Guide · Singapore
Website legal requirements in Singapore
A Singapore business website or app may need to account for the Personal Data Protection Act 2012, Do Not Call rules for marketing messages and GST obligations. GST-registered businesses should also check when the GST InvoiceNow Requirement applies to them. Your build plan can cover how forms collect personal data, how marketing messages are checked, and which payment methods the checkout will accept. A .sg domain is regulated by the Singapore Network Information Centre.
Checked against official sources on 5 November 2026. General information, not legal advice: confirm the rules that apply to your business with an adviser.
What data protection law applies to my website?
When planning forms that collect personal data, account for Singapore's Personal Data Protection Act 2012. The Personal Data Protection Commission administers the Act, a role designated to the Info-communications Media Development Authority.
What rules apply to marketing messages?
Under section 43 of the PDPA, a marketing message, called a specified message, must not be sent to a Singapore telephone number without valid confirmation that the number is not listed in the Do Not Call Register. Include this check in your marketing process.
What GST and invoicing rules affect online sales?
Singapore's Goods and Services Tax (GST) rate has been 9% since 1 January 2024. Account for GST when planning how your online shop displays and records sales.
Under the GST InvoiceNow Requirement, GST-registered businesses must use InvoiceNow-Ready Solutions to send invoice data to IRAS. The requirement starts with newly incorporated companies registering for GST voluntarily from 1 November 2025 and all new voluntary GST registrants from 1 April 2026. Check your invoicing setup when planning the site.
Which Singapore payment options can my checkout accept?
PayNow transfers Singapore dollar funds using a mobile number, NRIC/FIN or virtual payment address, and PayNow Corporate lets businesses receive funds via their UEN. It has been available through participating banks since 10 July 2017 and through major payment institutions since 8 February 2021. Consider these details if you plan to accept PayNow.
Which languages could my website use?
Singapore's official languages are English, Mandarin Chinese, Malay and Tamil. The Constitution designates Malay as the national language. Consider your language choices when planning site content.
Who regulates a .sg domain?
The .sg country-code domain is regulated by the Singapore Network Information Centre (SGNIC), the appointed national registry and a wholly owned subsidiary of the Infocomm Media Development Authority. Keep this in mind if you choose a .sg address.
What should you check for a website in Singapore?
English is the de facto main language of Singapore's government, legal, trade and commercial affairs. Consider your site's language as you work through these steps.
- Account for data protection when planning forms that collect personal data.
- Build a Do Not Call Register check into your marketing process.
- Account for GST when planning how the shop displays and records sales.
- Check when the GST InvoiceNow Requirement applies to your business.
- Consider PayNow details if you want to accept it at checkout.
- Choose the languages for your site content.
- Check the .sg domain option for your site address.
Questions
What must I do after assessing a data breach as notifiable?
You must notify the PDPC as soon as practicable and no later than 3 calendar days after the assessment, and you must also notify affected individuals. These duties are set out in section 26D of the PDPA.
When must an overseas supplier register for Singapore GST?
Under IRAS's overseas vendor registration regime, an overseas supplier must register if its global turnover exceeds S$1 million and its B2C remote services to customers in Singapore exceed S$100,000. The regime has covered digital services since 1 January 2020 and non-digital remote services since 1 January 2023.
When will the GST InvoiceNow Requirement extend to other businesses?
IRAS has scheduled it to extend to new compulsory GST registrants from 1 April 2028 and to existing GST-registered businesses in phases by annual supplies from 1 April 2028 to 1 April 2031.
Can one QR label show the payment options my business accepts?
Yes. SGQR combines multiple payment QR codes into a single label, so merchants display one code for all the payment options they accept. The scheme is co-owned by MAS and IMDA.