How to make sure your Singapore e-commerce business complies with privacy laws

Singapore’s economic development boom and the increasing penetration of mobile and internet services in the region has increased the need for cyber law reform in the area. Singapore has led the charge on a number of fronts, including privacy law, cloud computing law, and electronic transactions. With these changes in place, it’s important that new e-commerce businesses in Singapore and those who have customers in Singapore are aware of the laws in place that they must comply with.

What is the law?

In Singapore, the primary governing act is called the Personal Data Protection Act 2012 (PDPA). The PDPA provides for the rights of consumers to have their personal data protected, as well as the rights of companies such as your e-commerce business to collect that data for legitimate and reasonable purposes.

The purpose of the PDPA is to regulate the flow of personal data, and satisfy the concerns of individuals about how their data is used. In this way, the PDPA hopes to strengthen Singapore’s role as a trusted, competitive hub for businesses to be based.

The PDPA has three main concepts that make it up:

1. Consent;
2. Purpose; and
3. Reasonableness.

This means that your e-commerce business should only collect, use, or disclose personal data with your customers’ consent, and make sure that you only use that data in an appropriate way (considering the circumstances). You must inform your customers of the purposes for which you will use their data.

The “reasonableness” concept means that you can only use your customers’ data for uses that are considered appropriate or reasonable in the circumstances.

For example, for your e-commerce business, it would be reasonable to collect customer data so that you can target new markets, send out special deals, or order more of a popular product.  Here’s an example from Adafruit asking me for my credit card and shipping details so that I can buy a Raspberry Pi:

Given that I am trying to purchase an item from their e-commerce store, it is completely reasonable that they need to collect this information.

On the other hand, it wouldn’t be reasonable to collect customer data through a store to sell to a recruitment company so that they can find more potential employees to market to their clients.