Singapore Corporate Website Privacy: A Practical Review Checklist

A corporate website privacy review should follow the information your website actually collects and sends. A privacy notice is important, but it cannot replace checking forms, connected tools, administrative access and the way submissions are handled.

Inventory collection points and destinations

Walk through contact, quote, recruitment, newsletter and account forms. Record required fields, uploaded documents, recipients and connected services. Include embedded chat, analytics and advertising tools. Ask whether each field is needed for the stated business task before adding it to the design.

Review applicable PDPA requirements with your organisation’s data protection lead using the PDPC’s key concepts guidance. Do not assume that every website has identical consent, retention or transfer requirements.

Check what visitors are told at the point of collection

Have the authorised business or legal owner approve privacy wording and the purposes of collection. Make relevant notices easy to find and readable on mobile. Keep marketing choices distinct from a request to respond to an enquiry where your approved process requires that distinction.

Test that form behaviour matches the approved wording. A notice referring to one destination is not enough if an integration silently sends the submission elsewhere.

Protect the submissions after they arrive

• Limit access to form entries and uploads to staff who need them.
• Check both WordPress storage and emailed copies of submissions.
• Avoid exposing uploaded files through guessable public links.
• Review forwarding rules and integrations when staff or agencies leave.
• Apply the organisation’s approved retention process instead of keeping every enquiry indefinitely.
• Maintain an incident reporting route and responsible contacts.

Include suppliers and supporting systems

Ask where relevant hosting, backup and third-party processing takes place. Document the scope of each supplier and the assistance available for investigation, export or deletion requests. Singapore hosting can meet a specified location preference, but it does not settle all privacy questions.

Use privacy checks in release testing

Before launch, submit test records and confirm their destinations, permissions and deletion behaviour. Repeat relevant checks after replacing a form, analytics tool or integration. Record open issues and obtain approval from the appropriate owner; do not present a developer’s successful form test as a legal compliance assessment.

Build the requirements into your website project

Discuss corporate web design with QUAPE using a brief that includes forms, integrations and approved privacy requirements. For WordPress sites, align that work with managed hosting and a documented maintenance scope. This checklist supports implementation planning, not a legal opinion.