the tropical heat and humidity were a constant given both locations’ proximity to the equator.
In Malaysia (which was still technically the Bahrain GP), a pre-race downpour disrupted things mightily. On Saturday morning in Singapore, shortly before the start of the sprint, it seemed history was about to rhyme when the skies opened. With standing water in places on the track, the sprint was delayed by 30 minutes. The sprint format, where a short extra race replaces a practice session a day before the main event, is unloved by the drivers and teams. For one thing, there’s little prestige in winning Saturday’s sprint. And with qualifying just a few hours later, risk-taking is discouraged lest one wreck the car and ruin Sunday’s race a day early.
Oh no, not again!
Credit:
Mark Thompson/Getty Images
And in Singapore, like most street circuits, the proximity of the unyielding barriers that line the track means there are real, punishing consequences for getting it even a little wrong.
© Then Chih Wey/Xinhua via Getty Images
Bitcoin Magazine
Standard Chartered to Offer Digital Asset Custody in Singapore
Standard Chartered plans to offer crypto custody services for institutional clients in Singapore, the British multinational has said.
Institutional and corporate clients increasingly want secure, regulated, bank-grade custody for digital assets, the bank said Thursday. Standard Chartered already offers the service in the United Arab Emirates, Luxembourg, and Hong Kong.
“Singapore is an important centre for financial innovation, with a strong institutional ecosystem and growing demand for trusted digital asset solutions,” Patrick Lee, CEO, Singapore and CEO, ASEAN & South Asia, Standard Chartered, said.
JUST IN:
— Bitcoin Magazine (@BitcoinMagazine) October 8, 2026
“Robust infrastructure will be critical to supporting the secure movement, safekeeping, and servicing of tokenised assets at an institutional scale.”
Banks worldwide are integrating or offering bitcoin-related products and services. A number of U.S. and European banks have started offering crypto-related services by custodying assets for institutions.
Standard Chartered added the custody service would be for “selected cryptoassets, stablecoins and tokenized real-world assets.”
Tokenization is a hot topic on Wall Street as a number of traditional finance firms do deals with crypto companies, mostly to bring stocks on the blockchain to allow for 24-7 trading. Other assets are also being considered or debuted.
In 2025, Standard Chartered set up a trading desk for bitcoin and other cryptocurrencies in London, making it one of the first global banks to enter spot cryptocurrency trading.
The crypto desk became part of the forex trading operation. The bank the same year launched a blockchain unit called Libeara to help institutions tokenize traditional assets.
Last month, the bank debuted bitcoin trading in the UAE for institutional clients.
Crypto custody is often a starting point for banks moving into the digital asset space. BNY Mellon in 2022 became the first major U.S. bank to offer digital asset custody services.
And last month, Germany’s Deutsche Bank said it plans to launch a custody service for bitcoin, ether and select stablecoins for European corporate and institutional clients later in 2026, pending regulatory approval.
This post Standard Chartered to Offer Digital Asset Custody in Singapore first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.
Bitcoin Magazine
Bitcoin Privacy Legend Amir Taaki Deported From Singapore
Crypto-anarchist, former Bitcoin Core contributor and cypherpunk legend Amir Taaki is in trouble again.
Writing on X Tuesday, the developer said that he was questioned by Singaporean police before being deported from the country about “what I work on.”
British-Iranian programmer Taaki, who was one of the first Bitcoin contributors, claims he has been in trouble with certain countries since spending time fighting with the Kurdish People’s Protection Units in Syria years ago.
Just got questioned for 6 hours by glow police then deported from Singapore. Everything about what I work on.
— Amir Taaki ⛛ (@lunardragon420) October 6, 2026
The extralegal glow regime charge my friends with fake things like money laundering. But they have nothing on me so they strike from the shadow. Weak coward tactics.… pic.twitter.com/l3SPA7lwWR
Taaki, who has made significant contributions to bitcoin privacy over the years, today is working on a crypto privacy protocol called DarkFi.
“The extralegal glow regime charge my friends with fake things like money laundering,” wrote Taaki.
“But they have nothing on me so they strike from the shadow. Weak coward tactics. Face me bitch.”
Taaki added that in the past year alone, he has also been deported from Argentina and Mexico, and detained in Serbia and Japan.
He continued: “Every time it happens I ask why and they always tell me it’s just a random check,” adding that authorities never give reasons for why he is being detained or questioned.
“I am on a list but I am not able to find any info about which country has sanctioned me.”
Taaki, who has contributed to Bitcoin Magazine, first faced trouble with British authorities after going to Syria to fight against the Islamic State group back in 2016.
He said in a 2017 BBC interview that he spent three and half months fighting with the Kurdish People’s Protection Units before helping with community projects in the country.
Privacy-focused Taaki, wrote the first implementations of CoinJoin and stealth addresses, created libbitcoin, and founded the UK’s first Bitcoin exchange.
He also authored BIP 0001, which set up the Bitcoin Improvement Proposal process.
This post Bitcoin Privacy Legend Amir Taaki Deported From Singapore first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.
Login