What Singapore’s PDPA requires
- Obtain consent for collection, use and disclosure of personal data.
- Notify individuals of the purposes for collection at or before collection.
- Allow individuals to withdraw consent and to access and correct their data.
- Implement reasonable security arrangements to protect personal data.
- Appoint a Data Protection Officer and publish their business contact.
- Notify the PDPC of a notifiable data breach within 3 calendar days of assessing that it is notifiable, and tell affected individuals if it is likely to cause them significant harm.
How GrantCookie covers it
- Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
- Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
- Withdrawing consent. A re-open control stays on every page, so visitors can withdraw or change their choice at any time.
This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.