In 2018, the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC) opened a call for organisations to join a pilot of Singapore’s Data Protection Trustmark (DPTM). The certification was meant to help Singapore-based organisations show sound, transparent and accountable data protection practices, and it was developed in consultation with industry.
Communications and Information Minister S Iswaran announced the open call at the 6th Personal Data Protection Seminar. The pilot was intended to settle the framework and certification process before a full launch, which was planned for the end of 2018.
What the scheme offered
Certified organisations could display a DPTM logo in business communications for the length of the certification, which ran for three years. The idea was that consumers could quickly spot organisations whose data protection policies and practices had been independently assessed. That would give certified firms a competitive edge.
Tan Kiat How, IMDA’s chief executive and the PDPC’s Commissioner, said in 2018 that businesses able to win customer trust would be better placed to thrive in a data-driven digital economy. He said several companies were already taking part in the pilot and urged others to join in the following months.
How certification worked
IMDA appointed three independent Assessment Bodies: ISOCert, Setsco Services and TUV SUD PSB. They checked whether an applicant’s practices matched the DPTM requirements drawn up by the PDPC, and helped identify gaps to fix.
The scheme was open to any organisation based in Singapore. The process had four steps:
- The organisation applied to IMDA.
- Once IMDA accepted the application, the organisation chose an Assessment Body.
- The body submitted its independent assessment to IMDA for review.
- If IMDA was satisfied, it issued the certification.
Assessment fees were paid to the Assessment Bodies and started from $1,400 in 2018.
The pilot participants
Eight organisations went through the pilot to help refine the controls and processes:
- Carpe Diem @ ITE
- Chan Brothers Travel
- DBS Bank
- Fullerton Healthcare Group and Fullerton Systems and Services
- RedMart, Singapore Telecommunications (Singtel) and Tan Tock Seng Hospital Community Fund
Other organisations could sign up until 30 September 2018. Every pilot participant went through the full certification process, and the certificates they received were official and stayed valid after the pilot ended.
International alignment
Although the DPTM was a Singapore mark, it drew on the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data and on the APEC Privacy Framework. The aim was to let organisations later obtain both the DPTM and certification under the APEC Cross Border Privacy Rules (CBPR) or Privacy Recognition for Processors (PRP) systems more easily. APEC-certified organisations gain another route for legitimately transferring data across borders with other certified organisations in participating APEC economies.
The case for trust
The PDPC argued that data-driven technologies such as big data analytics and artificial intelligence depend on consumer trust. It cited its own surveys. Four in five individuals agreed that organisations handling personal data should have strong data protection policies and practices, and two-thirds favoured organisations that demonstrate a sound regime. Among industry representatives, nearly 80% said a data protection certification would significantly improve brand image and consumer confidence. Organisations also treated data protection as a factor when choosing a vendor to manage personal data for them.
Where the DPTM stands now
The DPTM is still a voluntary, enterprise-wide certification developed by the PDPC and IMDA. It is built on the Personal Data Protection Act and groups its requirements under four principles: governance and transparency, management of personal data, care of personal data, and individuals’ rights. Certification is valid for three years.
In 2025 the DPTM was incorporated into the Singapore Standards as SS 714:2025. The Singapore Accreditation Council launched an accreditation programme for certification bodies under the new standard, effective 7 July 2025. According to IMDA, the revised standard sets clearer requirements on third-party management and overseas transfers of personal data. Certified organisations now also undergo annual surveillance audits, and IMDA-appointed certification bodies work under the council’s oversight. Eligible organisations in Singapore may apply for government funding towards certification costs.