PDPA Staff Acknowledgement Form for Singapore Employers

By Amanda Zheng, DataCare Solutions · September 2026 · Free download

A free, printable staff data protection pledge for Singapore employers. Ten specific commitments plus a signature block for the employee and a supervisor or witness. It exists to answer one question cheaply: can you show that the people handling personal data knew what they were required to do?

Staff Data Protection Pledge

Ten commitments, an acknowledgement paragraph, and a signature block. Free, no sign-up.

Download the form

What the employee is committing to

The ten commitments, in plain terms:

Collect personal data only for legitimate business purposes that have been clearly communicated
Access only the personal data they are authorised to see and need for their role
Never disclose personal data to unauthorised parties, internal or external
Use secure methods to store and transmit personal data, including encryption where required
Not retain personal data longer than necessary, and dispose of it properly
Ensure proper disposal of both physical and digital documents
Report suspected or confirmed breaches immediately to their supervisor and the DPO
Follow all company data protection policies and procedures at all times
Complete required data protection training and keep their knowledge current
Understand that violations may result in disciplinary action

It closes with an acknowledgement paragraph and a declaration block: employee name, department, signature and date, plus a supervisor or witness signature and date.

Why a signed form is worth the two minutes

The PDPA does not name a staff acknowledgement as a standalone requirement. What the Accountability Obligation requires is that you develop and implement policies and practices, and communicate them to your staff. PDPC guidance expects training records to exist as evidence.

The practical value: a policy on a shared drive proves nothing about who read it. A signed acknowledgement names the person, the date and what they agreed to. If an incident happens, that is the difference between saying your staff were trained and showing it.

Most breaches start with a person rather than a system: a file sent to the wrong recipient, a mailing list pasted into the To field, records still reachable after someone leaves. Those are not technical failures, and the honest defence is that the person was told, in writing, and confirmed it.

When to have staff sign it

At onboarding, for anyone who will handle personal data. In a small company that is usually close to everyone.
After each refresher training session, so the record has a current date rather than one from four years ago.
Whenever your policies change materially, since the acknowledgement should reflect what your policies actually say now.
When someone changes role into handling more sensitive data than before.

Keep the signed copies with your training records. Together they answer what an investigator asks first. Our PDPA staff training cost breakdown covers the training side, including how often it needs repeating.

What to change before you use it

Put your company name in where the template says [COMPANY NAME].
Name your DPO in the breach-reporting commitment, so reporting has an actual destination.
Align the commitments with your own policies. If your retention rules or approved tools differ, the form should say so, otherwise staff are agreeing to something you do not do.
Check the disciplinary wording against your employment terms and HR policy.

Need the policies this form points to?

An acknowledgement is only as strong as the policies behind it. A gap assessment tells you which ones you actually have.

Get a Gap Assessment

Frequently asked questions

What is a PDPA staff acknowledgement form?

A signed declaration in which an employee confirms they understand their data protection responsibilities and agree to follow the organisation’s policies. It typically lists specific commitments, such as only accessing data they are authorised to see and reporting suspected breaches immediately, and ends with a signature block for the employee and a supervisor or witness.

Is a staff acknowledgement form required under the PDPA?

It is not named in the Act as a standalone requirement. The Accountability Obligation requires organisations to develop and implement policies and practices and to communicate them to staff, and PDPC guidance expects training records to exist as evidence. A signed acknowledgement is one of the simplest ways to show that communication actually happened and who received it.

When should employees sign a data protection acknowledgement?

At onboarding for anyone who will handle personal data, again after each refresher training session, and whenever your policies change materially. Keep the signed copies with your training records: together they answer the question an investigator asks first, which is whether the people handling personal data knew what they were required to do.

Is this form free to use?

Yes. Download it, put your company name in, adjust the commitments to match your own policies, and have staff sign it. It is a starting point for Singapore SMEs rather than legal advice, and it should reflect what your policies actually say.

Useful resources

Disclaimer: This template and article are for general information only and do not constitute legal or employment advice. Adapt the commitments and any disciplinary wording to your own policies and employment terms, and seek qualified advice where the consequences matter.