Privacy Policy
What it is: A public notice explaining what personal data you collect, why, who you share it with, and how to contact your Data Protection Officer.
Why do you need a privacy policy? If your website collects any personal data, even just names and email addresses through an enquiry form, the PDPA requires you to tell people what you collect and why (section 20) and to make your data protection policies available (sections 11–12). This is mandatory. When someone complains to the PDPC, your privacy policy is the first document it reads.
Why it matters: Financial penalties of up to S$1 million, or 10% of annual Singapore turnover where that turnover exceeds S$10 million (PDPA section 48J).
What we provide: We map your actual data flows first, then advise on consent, deemed consent and the available exceptions before drafting.
- Privacy policy (English / 中文)
- DPO contact wording
Cookie Policy
Why do you need a cookie policy? Singapore has no cookie-specific law, but if your cookies or analytics tools collect personal data, the PDPA applies to them. A cookie notice is best practice here, and it may be legally required if you serve users in the EU or UK (GDPR / UK PECR).
- Cookie notice and banner wording
Terms of Use / Acceptable Use Policy
Why do you need terms of use? No statute requires them, but without them there is no limit on your liability to website users and no agreed forum if a dispute arises. They are best practice.
What we provide: Liability caps, governing law and dispute resolution clauses (arbitration or mediation) drafted by a litigator and arbitrator.
E-commerce Terms of Sale
Why do you need terms of sale? Every online sale is a contract. The Consumer Protection (Fair Trading) Act 2003 does not require you to have terms, but it prohibits unfair practices and gives consumers remedies, so your terms, pricing and refund policy must not mislead. Without clear terms, the customer's account of what was promised is the only account.
- Terms of sale
- Returns and refunds policy
- Pricing presentation check
Marketing consents
Why do you need marketing consents? If you send marketing messages by phone call, SMS or messaging app, the Do Not Call provisions in Parts 9 and 9A of the PDPA apply, and the Spam Control Act 2007 covers unsolicited commercial emails and messages sent in bulk. These rules are mandatory, and the PDPC enforces them.
Why you need it
Most businesses start collecting personal data through their website before anywhere else: enquiry forms, accounts, analytics, payment pages, marketing sign-ups. Once collection starts, the Personal Data Protection Act 2012 applies. You must tell people what you collect and why (section 20), publish your data protection policies (sections 11–12), and have consent, deemed consent or a statutory exception for each use. The privacy policy is where the Personal Data Protection Commission starts when a complaint comes in. Penalties run to S$1 million, or 10% of annual Singapore turnover where that turnover exceeds S$10 million (section 48J), and the PDPC publishes its decisions. A policy copied from a competitor describes someone else's data practices. If it does not match yours, the policy itself breaches the notification and openness obligations, and the document meant to protect the company gets put to it as evidence instead.
The commercial terms matter for the same reason. Online sales are contracts. The Consumer Protection (Fair Trading) Act 2003 prohibits unfair practices, the Electronic Transactions Act 2010 confirms that contracts form electronically (section 11), and the CCCS Guidelines on Price Transparency (September 2020) set expectations on drip pricing, discounts and comparisons. A badly sequenced checkout can bind the business before it meant to be bound. Without proper terms there is no enforceable liability cap and no agreed forum, and a customer's account of what was promised stands unchallenged. If you serve EU or UK users, the GDPR and UK PECR may apply to the same pages.
Counterparties check. Payment processors and marketplaces ask for compliant policies at onboarding, and investors read them in due diligence. On the horizon: the PDPC's Advisory Guidelines on the Use of Personal Data in Generative AI (20 July 2026) will matter for any site running AI chatbots or analytics.
How we help
A template, or a policy generated by an AI tool, shows you what this kind of document usually says. It cannot tell you whether any of it is true of your business, and truth is what the PDPC tests. We start with your actual data flows: what you collect, through which systems, shared with which vendors, stored where. Then we draft from those facts, so the published policy matches your practice.
Our advice in the course of that work is legal advice and may be protected by legal professional privilege. No non-law vendor can offer that. The documents are drafted by a litigator and arbitrator, so liability caps, dispute resolution clauses and consumer-facing wording are written the way they would one day be argued.
If the PDPC, the CCCS or a consumer claimant tests the documents, the firm that drafted them can act for you. We also offer an annual refresh, because the law changes faster than most websites do.
FAQ
Get your website reviewedContact us to arrange a confidential discussion.
The information on this page is general information only and is not legal advice. The law changes and develops over time, and nothing on this page creates a solicitor–client relationship. For advice on your own situation, please contact us.