Website Terms and Privacy Notice in Singapore: What Your Business Site Needs

A Singapore business website usually needs three documents: website terms of use, terms of sale if you sell online, and a privacy notice. Only some content is strictly required by law. The Personal Data Protection Act 2012 requires you to tell people why you collect their personal data and to make your data protection officer’s business contact information publicly available. Consumer protection law requires honest pricing and descriptions. Terms of use and terms of sale are not compulsory, but without them your business has little control over liability, refunds and disputes.

Which documents does a Singapore business website need?

Each document does a different job. Many small businesses copy one long “Terms and Privacy Policy” from another site, which usually leaves gaps and includes promises the business cannot keep.

What must the privacy notice contain under the PDPA?

The PDPA does not prescribe a single document called a privacy policy. Instead it imposes obligations, and the privacy notice is the practical way to meet several of them on a website. Our PDPA compliance guide for Singapore companies covers all the obligations. For a website, focus on these:

• Purposes. Under section 20, an organisation must inform individuals of the purposes for collecting, using or disclosing their personal data on or before collection, and of any new purpose before using the data for it. List real purposes, such as processing orders, delivery, customer support, account management and, if applicable, marketing.
• Consent and withdrawal. Section 13 requires consent (actual or deemed) unless an exception applies. Section 16 lets individuals withdraw consent on reasonable notice, and the organisation must explain the likely consequences of withdrawal. Tell visitors how to withdraw.
• Contact for questions. Section 20(1)(c) requires the organisation, on request, to provide the business contact information of a person who can answer questions about the collection, use or disclosure. Section 11(5) separately requires the business contact information of at least one designated data protection officer to be made available to the public. Putting a DPO email address in the privacy notice is the simplest way to cover both.
• Access and correction. Explain how a person can ask for their data and how it has been used or disclosed in the past year (section 21), or ask for corrections.
• Overseas transfers. If your website host, payment gateway or email platform stores data outside Singapore, section 26 requires the transfer to meet prescribed standards of protection. Say that data may be transferred and that you take steps to protect it.
• Retention and security. Summarise how long you keep data and that you use reasonable security arrangements (sections 24 and 25). Do not promise specific technologies you do not use.

If you have not yet appointed a DPO, start there. Our guide to what every company must do to appoint a data protection officer explains the role.

What about cookies and analytics tools?

Singapore does not have a cookie rule equivalent to the European cookie banner regime. The question under the PDPA is whether the cookie or tracking tool collects personal data, meaning data from which an individual can be identified, alone or with other information the organisation has or is likely to have. The PDPC’s Advisory Guidelines on the PDPA for Selected Topics include a chapter on online activities that discusses this.

In practice, explain in the privacy notice which analytics, advertising and session cookies the site uses, what they collect, and how visitors can disable them through browser settings. Where tracking tools are linked to logged in accounts or used for targeted advertising, treat the data as personal data and make sure your notice and consent wording cover it.

What should the website terms of use cover?

Terms of use protect the business against visitors who copy content, rely on general information as advice, or misuse the site. A practical clause list:

1. Who operates the site: company name, UEN and registered address.
2. Acceptance: that using the site means accepting the terms, with a link from every page footer.
3. Intellectual property: the business owns or licenses the content, logos and images, and visitors may not copy them for commercial use.
4. Information only: website content is general information and not professional advice, where relevant.
5. Acceptable use: no hacking, scraping, uploading malware or posting unlawful material.
6. User content: if visitors can post reviews or comments, the right to remove content and a licence to display it.
7. Third party links: no responsibility for linked sites.
8. Limitation of liability: reasonable limits, drafted with the Unfair Contract Terms Act 1977 in mind.
9. Changes: how and when you may update the terms.
10. Governing law and jurisdiction: Singapore law and Singapore courts.

Limitation clauses are only effective if they are reasonable and properly incorporated. Our article on whether a limitation of liability survives the Unfair Contract Terms Act explains the tests.

What should terms of sale for an online shop include?

Terms of sale form the contract with each customer. The Electronic Transactions Act 2010 confirms that offers and acceptances can be made electronically and that a contract is not invalid only because it was formed electronically (section 11). It also treats a general online proposal, such as product listings on a shop, as an invitation to make offers unless it clearly shows an intention to be bound (section 14). This is why well drafted terms say that the customer’s order is an offer and the business accepts it when it sends an order confirmation or ships the goods. That wording lets the business cancel an order placed at an obviously wrong price.

The Act also deals with input errors in automated systems (section 16). If a natural person makes an input error and the system gives no opportunity to correct it, the person may withdraw the affected part of the communication in certain conditions. A clear order summary page with an “edit” option reduces this risk.

Include at least:

• description of goods or services, and how prices, GST and delivery charges are shown;
• how the contract is formed and when the order is accepted;
• payment methods and when payment is taken;
• delivery times, risk and title;
• returns, refunds, exchanges and cancellation;
• warranties and what happens if goods are defective;
• subscription renewal and cancellation terms, if any;
• limitation of liability, complaints handling and governing law.

Use a click wrap acceptance, such as an unticked checkbox “I agree to the Terms of Sale” with a link next to it at checkout, and keep a record of which version each customer accepted. A link buried in the footer is weaker evidence that the customer agreed.

Which consumer protection rules affect what the site says?

The Consumer Protection (Fair Trading) Act 2003 prohibits unfair practices by suppliers in consumer transactions, including doing or saying anything that could reasonably mislead a consumer. Website terms cannot cure misleading marketing on the product pages.

The Competition and Consumer Commission of Singapore’s Guidelines on Price Transparency, effective from 1 November 2020, cover drip pricing, price comparisons, discounts and the use of “free”. They expect unavoidable charges such as service fees and surcharges to be included in the headline price, or clearly disclosed where they cannot reasonably be calculated in advance. They also encourage letting customers actively choose optional add-ons instead of pre-selecting them for them.

For the wider set of rules on starting an online store, see our guide to setting up an online business in Singapore.

What about newsletters, SMS and WhatsApp marketing?

Sign up forms need separate, clear wording. The Do Not Call provisions in Part 9 of the PDPA govern marketing messages to Singapore telephone numbers, and the Spam Control Act 2007 governs unsolicited commercial electronic messages sent in bulk. Under the Second Schedule of the Spam Control Act, such messages must include an unsubscribe facility that stays valid for at least 30 days after sending, and requests must be honoured within 10 business days. Email subject lines must not be misleading and must carry the “<ADV>” label in the way the Act requires. Our guide to marketing calls, SMS and WhatsApp messages under the DNC and Spam Control rules covers these in detail.

Common mistakes when businesses copy templates

• Copying a European GDPR policy. It refers to legal bases, regulators and rights that do not match the PDPA, and can confuse customers about how to contact you.
• Naming the wrong entity. Terms must name the company that actually contracts with customers.
• Promises the business does not keep. For example, “we never share data with third parties” when you use a courier, payment gateway and email platform.
• No DPO contact. A generic “contact us” form does not clearly show who handles data protection questions.
• Refund terms that conflict with the checkout page or with what staff tell customers.
• Never updating. New tools such as chat widgets, booking systems or AI chatbots often collect new data that the old notice does not mention.

Example: a home bakery moves online

Example: A private limited company that sells cakes launches a website with online ordering, a WhatsApp order button and a newsletter. Its directors map the data the site collects: names, phone numbers, delivery addresses, allergy notes and payment confirmations from the payment gateway. They designate a director as DPO and publish a dedicated email address for data protection questions. The privacy notice lists order fulfilment, delivery, customer service and, separately, marketing with consent. The terms of sale state that orders are accepted only on confirmation, set a cut off for changing delivery dates and explain refunds for damaged items. The newsletter form uses an unticked box. The company keeps a dated copy of each version of its terms. This example is hypothetical.

Website legal pages checklist

• Privacy notice with purposes, consent and withdrawal, access requests, transfers and DPO contact
• Cookie and analytics information
• Website terms of use linked in every footer
• Terms of sale with click wrap acceptance at checkout
• Price display that includes unavoidable charges
• Separate marketing consent with unsubscribe instructions
• Company name, UEN and contact details visible on the site
• Version history and internal owner for each document

Frequently asked questions

Is a privacy policy compulsory for a Singapore website?

The PDPA requires you to notify purposes, obtain consent where needed and make your DPO’s business contact information public. A published privacy notice is the normal way to meet these obligations online, so in practice any site that collects personal data should have one.

Does a website with only a contact form need a privacy notice?

Yes, if the form collects names, emails or phone numbers. A short notice explaining that you use the details to respond to the enquiry, and how to reach your DPO, is usually enough.

What happens if our privacy practices breach the PDPA?

The PDPC can give directions and impose financial penalties. Under section 48J, the maximum for an organisation is S$1 million, or 10% of annual turnover in Singapore if that turnover exceeds S$10 million, whichever applies. Actual penalties depend on the seriousness of the breach and other factors.

Can we change our terms of sale at any time?

You can update them for future orders, but each order is governed by the version the customer accepted. Keep dated copies and avoid applying new terms to orders already placed.

Do we need separate terms for business customers?

It is often sensible. Consumer protection law applies to consumer transactions, and the reasonableness tests for limitation clauses can apply differently to businesses. Many companies use one set for consumers and another for trade accounts.

Need help with your website terms and privacy notice?

If your company is launching a website or online shop, or your existing terms and privacy notice were copied from another site, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, we will refer you to a firm on our panel of Singapore law firms that regularly handles data protection and commercial contracts. Raffles Corporate Services is a corporate services provider, not a law firm, and this article is general information, not legal advice.

The Raffles Corporate Services Editorial Team, Raffles Corporate Services