By country

Terms & Conditions Generator Singapore

The PDPA, a mandatory Data Protection Officer, the Do Not Call registry and mandatory breach notification.

Generate your terms and conditions Read the terms and conditions guide

Singapore terms sit alongside the Consumer Protection (Fair Trading) Act and the Unfair Contract Terms Act, plus e-commerce specific expectations from the Consumers Association. Liability exclusions are subject to a reasonableness test rather than being freely enforceable.

Singapore’s Personal Data Protection Act has an obligation most regimes do not: every organisation must appoint at least one Data Protection Officer and make their business contact information publicly available. It is a small requirement that is missed constantly, and it is trivially checkable.

The 2020 amendments added mandatory breach notification, a data portability obligation, and a deemed-consent-by-notification route that lets organisations proceed without express consent where an assessment shows no adverse effect - a mechanism with no direct GDPR equivalent.

Marketing is governed separately through the Do Not Call provisions. Before sending a marketing message to a Singapore number you must check the DNC registry unless you have clear and unambiguous consent in evidential form, and penalties are enforced actively.

What a terms and conditions in Singapore has to cover

Exclusions and limitations subject to the reasonableness test under the Unfair Contract Terms Act
Fair trading obligations - no misleading claims about price, availability or characteristics
Clear cancellation, delivery and refund terms, since there is no general statutory cooling-off right
Governing law and Singapore jurisdiction, with any arbitration route stated clearly

How Singapore actually moves personal data

NRIC and identity numbers

The PDPC restricts collection of NRIC numbers and copies of the identity card to narrow circumstances. Using NRIC as a customer reference is the classic Singapore compliance failure.

Deemed consent by notification

A route to proceed without express consent after an assessment of adverse effect and a notification period. It has to be documented to be relied on.

Marketing to Singapore numbers

DNC checks are a per-campaign operational step, with records kept to demonstrate the check happened.

Cross-border transfers

The organisation stays accountable, so the transfer clause and the recipient obligations belong in the policy and in the contract.

Data portability

The amendment introduced a portability obligation for applicable data, with implementation phased - the direction of travel is towards machine-readable transmission on request.

Third parties the draft will ask you about

Stripe · PayNow · GrabPay · AWS ap-southeast-1 · Xero · Salesforce · Twilio · SingPost

The rules that apply

PDPA 2012 (as amended 2020)

Consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation and accountability.

Mandatory DPO

At least one designated individual, with business contact information published. Failure to appoint is itself a breach.

Data breach notification

Notifiable breaches must be reported to the PDPC within three calendar days of assessment, and to affected individuals where significant harm is likely.

Do Not Call registry

Checks required before marketing to Singapore telephone numbers, with exemptions only for clear and unambiguous consent or an ongoing relationship in defined terms.

Transfer limitation

Overseas recipients must be bound to a comparable standard of protection, typically through contract.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

PDPA implementation essentials

Appoint and publish a DPO
A named role with contact details on the website, and internal authority to act.
Review NRIC collection
Remove it wherever a different identifier will do.
Document consent and deemed consent
Express consent records, plus the assessments underpinning any deemed-consent reliance.
Build the breach assessment and 3-day notification path
With a decision test for what makes a breach notifiable.
Bind overseas recipients contractually
To a comparable standard, and reflect that in the transfer clause.

Where this usually goes wrong

No published DPO contact

The requirement is not just to appoint but to publish business contact information. An unnamed "privacy team" inbox does not obviously satisfy it.

Collecting NRIC numbers by default

Permitted only where required by law or necessary to verify identity to a high degree of fidelity. Loyalty schemes and delivery forms are not that.

Skipping DNC checks

Consent has to be clear, unambiguous and in evidential form to displace the registry check. Implied consent from a purchase does not.

Missing the three-day notification window

It is calendar days from assessment, which is far tighter than most teams expect.

Frequently asked questions

Do I need a Data Protection Officer in Singapore?

Yes. Every organisation covered by the PDPA must designate at least one individual and make their business contact information available. There is no size exemption.

How quickly must I report a data breach?

To the PDPC within three calendar days of determining a breach is notifiable, and to affected individuals as soon as practicable where significant harm is likely.

Can I collect NRIC numbers?

Only where required by law or necessary to accurately establish identity to a high degree of fidelity. The PDPC guidance is restrictive and enforcement is active.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.