PDPA and cyber security for real estate agencies
We work across sectors. Here is what matters most in yours.
The 3 most recent PDPC decisions in your sector
2025-02-27 · Voluntary undertaking
Ransomware spread from a compromised user account and an administrator account.
Lesson: Guard administrator accounts and watch for attackers moving across the network.
Read the PDPC decision of 27 February 2025, on pdpc.gov.sg (opens in a new tab)2024-08-02 · Voluntary undertaking
Administrator accounts set up for a vendor’s cloud move were guessed over remote desktop.
Lesson: Remove vendor accounts after the job and lock down remote administration.
Read the PDPC decision of 2 August 2024, on pdpc.gov.sg (opens in a new tab)2024-03-21 · Financial penalty and directions, S$16,800
A property salesperson collected and used personal data without consent or notice.
Lesson: Tell people why you collect their data, and get consent first.
Read the PDPC decision of 21 March 2024, on pdpc.gov.sg (opens in a new tab)
Source: PDPC Case Library, read 12 October 2026.What PDPC decisions show
Where organisations like yours are most often exposed
The gap areas our free check asks about most for your sector.
- NRIC numbers or copies collected without needCollecting NRIC numbers without need adds risk you do not have to carry.How we help: Policies, notices and consent
- Marketing messages without DNC checks or consentMarketing without consent or Do Not Call checks can lead to penalties.How we help: Policies, notices and consent
- Leadership not briefed on data and cyber riskLeaders are expected to understand data and cyber risk, not just delegate it.How we help: Board briefing
- Purposes not notified, consent not provableIf you cannot show people were told why you collect their data, their consent is hard to prove.How we help: Policies, notices and consent
Certificates that most often fit your sector
From every answer path of our “Which certification fits?” questions for your sector. Side by side, as choices.
Common questions
Can agents keep client data on their own phones?
Yes, with controls: a passcode, encryption, a managed work space for client data, and a way to remove it when the agent leaves. Device management makes those controls practical.
Can we collect National Registration Identity Card (NRIC) copies from buyers and tenants?
Where the law requires it or identity must be verified to a high degree, as in some property transactions. Collect what the transaction needs, store copies securely and limit who can see them.
Do property agencies need a data protection officer?
Yes. Every organisation under the PDPA must appoint one and publish the contact. We can act as your named data protection officer (DPO) and train your agents.
What happens after a data breach at an agency?
Assess the breach within 30 calendar days; if the breach is notifiable, tell the Personal Data Protection Commission (PDPC) within 3 calendar days. We help you through each step.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)