Free website PDPA checklist (Excel)

How to use the website PDPA checklist

1. Download the file and open it in Excel or Google Sheets. On the Start here tab, fill in your website details and who your data protection officer is.
2. On Forms and consent, list every form on the site, including checkout, sign-ups and file uploads. Note what each one collects and what you tell people next to the button.
3. On Cookies, tags, analytics, list every tag, plugin and tool that receives visitor or customer data. If you cannot say where a tag sends data, find out before you keep it.
4. Work through Notices and policy and Security and retention. Give each row an owner and a status, and write what needs fixing in Notes.
5. Keep Breach response and Requests log ready. When something happens, the log works out the assessment and notification dates for you. Review the whole file after any website change that collects data.

What should a website PDPA checklist cover?

Everything on the site that collects or passes on personal data, and what you do with it afterwards. That means each form and what it says to people, your privacy policy, every cookie, tag and third-party tool, security for form entries and admin logins, deleting what you no longer need, a breach plan, and a way to answer requests for access or correction.

Each row in the checklist names the PDPA section or PDPC guideline behind it, so you can check the source yourself. Our guide to the PDPA for websites in Singapore explains each area with worked examples.

How do you fill in the cookies, tags and analytics inventory?

Open your tag manager and your website's plugin or app list, and add one row for each tool that receives data about visitors or customers: analytics, ad pixels, heatmaps, chat buttons, payment and email tools, and spam checks on forms. For each one, write what it is for, what it collects, where the data goes and what protects it there, such as a data processing agreement.

The basis column has a dropdown. PDPC's Advisory Guidelines on Selected Topics say cookies that collect no personal data need no consent, functions the visitor asked for may not need consent, and targeted advertising through cookies does, with cookie preference settings as good practice. If you are not sure, choose Not sure and ask your data protection officer.

How does the breach response tab work out the PDPA dates?

Enter the date you found the breach and the log adds 30 days as an assessment target, because PDPC's Key Concepts Guidelines say the assessment should generally be done within 30 calendar days. When you decide the breach is notifiable, enter that date and the log adds 3 days: section 26D of the PDPA says to notify the PDPC no later than 3 calendar days after that decision.

The log also flags breaches that affect 500 or more people, or that involve prescribed data such as a username with its password, as notifiable. Breaches that meet neither still need a judgement on whether significant harm is likely. Report through the PDPC's data breach e-service.

Is the checklist legal advice?

No. It is general information to help you organise what your website does with personal data, checked against the PDPA and PDPC guidance in October 2026. Where the PDPC has not said something directly, the article marks it as our reading. If your site handles sensitive data, such as health details or children's information, check your approach with your data protection officer or a lawyer.