> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Singapore and Thailand PDPA Posture

> Assemble a Singapore / Thailand PDPA posture from the controls Orbit already gives you — consent capture with a recorded lawful basis, DNC-register scrub, DSAR filing on the 30-day pdpa clock, and the privacy register — with one worked sequence per market.

# Singapore and Thailand PDPA Posture

Singapore's Personal Data Protection Act (2012, amended 2020) and
Thailand's Personal Data Protection Act B.E. 2562 (in force since 2022)
share a design: a personal-data regime with a consent requirement at
collection, an access-and-correction right on roughly a 30-day clock,
and — in Singapore's case — a separate Do Not Call (DNC) register that
gates outbound marketing calls, SMS, and faxes to +65 numbers. Thailand
runs a consent-led regime administered by the Personal Data Protection
Committee (PDPC Thailand); Singapore's regulator is the Personal Data
Protection Commission (PDPC SG). Both are **deemed-consent**,
opt-out-flavoured regimes compared with the EU's opt-in strictness —
Singapore's PDPA since the 2020 amendment even codifies a deemed-by-business-necessity
class — but that latitude is a judgement about your facts, made by your
counsel, not a default Orbit assumes.

PDPA places the duty on the organisation, not the platform. Orbit never
mandates your Singapore or Thailand posture — it gives you the tenant-controlled
consent ledger, the suppression layer, the DNC scrub chain, the DSAR
pipeline with a coded `pdpa` jurisdiction, and the privacy register.
This page maps each PDPA obligation to the surface you already have so
a PDPC questionnaire or a Thai regulator review reads the evidence from
your own configuration.

<Warning>
  This page describes Orbit's platform controls. It is **not legal
  advice.** Which PDPA obligations apply to you — deemed consent or express,
  whether Singapore's DNC register reaches your traffic, what basis fits a
  cross-border transfer — depends on your processing. Orbit supplies the
  record-keeping surfaces; the legal posture is yours. Confirm with qualified
  counsel.
</Warning>

***

## The PDPA surface map

One row per obligation a Singapore or Thailand operator usually has to
answer, mapped to the Orbit control that holds it and the deep page that
documents it. This table mirrors "The GDPR surface map" on the
[GDPR posture guide](/compliance/gdpr-posture-guide) — the same controls,
read against a different statute.

| PDPA obligation                                                                                                                           | Orbit control                                                                                                                                                                                             | Where it lives                                                                                  | Deep page                                                                                                                                 |
| ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **Consent capture with a lawful basis** (SG PDPA s13, TH PDPA s6)                                                                         | `POST /compliance/consent` with `lawful_basis` and a `purpose` string recorded per `(contact, channel)` pair — the opt-out/deemed-consent nuance lives in the basis you record, not in a platform default | Consent API; fan-out to suppression and send gates                                              | [Consent Management](/compliance/consent-management), [Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy) |
| **Withdrawal and suppression** (SG PDPA withdrawing consent, TH PDPA s19)                                                                 | STOP keywords, consent API opt-outs, preference center, CSV bulk import — one suppression list, scoped per channel                                                                                        | Suppression layer every send reads                                                              | [Opt-Out & Suppression Lists](/compliance/opt-out-suppression)                                                                            |
| **Do Not Call register interplay** (SG DNC provisions, Part 9 PDPA)                                                                       | The DNC scrub chain checks your own lists, the platform-wide list, and per-jurisdiction national registries; the check endpoint is readable as an API so a campaign pre-flights without a violating send  | `GET /compliance/dnc/check` plus the send-path chain; country rows refreshed by the rules feeds | [DNC Scrubbing](/compliance/dnc-scrub), [Country Rules Auto-Refresh Feeds](/compliance/country-rule-feeds)                                |
| **Data-subject access and correction requests** (SG PDPA s21–22, TH PDPA rights chapter)                                                  | DSAR intake with `applicable_jurisdiction: "pdpa"` — the portal and operator API apply the **30-day SLA clock** automatically under that code                                                             | Operator API + public self-service portal                                                       | [DSAR](/compliance/dsar)                                                                                                                  |
| **Processing-records filing — the Art.30-analog register** (SG PDPA accountability duty; TH PDPA s39–41 records and RoPA-class inventory) | The privacy register — per-activity records with DPIA screening and an exportable inventory your PDPC answers cite                                                                                        | `…/compliance/privacy-register/*`                                                               | [Privacy Register](/compliance/privacy-register)                                                                                          |
| **Evidence for a regulator or buyer**                                                                                                     | The evidence binder assembles DSAR history, breach counts, and consent/retention posture into one signed export                                                                                           | Settings → Compliance → Binder                                                                  | [Evidence Binder](/compliance/evidence-binder)                                                                                            |
| **Data-breach register** (SG PDPA 2020 mandatory breach notification; TH PDPA s48)                                                        | `POST /compliance/breach-incidents` — the register entries and attestations feed the binder; the 72-hour attestation carries the notification judgement you recorded                                      | Operator API; reads open to any member, writes owner/admin                                      | [Breach Incident Register](/compliance/breach-incident-register)                                                                          |

Two adjacent controls round out the map:

* **Quiet hours.** No PDPA provision names them, but an SG or TH
  marketing program inherits the expectation from the carriers and the
  local marketing regimes — set the fallback window with the rest
  ([Quiet hours configuration](/guides/quiet-hours-configuration)).
* **Voice data residency.** SG and TH transfers are assessments you run
  on your transfer basis; the residency pin
  ([Voice data residency](/compliance/voice-data-residency)) records
  where recordings physically live.

***

## Section 2 — A worked sequence for a Singapore recipient

A tenant running SMS plus voice outbound into Singapore reads as this
sequence. Each step is a tenant-owned decision Orbit enforces; none is
a platform mandate.

**Step 1 — posture.** For deemed-consent or opt-out-based SG marketing,
keep `unknown_marketing_policy: allow_with_logging` (so the send runs
and the ledger records the unbacked contact) but move
`consent_default_policy: deny_on_missing` where you want the stricter
line — for example on channels where you cannot show any consent basis.
The two knobs are tenant-owned — see
[Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy).

**Step 2 — capture consent with the basis.** At acquisition, record the
grant with `lawful_basis` and a `purpose` string (PDPA's consent duty
turns on the disclosed purpose):

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/consent \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "+6591234567",
    "channels": ["sms", "voice"],
    "opt_in": true,
    "consent_type": "marketing",
    "lawful_basis": "consent",
    "purpose": "Marketing SMS and calls — purpose disclosed at signup (PDPA s13 duty)."
  }'
```

**Step 3 — DNC scrub before outbound.** Wire the pre-flight check into
your campaign rollout so an SG-destination list scrubs against the
combination of your suppression layer and the national register before
the first send. The check endpoint answers source and freshness
explicitly — read the `source` and `last_synced_at` fields and treat a
stale row as a risk flag, not a blocker (the fail-open caveat is
documented on [DNC Scrubbing](/compliance/dnc-scrub)). The feed that
refreshes the per-country rules rows carries the SG register link — see
[Country Rules Auto-Refresh Feeds](/compliance/country-rule-feeds).

**Step 4 — wire withdrawal to the same suppression list.** STOP
keywords, the consent API with `opt_in: false`, and the preference
center all land on one list. A revoked +65 contact stays suppressed
regardless of which entry point they used.

**Step 5 — file a DSAR with the `pdpa` clock.** When an SG data subject
asks for access or correction, file it under the coded jurisdiction so
the SLA tracker applies the 30-day clock automatically:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/dsar \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subject_email": "jordan@example.sg",
    "requester_email": "privacy@your-company.sg",
    "applicable_jurisdiction": "pdpa",
    "request_type": "know",
    "requester_statement": "PDPA access request (Singapore data subject, s21 duty)."
  }'
```

Erasure follows the same pipeline; the proof-of-deletion certificate
(see [DSAR](/compliance/dsar)) is the receipt you hand the subject or a
PDPC SG reviewer.

**Step 6 — file your processing activities in the privacy register.**
Record each SG-facing activity — purpose, data categories, recipients,
transfers, retention, security measures — in the
[privacy register](/compliance/privacy-register) before the first DSAR
arrives. An accountability review reads that register first.

***

## Section 3 — A worked sequence for a Thailand recipient

Thailand's PDPA reads closer to the EU shape — express consent at
collection, a rights chapter administered by the PDPC Thailand, and
explicit RoPA-class records duties (s39–41). The sequence:

**Step 1 — posture.** Express-consent markets call for the strict line:
keep `unknown_marketing_policy: refuse` and
`consent_default_policy: deny_on_missing` for TH recipients, so an
unbacked contact receives no marketing.

**Step 2 — capture consent with the basis.** Record the grant explicitly
per channel, `lawful_basis: consent`, and the purpose string your TH
notice disclosed:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/consent \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier": "+66812345678",
    "channels": ["sms"],
    "opt_in": true,
    "consent_type": "marketing",
    "lawful_basis": "consent",
    "purpose": "Marketing SMS — purpose disclosed at collection (TH PDPA s6 duty)."
  }'
```

**Step 3 — sender and scrub.** The DNC chain treats national registers
per jurisdiction — where a TH register feeds it, pre-flight the same
way as the SG step; otherwise lean on your own suppression layer, which
answers for every recipient who revoked regardless of any register. The
country-rules row for TH on the channel you send is the
sender-registration answer —
[Country Compliance Requirements](/compliance/country-requirements)
documents the read; the [feeds page](/compliance/country-rule-feeds)
documents why the row's `last_synced_at` stayed fresh.

**Step 4 — DSAR on the same `pdpa` code.** TH data subjects file under
the same coded jurisdiction; the 30-day SLA clock tracks the request
with or without an SG/TH split:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/dsar \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subject_email": "jordan@example.co.th",
    "requester_email": "privacy@your-company.co.th",
    "applicable_jurisdiction": "pdpa",
    "request_type": "know",
    "requester_statement": "PDPA access request (Thailand data subject; 30-day clock per the DSAR page)."
  }'
```

**Step 5 — register.** File the TH-facing processing activities in the
[privacy register](/compliance/privacy-register) separately from the SG
ones — s39 RoPA-class inventory answers against the activities you filed,
not against a cross-market merge. The binder reads both sets when a
reviewer asks for the whole program.

***

## Section 4 — What Orbit does NOT do

Boundary conditions, stated once and plainly:

* **Orbit never files with the PDPC for you.** A breach notification to
  the Singapore PDPC (or the equivalent Thai filing) is your act — the
  [breach register's](/compliance/breach-incident-register) attestation
  records the judgement behind the notification, but the notification
  itself is yours.
* **Orbit never decides whether deemed consent applies, or which basis
  fits.** Deemed consent, business-necessity consent, legitimate interests — the legal analysis is counsel's. The consent ledger records the basis you assert; the judgement it captures is yours.
* **Orbit never scrubs your outbound against a register automatically in
  a way you cannot see.** The DNC check answers source and freshness
  explicitly, fails open when a source is stale, and applies the gates you
  enabled. A failing scrub because the org toggle is off is a
  configuration fact, not a platform mandate — the strict-tenant rule
  applies to every control except the US federal voice window.
* **Nothing on this page gates sending by itself.** Consent records,
  the suppression layer, the DSAR pipeline, and the register are the
  ledger. The send-time gates that exist are the ones you turned on,
  and each defaults open.
* **This is not legal advice.** The sequence assembles Orbit's controls;
  whether the assembled posture satisfies the SG or TH PDPA for your
  processing is a call for your counsel.

***

## Section 5 — Related references

* [Posture overview](/compliance/posture-overview) — the toggle map this
  page extends for SG/TH.
* [Privacy Register](/compliance/privacy-register) — the Art.30-analog
  activity filings the PDPC stores read first.
* [DNC Scrubbing: Sources, Freshness, and the Check Endpoint](/compliance/dnc-scrub) —
  the pre-flight the SG outbound sequence wires.
* [Country Rules Auto-Refresh Feeds](/compliance/country-rule-feeds) —
  what keeps the SG and TH country rows current.
* [DSAR](/compliance/dsar) — the operator verb set, the coded jurisdictions
  (including `pdpa` at 30 days), and the proof-of-deletion certificate.
* [Consent Management](/compliance/consent-management) — the lawful-basis
  fields the SG/TH consent records rest on.
* [Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy) —
  the two posture knobs that separate the SG opt-out line from the TH
  express-consent line.
* [Evidence Binder](/compliance/evidence-binder) — the export that reads
  everything above when a regulator or buyer asks for the full program.