Definition · Privacy Law

PDPA (Singapore)

Singapore's Personal Data Protection Act (PDPA) regulates how organisations collect, use, disclose, protect, retain, and transfer personal data, and sets duties that can differ for organisations and data intermediaries.

Put the evidence in context

Review the intended task, source information, human checkpoints and observed results together. A benchmark or sandbox result has a defined scope; it does not establish suitability, approval or performance for every institution.

Read the full explanation
Discuss this step for your team

For healthcare AI, PDPA analysis depends on the parties' actual roles, purposes, data flow, patient and provider context, processing and support locations, and contracts. A hospital, vendor, cloud provider, or other subprocessor should not be labelled an organisation, data intermediary, controller, or processor from its name alone. Health-sector rules, professional duties, institution policies, and security standards may apply alongside the PDPA.

Before production, assess the applicable basis and notices for collection, use, and disclosure; data minimisation; accuracy; protection; access and correction; retention; overseas transfers; breach handling; and contractual allocation. For a Micromeet deployment, hosting, AI processing, support access, subprocessors, retention, deletion, and audit evidence must be confirmed for that configuration and contract. This glossary is general information, not a conclusion that a deployment is compliant.