How Does Data Protection Trustmark
Certification Work

Data Protection Trustmark is a nationally recognized certificate that helps gain customer trust and prove an organization’s credibility in data protection practices.

What Exactly Is the Data Protection Trustmark (DPTM)?

Data Protection Trustmark (DPTM) is developed by the Infocomm Media Development Authority (IMDA) based on Singapore’s Personal Data Protection Act (PDPA). This certificate shows that an organization has developed and implemented accountable data protection practices. Since 2025, DPTM criteria follow and align with the national Singapore Standard (SS 714:2025) for more structured and consistent assessment.

Although applying for DPTM certification is a voluntary option, businesses can gain competitive advantage and enhance their credibility with this nationally recognized certificate. Any organization handling and managing personal data can apply for Data Protection Trustmark certification.

Step-By-Step DPTM Certification Workflow

(1) Readiness Assessment

First, companies should review the existing data protection policies and procedures to check their readiness. An internal auditor or a qualified consultant should identify gaps in the existing data protection measures that do not meet DPTM requirements.

(2) Strengthen Data Protection Framework

Based on the gap analysis, organizations should develop and implement data protection practices that align with DPTM requirements.

(3) Certification Application

Apply through the official IMDA website and submit the required documents online. After choosing the IMDA-approved assessment body, the assessor will conduct a documentation review and on-site assessment. Since DPTM assessment is an evidence-based evaluation, the assessment body will perform a formal assessment to ensure the effectiveness of implementation regarding data protection. Finally, the assessment body will submit the final report to IMDA.

(4) Certification Decision

If the requirements are met, IMDA will award Data Protection Trustmark Certification. The certification is valid for three years and regular assessments will be conducted during this period to ensure compliance and effectiveness of data protection measures

Assessment Criteria: What Assessors Are Evaluating

While evaluating the effectiveness of data protection management, the assessment covers four key principles.

Governance and Transparency

To achieve the Data Protection Trustmark, organizations need to develop and implement effective data protection policies. Then, they should publish the policies to the relevant stakeholders for clear communication. Relevant staff training programs should be arranged to help employees understand the organization’s data protection practices. Next, the assessor will ensure organizations have established an effective and responsible data breach management plan.

Companies need to engage with a competent Data Protection Officer (DPO) to ensure compliance with the DPTM requirements.

Personal Data Management : When collecting data, the organization needs to limit it to specific purposes and collect valid consent. When sharing data with third parties and handling overseas data transfers, the organization needs to ensure compliance with Singapore’s PDPA. The whole data inventory map must be documented to track data flow.

Personal Data Care : Strong and secure data protection plans such as information security policies are required. Next, organizations should have clear retention policies and disposal schedules.

Individuals’ Rights : The organization needs to ensure that only consented data is collected and users have access to withdraw or correct their consent.