PDPA Compliance in Research Contracts: A Singapore Guide

Singapore’s Personal Data Protection Act (PDPA) governs how organizations collect, use, and disclose personal data. For universities managing research contracts, particularly those involving human subjects, patient data, or cross-border collaborations, PDPA compliance is not optional.

Yet many Research Offices still treat data protection as an afterthought, bolting on generic privacy clauses after negotiations are nearly complete. That approach creates risk. A single poorly drafted data use agreement can expose the university to regulatory action, damage institutional reputation, and jeopardize research partnerships. Data protection should be treated as a core component of your broader contract risk assessment framework, not an afterthought.

This guide covers when the PDPA applies to research, what clauses your contracts need, and how to operationalize compliance across your contract portfolio.

When Does PDPA Apply to Research?

The PDPA applies whenever an organization in Singapore collects, uses, or discloses personal data. In the research context, this means the Act is triggered any time your institution handles data that can identify a living individual, whether directly or indirectly.

Common scenarios where PDPA applies include:

• Surveys and behavioural studies that collect names, contact details, or demographic information linked to individual respondents.
• Health and clinical research involving patient records, biobank data, or clinical trial participant information.
• Data Use Agreements (DUAs) where personal data is shared between institutions for secondary analysis.
• Cross-border collaborations where personal data collected in Singapore is transferred to a partner institution overseas.
• Industry-sponsored research where a corporate sponsor provides customer or employee data for analysis.

The Research Exemption and Its Limits

The PDPA does provide a research exemption, but it is narrower than many Research Offices assume. Under sections 17 and 18 of the PDPA (read together with Part 1 of the Fourth Schedule), an organization may collect, use, or disclose personal data without consent for research purposes, but only when all of the following conditions are met:

1. The research is in the public interest. Purely commercial research with no broader societal benefit may not qualify.
2. It is not reasonably practicable to obtain consent. This is a high bar. If you can realistically seek consent (even retrospectively), the exemption does not apply.
3. Adequate safeguards are in place to protect the personal data, including de-identification where possible.
4. The results will not be published in a form that identifies individuals without their consent.

Relying on the exemption without documenting how each condition is satisfied is a compliance risk. Your Research Collaboration Agreements (RCAs) and DUAs should explicitly state whether the exemption is being invoked and reference the safeguards in place.

Key PDPA Principles for Research Contracts

The PDPA is built around a set of data protection obligations. Each one has direct implications for how your research contracts should be drafted.

Consent. Unless the research exemption applies, you must obtain consent before collecting personal data. Your contracts should specify who is responsible for obtaining consent, what form it takes, and how withdrawal of consent is handled.

Purpose Limitation. Personal data may only be used for the purpose for which it was collected, or a purpose the individual would reasonably consider appropriate. Research contracts must clearly define the permitted purpose and prohibit secondary use without additional consent or a new lawful basis.

Notification. Individuals must be informed of the purposes for which their data will be collected, used, or disclosed. Contracts should specify which party is responsible for providing this notification and in what form.

Access and Correction. Individuals have the right to request access to their personal data and to correct errors. Your contracts need to allocate responsibility for responding to these requests, which is particularly important in multi-institution collaborations where data is held by more than one party.

Protection. Organizations must implement reasonable security arrangements to protect personal data. This is not a vague aspiration. It translates into specific contractual requirements around encryption standards, access controls, and security certifications.

Retention Limitation. Personal data should not be retained longer than necessary for the purpose for which it was collected. Research contracts should specify retention periods and destruction obligations, particularly for data that is no longer needed after the study concludes.

Transfer Limitation. Personal data may only be transferred outside Singapore if the receiving jurisdiction provides a comparable standard of protection, or if contractual safeguards are in place. This is a critical clause in any cross-border research agreement.

Data Breach Notification. Since the 2021 amendments, organizations must notify the Personal Data Protection Commission (PDPC) within three calendar days of assessing that a data breach is notifiable, meaning the breach results in or is likely to result in significant harm to affected individuals, or involves 500 or more individuals. Contracts must specify who bears the notification obligation and what the reporting chain looks like between collaborating institutions.

Essential PDPA Clauses for Research Contracts

When personal data is involved, your RCAs, DUAs, and Material Transfer Agreements (MTAs) need specific provisions that go beyond standard confidentiality language. If you have already built a university contract clause library, PDPA-specific modules should be a core component.

Here is what your contracts should address:

Purpose and scope of data use. Define precisely what data will be collected or shared, the specific research purpose, and what constitutes unauthorized use. Avoid broad language like “for research purposes” because the PDPA requires specificity.

Lawful basis for processing. State whether the processing relies on consent, the research exemption, or another lawful basis. If invoking the research exemption, reference the conditions being satisfied.

Data security requirements. Specify minimum security standards: encryption at rest and in transit, access controls, multi-factor authentication, regular security assessments, and incident response procedures. Reference recognized frameworks such as ISO 27001 where possible.

Data breach notification obligations. Require the data recipient to notify the data provider within a fixed timeframe (typically 24-48 hours) of discovering a suspected breach, and to cooperate in any investigation or regulatory notification.

Cross-border transfer provisions. If data will leave Singapore, the contract must include binding obligations on the overseas recipient to protect the data to a standard at least comparable to the PDPA. More on this below.

Data retention and destruction requirements. Specify how long data may be retained, the format of retention (anonymized vs. identifiable), and the method of destruction (certified deletion, secure disposal of physical media). Include a certification requirement: the recipient should confirm in writing that data has been destroyed.

Sub-processing restrictions. Restrict or prohibit the recipient from sharing the data with third parties (including sub-contractors or affiliated institutions) without prior written consent. If sub-processing is permitted, require equivalent contractual protections to flow down.

Audit rights. Reserve the right to audit the data recipient’s compliance with the agreement, including their security arrangements and data handling practices.

Indemnification for data breaches. Allocate financial responsibility for breaches caused by a party’s failure to comply with its data protection obligations. This should cover regulatory fines, notification costs, and third-party claims.

Return or destruction of data upon termination. Specify that upon expiry or termination of the agreement, all personal data (including copies) must be returned or securely destroyed, with written confirmation provided.

Cross-Border Data Transfers

For Singapore universities engaged in international research collaborations, cross-border data transfers are one of the most consequential PDPA compliance areas.

What the PDPA Requires

Under section 26 of the PDPA, an organization may transfer personal data outside Singapore only if the receiving country or territory provides a standard of protection that is at least comparable to the protection under the PDPA, or if the transfer is covered by one of the recognized exceptions.

In practice, the most common approach for research collaborations is to use contractual safeguards, binding the overseas recipient to data protection obligations that mirror the PDPA through the terms of the research agreement itself.

Practical Considerations by Region

ASEAN collaborations. Several ASEAN countries have enacted their own personal data protection laws, including Malaysia’s PDPA (2010), Thailand’s PDPA (2019), and the Philippines’ Data Privacy Act (2012). While there are broad similarities with Singapore’s PDPA, the specific requirements differ. Your contracts should reference the applicable local law in the recipient’s jurisdiction and address any gaps.

EU collaborations. When collaborating with EU-based institutions, you will need to contend with the General Data Protection Regulation (GDPR), which has its own transfer mechanism requirements (Standard Contractual Clauses, adequacy decisions, etc.). Singapore is not currently covered by an EU adequacy decision, so contractual safeguards on both sides are essential. The good news: the PDPA and GDPR share many core principles, so alignment is achievable with careful drafting.

US collaborations. The United States has no comprehensive federal data protection law. For health-related research, HIPAA applies to covered entities and their business associates. For other research, sector-specific and state-level laws may apply. Contracts with US institutions should be particularly detailed in specifying the security and privacy standards the recipient must meet.

PDPA vs Other Data Protection Frameworks

For multi-jurisdictional research collaborations, understanding how the PDPA compares to other frameworks helps you draft contracts that satisfy multiple regimes simultaneously.

When your research spans multiple jurisdictions, the most practical approach is to draft to the highest common standard. In most cases, that means GDPR-aligned clauses with PDPA-specific additions for Singapore-related obligations.

How to Operationalize PDPA Compliance in Your Contract Workflow

Having the right clauses is necessary but not sufficient. You also need systems and processes to ensure those clauses are consistently applied, tracked, and enforced across your contract portfolio.

Build PDPA-specific clauses into your contract playbooks. Rather than relying on individual contract managers to remember PDPA requirements, embed them directly into your review playbooks. Define mandatory clauses for contracts involving personal data, acceptable fallback positions, and escalation triggers for non-standard requests.

Use AI-assisted review to flag missing provisions. When your Research Office receives an incoming agreement from an external partner, AI-assisted contract review can automatically check whether the agreement contains the required PDPA provisions (data breach notification, cross-border transfer safeguards, retention and destruction obligations) and flag gaps before you even begin negotiation.

Track data processing obligations across your portfolio. PDPA compliance does not end at signature. Your contract management system should allow you to track which agreements involve personal data, what the permitted purposes are, and when data retention periods expire. This is especially important when managing a large portfolio of active research collaboration agreements and DUAs.

Set reminders for retention deadlines and destruction obligations. A contract that requires data destruction within 90 days of project completion is only effective if someone acts on it. Automated reminders tied to specific contract milestones ensure nothing falls through the cracks.

Ensure your contract platform supports data residency requirements. For Singapore institutions, it matters where your contract data is stored. Pactly’s infrastructure is hosted on AWS Singapore, meaning your contracts and associated data remain within Singapore. Combined with ISO 27001 certification, this provides the security assurance that data protection officers and institutional compliance teams need.

Conclusion

PDPA compliance in research contracts is not a one-time exercise. It requires the right clauses in your agreements, the right systems to track obligations across your portfolio, and the right processes to ensure nothing is missed as collaborations evolve and data flows across borders.

The universities that get this right build PDPA compliance into their contract workflow from the start, through standardized clause libraries, automated reviews, and centralized obligation tracking, rather than retrofitting it after an audit finding or, worse, a data breach.

If you are looking to strengthen how your Research Office manages data protection obligations across your contract portfolio, book a demo to see how Pactly can help.