PDPA and GEO: What a Foreign Agency Must Do

Singapore's Personal Data Protection Act applies to a foreign agency the moment it collects, uses or discloses a Singapore resident's personal data, regardless of where that agency's office sits. For an Indonesia-based, or any non-Singapore-based, GEO agency, this means PDPA compliance isn't a nice-to-have trust signal for the pitch deck. It's an operational requirement from the first prompt-tracking session that touches identifiable client or customer data.

By Tessar Napitupulu, Founder & CEO of PT Arfadia Digital Indonesia and Forbes Agency Council member.

Why GEO Work Touches Personal Data at All

On the surface, Generative Engine Optimization looks like a content and monitoring discipline, not a data-processing one. Most of it is: tracking a fixed panel of buyer-intent prompts across AI platforms is public visibility testing, and public information carries minimal PDPA exposure on its own.

The exposure appears at the edges of the engagement, in the parts that make GEO reporting genuinely useful to an enterprise client. Attributing AI-referred traffic to pipeline requires CRM data. Understanding which real buyer questions to track often means reviewing call transcripts or sales notes. Benchmarking a client's own audience against AI-search behaviour can involve customer lists. None of this is exotic; it's normal enterprise marketing analytics. But it means a GEO engagement that starts as "public prompt testing" tends to expand into something that does process personal data, and the PDPA doesn't care which part of the engagement started that way.

The PDPA's Reach: What "Extraterritorial" Actually Means Here

Singapore's Personal Data Protection Act 2012, as amended, applies to any organisation that collects, uses or discloses personal data in relation to Singapore, whether or not that organisation is formed, recognised, or resident in Singapore. The operative question the Personal Data Protection Commission asks is not where an agency's office is. It's whether personal data connected to Singapore is being processed.

For an agency delivering GEO services to a Singapore client from Jakarta or Bandung, this settles the question before it's asked: PDPA obligations apply from day one of the engagement, not from the point of setting up a Singapore entity, which most foreign agencies serving Singapore clients remotely never do and are not required to do.

Data Intermediary Status: The Concept Most Agencies Get Wrong

Under the PDPA, an agency processing personal data on behalf of a Singapore client, rather than for its own purposes, generally operates as a data intermediary. This status is genuinely useful: a data intermediary is exempt from most of the PDPA's standard data protection obligations, with the client remaining accountable overall.

The exemption is not unconditional, and this is where the misunderstanding tends to happen. Even as a data intermediary, an agency remains directly liable under two specific provisions: the Protection Obligation, which requires reasonable security measures against unauthorised access, alteration or disclosure, and the Retention Limitation Obligation, which requires personal data to be deleted or anonymised once it is no longer needed for the purpose it was collected for. An agency that processes data outside the scope of its written agreement with the client loses data intermediary status entirely, and faces full liability as a primary data controller instead. In practice, this means the contract itself, defining exactly what the agency is and isn't authorised to do with client data, is the single most important compliance document in the relationship, not an afterthought signed after the statement of work.

What the Penalties Actually Are, Precisely

Financial exposure under the PDPA was significantly increased by the Personal Data Protection (Amendment) Act 2020, with the enhanced structure taking effect from 1 October 2022. The maximum financial penalty is commonly summarised as "S$1 million or 10% of annual turnover, whichever is higher," and most reporting on this figure, including several otherwise well-researched Singapore market analyses, states it exactly that way, without qualification. That summary is incomplete.

The 10%-of-turnover branch of the penalty only applies to organisations whose annual turnover in Singapore exceeds S$10 million. Organisations at or below that threshold, which describes most agencies and many of their SME clients, face a flat S$1 million cap instead. The distinction matters for anyone sizing genuine risk exposure rather than reciting a headline number, and it's worth confirming directly against PDPC guidance before it appears in a client-facing compliance document, precisely because the unqualified version circulates so widely that it has become the default way most secondary sources describe it.

Organisation's Singapore turnover	Maximum financial penalty per breach
Exceeds S$10 million	S$1 million, or 10% of annual Singapore turnover, whichever is higher
S$10 million or below	Flat S$1 million cap
Individual director or officer (Section 51)	Personal liability where breach is attributable to neglect, consent or connivance

Beyond financial penalties, the Personal Data Protection Commission can issue binding directions and, notably, publishes the names of organisations it penalises alongside a description of the breach. For an agency whose entire value proposition rests on being trusted with a client's brand reputation, that public-naming mechanism is arguably a sharper incentive than the financial cap itself.

Published enforcement decisions make this concrete rather than theoretical. The PDPC's largest penalty to date remains the 2019 SingHealth and IHIS case, a cyberattack that compromised 1.5 million patients' personal data, including the Prime Minister's, resulting in a combined S$1,000,000 penalty (S$250,000 against SingHealth, S$750,000 against IHIS) for systemic failures in the Protection Obligation: inadequate staff training, insufficient security monitoring, and delayed breach response. At the other end of the scale, Grab was fined a comparatively modest S$10,000 in 2020 for updating its privacy policy to permit broader third-party data sharing without proper consent, a Consent Obligation breach that nonetheless attracted significant media attention disproportionate to the financial penalty, illustrating the reputational point above. More recently, Marina Bay Sands was fined S$315,000 in October 2025, evidence that active PDPC enforcement against large, well-resourced organisations has continued well into the period this GEO market analysis covers. For an agency structuring its own compliance posture, the range across these three cases, from S$10,000 to S$1,000,000, is a more useful calibration tool than the statutory maximum alone: it shows the PDPC scales penalties to the severity and systemic nature of the failure, not merely to organisation size.

The 2025-2026 AI Governance Additions

The PDPA itself hasn't been rewritten for the AI era, but Singapore's regulators have layered new, AI-specific guidance on top of it, and an agency running GEO work in this market should know what changed recently rather than working from a static, several-years-old understanding of the framework.

The PDPC's 2025 advisory guidelines on AI systems require organisations deploying AI to be transparent about how personal data is used, proportionate to the level of risk involved, a standard that applies to an agency's own AI-assisted content and monitoring tools, not only to a client's product. The Data Protection Trustmark, Singapore's voluntary certification for good data protection practice, was elevated to a formal Singapore Standard, SS 714:2025, aligning it more closely with international benchmarks and giving enterprise procurement teams a more recognisable certification to ask for. Separately, the government expanded its Global AI Assurance Sandbox in July 2025 to cover more complex AI risks specifically, including data leakage, prompt injection, and agentic AI governance, signalling that regulators are actively tracking the newer failure modes AI-driven marketing tools can introduce, not just the traditional data-handling risks the original PDPA was written for.

One further, very concrete change is worth flagging for any client-facing content built for this market: in February 2026, the PDPC announced that private organisations must stop using NRIC numbers for authentication purposes entirely by 31 December 2026. This affects login flows, identity verification and any lead-capture mechanism a GEO campaign's landing pages might otherwise have relied on, and it is recent enough that older Singapore-market content, including some published agency guidance, may not yet reflect it.

The MAS Layer, for Financial Services Clients

Clients in financial services face an additional compliance layer on top of the general PDPA framework. The Monetary Authority of Singapore's FEAT principles (Fairness, Ethics, Accountability, Transparency) and the Veritas framework govern AI use in that sector specifically, alongside sector-specific guidance published through 2025 and 2026, including a 24-firm industry consortium's AI Risk Management Toolkit. An agency running GEO or AI-citation monitoring for a bank, insurer or fintech should expect vendor due-diligence questions aligned to these frameworks as a matter of course, not as an unusual request.

Building This Into an Engagement From Day One

The practical response to all of this is straightforward, even if the underlying law is not: PDPA-readiness has to be built into the engagement structure before it starts, not bolted on after a client raises the question. That means a named DPO with public contact details, a data processing agreement that precisely scopes what the agency is authorised to do with client data, ASEAN Model Contractual Clauses covering the Indonesia-Singapore data transfer itself, and a documented retention and deletion schedule that gets followed, not just written.

None of this is a differentiator that wins a pitch on its own. It's closer to a gate: Singapore's enterprise and financial-services procurement teams will ask about it, and an agency without clear, specific answers loses credibility on a dimension that has nothing to do with GEO methodology at all.

One adjacent point worth clarifying, because it comes up in Singapore market-entry conversations and is easy to misread: Singapore's Market Readiness Assistance grant covers up to 70% of overseas marketing costs, capped at S$100,000 per market under a programme running from April 2026 to March 2029, and the Enterprise Development Grant and Productivity Solutions Grant separately subsidise up to 50% of approved tools and services. These are genuinely useful funding mechanisms, but they exist to help Singapore SMEs expand into overseas markets, not to subsidise a foreign agency's own Singapore market entry. The relevant, correct use of this information is different: if a GEO engagement is being pitched to a Singapore client that is itself expanding into new overseas markets, these grants may be directly relevant to that client's own budget, and worth raising in the proposal on their behalf. It has no bearing on Arfadia's own cost structure as a foreign agency serving Singapore.

The regulatory and compliance dimension of GEO, across multiple markets, is covered in more depth in Cited or Silent, alongside the platform-specific playbooks this project's Singapore research also drew on.

---

Frequently Asked Questions

Does a foreign agency need to register a Singapore company to serve Singapore clients under the PDPA?

No. PDPA obligations attach to the processing of personal data in relation to Singapore, not to corporate registration. A foreign agency can be fully PDPA-compliant while operating entirely from outside Singapore, provided its contracts, DPO designation and data-handling practices meet the Act's requirements.

Is public AI-citation monitoring itself risky under the PDPA?

Generally lower-risk, because it typically tracks brand and competitor entities using public prompts, not personal data. Risk rises specifically where monitoring extends to identifiable leads, customer records, or confidential client documents, which should be treated as a separate, more tightly governed workflow.

What is a Data Protection Officer required to actually do?

The DPO is responsible for ensuring PDPA compliance, handling data protection queries and complaints, and being the accountable, publicly contactable point of contact for the organisation's data protection obligations. Larger organisations often integrate this into an existing compliance or legal function rather than hiring a dedicated role.

How quickly must a data breach be reported to the PDPC?

Once an organisation has assessed that a breach is notifiable, typically because it affects 500 or more individuals or is likely to cause significant harm, notification to the PDPC is required within 3 calendar days of that assessment.

Are ASEAN Model Contractual Clauses legally required for Indonesia-Singapore data transfers?

They are not the only permitted mechanism, but they are the PDPC-recognised standard template for demonstrating that transferred data receives protection comparable to the PDPA, and Indonesia's own 2022 Personal Data Protection Law references compatible cross-border transfer mechanisms, making the ASEAN MCC framework a practical, low-friction choice for this specific corridor.

How severe are real PDPC penalties in practice, compared to the S$1 million statutory maximum?

Published cases range widely by severity: Grab was fined S$10,000 in 2020 for a consent-related breach, Marina Bay Sands was fined S$315,000 in October 2025, and the SingHealth/IHIS case, the largest to date, totalled S$1,000,000 in 2019 for a breach affecting 1.5 million patients. The PDPC scales penalties to the severity and systemic nature of the failure rather than defaulting to the statutory maximum.

For the platform-specific playbooks and measurement frameworks that sit alongside this compliance layer, Cited or Silent covers the regulatory dimension of GEO across multiple markets in more depth. Get the free excerpt here, or see how this fits into Arfadia's GEO & AEO service for Singapore engagements.

---