What it is

pdpa-sg-clj is a free toolkit that helps any organisation in Singapore follow the Personal Data Protection Act (PDPA) — the law on collecting and protecting customers’ personal data (names, national ID numbers, phone numbers, emails). It gives you a checklist of all 11 legal duties in plain steps, ready-to-fill policy documents, and a scanner your developers run to find leaked personal data and passwords in their systems, producing a report card for auditors.

The 11 obligations (the whole law on one table)

# Obligation One-line meaning
1 Consent Get clear permission before collecting data
2 Purpose Limitation Use data only for the stated purpose
3 Notification Tell people what you do with their data
4 Accuracy Keep data correct and complete
5 Protection Apply reasonable security
6 Retention Limitation Delete data when no longer needed
7 Transfer Limitation Overseas transfers need comparable safeguards
8 Access & Correction Honor data-subject requests (DSRs)
9 Withdrawal of Consent Support withdrawal as easily as consent was given
10 Data Breach Notification Notify PDPC within 3 calendar days if serious harm is likely
11 Accountability / DPO Name a Data Protection Officer with public contact

Plus the Safe NRIC rule: full national ID collection or use must end — do not collect NRIC numbers unless legally required.

5-minute quickstart

git clone https://github.com/nurazhardotcom/pdpa-sg-clj
cd pdpa-sg-clj
bb about              # toolkit + PDPA rule version
bb init ./your-project/
bb scan examples/minimal_project

Expected (the bundled example is clean by design):

[SCAN] examples/minimal_project/README.md → 0 PII, 0 secrets
[SCAN] OK — 0 HIGH, 0 CRITICAL findings

CLI reference

Command What it does
bb about Prints toolkit + PDPA rule version stamp
bb init [target-dir] Copies CHECKLIST.md + 6 policy templates into your project
bb scan [path] [--format text\|json\|sarif\|quickfix] [--out FILE] Runs the PII / secret / NRIC scanner; exit 0 = clean
bb redact <file> Replaces valid NRICs, SG mobile numbers, emails with [REDACTED_*] (keeps .redact.bak)
bb checklist Prints 11-obligation status summary
bb audit [path] [--format text\|json\|sarif\|html\|md] [--out FILE] Scan + checklist + report in one step
bb export-rules --format gitleaks --out gitleaks.toml Reuse the 20-rule pack inside gitleaks
bb test Babashka + Clojure test suite

Machine-readable outputs for gates and editors: --format json (CI input), --format sarif (GitHub code scanning / VS Code SARIF Viewer), --format quickfix (path:line: [SEV] for Vim/VS Code).

How it works (architecture)

Open full viewer

Labs

When it gets messy — a leaked NRIC racing the 3-day notification clock:

Open full viewer

Lab 1 — audit the example. bb audit examples/minimal_project --format md --out audit.md. Confirm 0 HIGH / 0 CRITICAL. Convert to PDF for filing (pandoc audit.md -o audit.pdf or print the HTML report to PDF).

Lab 2 — redact. Copy any scratch file with a fake NRIC/phone/email into /tmp, run bb redact /tmp/file, confirm placeholders + .bak backup.

Lab 3 — CI gate. Add bb scan . --format json --out audit.json to your pipeline; gate on exit code (non-zero = findings).

Lab 4 — agent use. From Clojure: (require '[pdpa.core :as pdpa]), then (pdpa/redact "..."), (pdpa/checklist-status), (pdpa/scan "./" {:json true}), (pdpa/fill-policy "PRIVACY_POLICY.template.md" {"ORG_NAME" "Acme Pte Ltd"}).

FAQ

Is this legal advice? No — practical guidance plus tooling. Consult a lawyer for legal certainty.

Do I need programmers? For the checklist and documents, no. For the automated scan, one developer, ~30 minutes.

What do I hand my auditor? The audit.html report (convert to PDF) plus the ticked checklist.

Cost? Nothing. MIT-licensed, free for commercial use.