Data Processing Agreement (Singapore) by OCS
This data processing agreement establishes the legal framework for a contractor to handle personal data on behalf of a customer under Singapore's Personal Data Protection Act 2012. It defines security requirements, breach notification procedures, and restrictions on overseas data transfers to ensure compliance with PDPA standards.
DATA PROCESSING AGREEMENT (SINGAPORE)
Note: Use this Agreement where one organisation (the Customer) engages another organisation (the Contractor) to handle personal data on its behalf: payroll, hosting, IT support, customer service, marketing operations, or similar. Under Singapore's Personal Data Protection Act 2012 (PDPA) that Contractor is a data intermediary. Section 4(2) PDPA only lifts most PDPA obligations off a data intermediary where the processing is done under a contract that is made or evidenced in writing, so this document is what puts the Contractor in that position.
Note: This Agreement assumes Singapore law governs and at least one party is established in Singapore. Section 4(3) PDPA makes the Customer answerable for personal data processed on its behalf as if the Customer had processed it itself, so the Customer keeps the regulatory exposure whoever does the work. Note also that the PDPA defines an organisation to include a body that is neither formed under Singapore law nor resident in Singapore (section 2(1)), so an overseas Contractor can still be caught directly.
Note: Do not use this Agreement where the two organisations each decide their own purposes for the data. That is data sharing between independent organisations, not processing on behalf of another, and it needs a Data Sharing Agreement instead.
PARTIES
This Data Processing Agreement is made on [effective date e.g. 1 september 2026] between:
(1) [full legal name of the customer], incorporated in [jurisdiction of incorporation of the customer e.g. singapore] with registration number [registration number of the customer e.g. 202012345a], whose registered office is at [registered office address of the customer] (the "Customer"); and
(2) [full legal name of the contractor], incorporated in [jurisdiction of incorporation of the contractor e.g. singapore] with registration number [registration number of the contractor e.g. 202198765b], whose registered office is at [registered office address of the contractor] (the "Contractor"),
each a "Party" and together the "Parties".
Note: At least one Party must be a Singapore-registered entity for this Agreement to sit naturally under Singapore law. Where the Customer sits outside Singapore, check whether the Customer's home data protection law also applies to the same processing and add those terms alongside these rather than in place of them.
IT IS AGREED as follows.
1. DEFINITIONS AND INTERPRETATION
1.1 Definitions. In this Agreement, the following terms have the following meanings:
"Agreement" means this data processing agreement, including its Schedules.
"Approved Territories" means the countries and territories listed in Schedule 5.
"Business Day" means any day other than a Saturday, Sunday or public holiday in Singapore.
"Commission" means the Personal Data Protection Commission, being the body responsible for administering the PDPA.
"Customer Personal Data" means Personal Data that the Customer discloses or makes available to the Contractor, or that the Contractor collects, creates, receives or otherwise Processes on behalf of and for the purposes of the Customer under this Agreement, as described in Schedule 2.
"Data Breach" has the meaning given in section 26A of the PDPA.
This is a preview. The full template is free on GitLaw.
5.0 out of 5 on Google
Read reviewsAs seen in
About this template
What is this template?
This document is a data processing agreement specifically tailored for compliance with the Singapore Personal Data Protection Act 2012. It is not a data sharing agreement between two independent organizations deciding their own data purposes. It contains specific schedules for documenting technical security measures, approved sub-processors, and specific countries permitted for data transfer.
When should you use it?
Use this agreement when hiring a third party to handle personal data such as payroll or IT support in Singapore. Use a Data Sharing Agreement instead if both parties are deciding their own purposes for the data.
What's inside
| Clause | Name | What it does |
|---|---|---|
| 2.2 | Status of the Parties | Establishes the Contractor as the Customer's Data Intermediary processing data only on the Customer's behalf for specified purposes. |
| 3.1 | Permitted Processing and Instructions | Restricts the Contractor to processing data only according to the Customer's written instructions or as required by law. |
| 3.6 | Marketing Messages | Requires the Contractor to verify Singapore telephone numbers against the PDPA register before sending marketing messages. |
| 4.1 | Security Obligation | Obliges the Contractor to implement reasonable security arrangements to prevent unauthorised access or loss of storage devices. |
| 5.1 | Access Requests | Requires the Contractor to provide data access to the Customer within a specified number of Business Days. |
| 7.1 | Data Breach Notification | Mandates the Contractor notify the Customer of a suspected Data Breach within a defined period of hours. |
| 8.2 | Transfer of Customer Personal Data Outside Singapore | Prohibits transfers outside Singapore unless the recipient is bound by legally enforceable obligations offering comparable protection. |
| 9.2 | Retention, Return and Deletion | Compels the Contractor to return or securely delete all data upon termination or earlier written request. |
| 11.1 | Indemnity | Requires the Contractor to indemnify the Customer against financial penalties and legal costs resulting from data protection breaches. |
Who it's for
- a Singapore-registered organization engaging a payroll or IT vendor to handle personal data
- a data intermediary established in Singapore providing cloud-hosted services to customers
- an overseas contractor processing personal data on behalf of a Singapore-based customer
- parties needing a bolton data agreement to supplement an existing master services agreement
How long it runs and how it's signed
Law it's drafted under
Frequently asked questions
A template isn't binding on its own - like any contract, it becomes binding once it's properly completed and signed. Templates in our curated library are professionally drafted for US or UK law; review any template before you sign it.
Yes. Chat with GitLaw to edit any section, or make changes directly in the editor.
Yes, read about team plans here.
Describe what you need in the chat and GitLaw will draft it for you.
Templates in our curated library are professionally drafted for US or UK law. The wider library comes from the GitLaw community and public sources - a solid starting point, but check any template fits your situation before you rely on it.
Mostly US and UK law. Some templates use general commercial terms that work across jurisdictions, and many note which law they're written for.
It depends on the situation. Templates work well for routine business agreements. For anything involving significant money, complex IP, employment, or areas you're unsure about, it's worth getting professional advice before you sign. GitLaw provides templates and tools, not legal advice.
Open any template in GitLaw and describe the change you want in the chat — 'make clause 4 mutual' or 'add a 30-day notice period', for example. GitLaw drafts the revised language and shows it as a suggested edit. You accept, reject, or keep editing from there.
Yes. Upload a Word, PDF, or Markdown file and GitLaw will open it in the editor. You can review, edit, or chat with GitLaw about it the same way you would with any template from the library.
Trusted by 5,000+ businesses
From template to signed, in one place
Every template opens in an editor with an AI agent alongside it.
Open
Pick a template and open it. Nothing to download, and no credit card to start.
Free to open
Edit with AI
Describe your situation in chat and the agent adapts the wording, clause by clause.
Tracked changes you can review
Send and sign
Share it for negotiation, then collect signatures without leaving GitLaw.
eSign included
Built for your legal work,
with practicing lawyers
Trained on 5,500+ clauses and specialist areas of law. Built with a standards committee of independent lawyers.
As seen in
Ready to get started?
No sales calls, no credit card. Just chat with GitLaw.
GitLaw provides templates and tools, not legal advice. Templates are a starting point, not a substitute for advice on your situation - for anything significant, speak to a qualified lawyer.