Regulationsby GlyphJurisdiction
Singapore: data, AI and cyber laws
Part of APAC.
Regulations
Add to calendar
Singapore Cybersecurity ActSingapore's framework for protecting critical information infrastructure (CII). CII owners must meet codes of practice, run audits and risk assessments, and report prescribed cybersecurity incidents to the Commissioner of Cybersecurity. Providers of licensable services (penetration testing and managed SOC) need a licence. The 2024 amendments extend oversight to foundational digital infrastructure providers, entities of special cybersecurity interest, systems of temporary cybersecurity concern, and CII located overseas, and add civil penalties.In effect since Aug 31, 2018Singapore Online Safety (Relief and Accountability) ActCreates a Commissioner of Online Safety, supported by the Online Safety Commission (OSC), who can direct platforms, posters and group administrators to stop or limit specified online harms. The first phase covers online harassment, doxxing, online stalking, intimate image abuse and image-based child abuse; eight further harm categories, including inauthentic material abuse, will be brought in later. The Act also creates statutory torts so victims can sue communicators, administrators and prescribed platforms in court.In effect since Jun 29, 2026Singapore PDPASingapore's baseline private-sector data protection law covering consent, purpose limitation, notification, access and correction, protection, retention, transfer limitation, and the Do Not Call registry. The 2020 amendments added mandatory breach notification, expanded deemed consent and legitimate-interests exceptions, and raised fines.In effect since Jul 2, 2014
Past deadlines
Singapore Online Safety (Relief and Accountability) ActOSC begins operations and first provisions commenceOSC starts taking reports for five harms, and the statutory torts for those harms take effect.SingaporeSingapore Online Safety (Relief and Accountability) ActAct assented toPassed by Parliament on 5 November 2025 and assented to by the President on 25 November 2025.SingaporeSingapore Cybersecurity Act2024 amendments commenceMost of the Cybersecurity (Amendment) Act 2024 takes effect, covering foundational digital infrastructure, entities of special cybersecurity interest and systems of temporary cybersecurity concern.SingaporeSingapore PDPAHigher financial penalty cap appliesMaximum penalty rises to 10% of Singapore turnover for organizations with turnover above SGD 10 million.SingaporeSingapore Cybersecurity ActCybersecurity service provider licensing commencesPart 5 and the Second Schedule take effect. Penetration testing and managed SOC providers need a licence.SingaporeSingapore PDPA2020 amendments largely in forceMandatory data breach notification and revised consent framework apply.SingaporeSingapore Cybersecurity ActCybersecurity Act main provisions commenceParts 1 to 4, 6 and the First Schedule (CII regime) commence.SingaporeSingapore PDPAPDPA data protection obligations take effectMain data protection provisions come into force.Singapore