Data Bureau (Singapore) will never ask you to transfer money or disclose banking log-in details over a phone call.
Call the 24/7 ScamShield Helpline at 1799 if you are unsure if a contact is legitimate.
Circular 03/2026 · Policy Publication · Policy Reference: DB-POL-001
Applies to all Data Bureau certification programmes.
This Policy establishes the obligations, procedures, and governance standards that govern the ongoing certification relationship between Data Bureau (Singapore) Pte. Ltd. ("Data Bureau") and all entities that hold, apply for, or seek to renew a Data Bureau certification ("Certificate Holders").
This Policy applies to all certification programmes issued under the Data Bureau certification framework, including but not limited to VBE-01 through VPO-16, and supersedes any conflicting provisions in earlier versions of individual certification standards regarding renewal, revocation, suspension, or appeals.
The authority to certify, suspend, reinstate, and revoke rests exclusively with Data Bureau (Singapore) Pte. Ltd. No facilitation partner, verification agency, or third party may exercise these powers on Data Bureau's behalf.
| Term | Meaning |
|---|---|
| Certificate | A Data Bureau certification document issued under any programme in the VBE-01–VPO-16 series. |
| Certificate Holder | Any natural person or legal entity currently holding a valid, unexpired Data Bureau certificate. |
| Certification Period | The validity window stated on the face of the certificate, typically one (1) year from the date of issue unless otherwise specified. |
| Renewal Application | A formal application submitted by a Certificate Holder to extend their certification for a further Certification Period. |
| Material Change | Any change to the Certificate Holder's legal status, ownership, regulatory standing, operating scope, or any criterion assessed in the original certification, that may affect conformance to the applicable standard. |
| Suspension | A temporary administrative hold on a certificate's active status pending investigation or resolution of a compliance concern. |
| Revocation | The permanent cancellation of a certificate prior to its stated expiry. |
| Lapse | Automatic expiry of a certificate where no valid Renewal Application has been submitted and approved before the end of the Certification Period. |
| Public Registry | The Data Bureau online register of current, suspended, and revoked certificates, accessible at databureau.com.sg. |
| Appointed Verification Agency | An entity appointed by Data Bureau to conduct assessment activities on its behalf, including Scam.SG / OnScam (SG) Pte. Ltd. Such entities do not hold certification authority. |
A certificate represents conformance at the time of assessment. Certificate Holders are required to maintain continuous conformance with all applicable certification criteria throughout the Certification Period, not merely at the point of initial assessment or renewal.
Certificate Holders must notify Data Bureau in writing at certify@databureau.com.sg within the timeframes specified below upon becoming aware of any of the following events:
| Event | Notification Deadline |
|---|---|
| Change of legal name or UEN | 14 calendar days |
| Change of registered address or principal place of business | 14 calendar days |
| Change of directors, partners, or beneficial owners | 14 calendar days |
| Bankruptcy, winding-up, or judicial management application filed against the entity or any director | 48 hours |
| Regulatory enforcement action, licence suspension, or licence revocation by any Singapore authority | 48 hours |
| Material change to any system, process, or data architecture within scope of an AI or information flow certification | 30 calendar days |
| Any agentic AI incident resulting in unintended action, system access breach, or third-party harm (AAC-03 holders) | 48 hours |
| Discovery that any information submitted in the certification application was inaccurate or incomplete | Immediately upon discovery |
| Any other Material Change | 30 calendar days |
Certificate Holders are permitted to display the Data Bureau certification badge and reference their certification status in commercial communications, subject to the following conditions:
Certificates are valid for one (1) year from the date of issue unless a different validity period is stated on the certificate face. Certificate Holders who wish to maintain certification must submit a Renewal Application before expiry.
| Step | Action | Detail |
|---|---|---|
| T−60 | Renewal Reminder | Data Bureau issues a written renewal reminder to the Certificate Holder's registered email address. |
| T−30 | Renewal Application Window Opens | Certificate Holder may submit a Renewal Application via the Data Bureau portal or by email to certify@databureau.com.sg. The renewal fee is payable at submission. |
| T−14 | Final Notice | Where no Renewal Application has been received, Data Bureau issues a final notice. Failure to respond by T−0 will result in lapse. |
| T−0 | Certificate Expiry | Certificate lapses if no valid Renewal Application has been approved. Registry status is updated to 'Lapsed' with immediate effect. |
| T+0 to T+30 | Late Renewal Window | A Certificate Holder may submit a late Renewal Application within 30 days of lapse. A late renewal fee applies. The certificate remains lapsed — and the certification mark may not be displayed — until the Renewal Application is approved. |
| T+30+ | Lapse Becomes Final | After 30 days post-expiry, the entity must submit a fresh certification application and undergo full assessment. |
Renewal is not automatic. Each renewal involves a reassessment of the applicable certification criteria. Data Bureau may conduct a full or targeted reassessment depending on:
Where a targeted reassessment is conducted, Data Bureau will specify which criteria have been re-evaluated. Criteria not re-evaluated carry forward the prior assessment outcome.
Renewal fees are set at the rate applicable at the time of the Renewal Application. Current fees are published in the Data Bureau Certification Catalogue. Data Bureau reserves the right to adjust fee schedules with a minimum of 60 days' written notice to Certificate Holders. Fees paid are non-refundable where a Renewal Application fails assessment, except where the failure is attributable solely to a Data Bureau administrative error.
Data Bureau may suspend a certificate, with immediate effect and without prior notice, where it has reasonable grounds to believe that one or more of the following conditions exist:
Suspension shall not exceed 60 calendar days from the date of the Suspension Notice. Where a resolution has not been reached within 60 days, Data Bureau will either proceed to revocation or extend the suspension by a further period, not exceeding 30 days, with written notice to the Certificate Holder. A certificate may not be suspended indefinitely.
Data Bureau may revoke a certificate, with immediate effect, upon any of the following grounds:
Notwithstanding Section 6.2, Data Bureau may effect immediate revocation — without a Show Cause Notice — where:
In cases of immediate revocation, the Certificate Holder retains the right to appeal under Section 7.
A revoked Certificate Holder may not apply for any Data Bureau certification for a period of 12 months from the effective date of revocation, unless the revocation was subsequently overturned on appeal.
Where revocation was on the grounds of fraud or deliberate misrepresentation, a 24-month exclusion period applies, and any new application will be subject to enhanced assessment.
The filing of a Notice of Appeal does not automatically suspend the effect of the decision under appeal. Where the decision is a revocation, the certificate remains revoked during the appeal period unless the appeals panel grants an interim stay in writing.
An interim stay may be granted by the panel where the appellant demonstrates a prima facie arguable case and that continued suspension or revocation would cause disproportionate harm pending appeal.
Where a certificate has lapsed for more than 30 days, the entity must submit a fresh certification application and undergo full assessment against the current version of the applicable standard. Prior certification history will be noted in the Registry but does not guarantee reapproval.
Subject to the exclusion periods set out in Section 6.4, a formerly revoked entity may reapply for certification. Where the grounds for revocation related to false information, misuse of certification marks, or obstruction, the reassessment will include enhanced due diligence, including verification of all previously declared information and an interview with a senior Data Bureau officer.
Data Bureau conducts continuous monitoring of all active Certificate Holders through:
Adverse signals identified through continuous monitoring will trigger a review in accordance with the suspension or revocation procedures in Sections 5 and 6, as appropriate. Data Bureau will not disclose the specific configuration of its monitoring systems to Certificate Holders.
All persons and entities participating in the Data Bureau certification process — including applicants, Certificate Holders, Appointed Verification Agencies, and Data Bureau staff — are required to maintain the integrity of that process. The following conduct is prohibited:
Assessment records, internal review notes, and appeals panel deliberations are confidential. Data Bureau will not disclose the substantive content of assessment records to third parties without the consent of the Certificate Holder, except where required by law, by a Singapore regulatory authority, or where the public interest so requires.
Certificate Holders may request a copy of their own assessment record by writing to certify@databureau.com.sg. Assessment records are retained for a minimum of 7 years from the date of assessment.
Certain certification criteria across the Data Bureau programme portfolio are assessed by signed declaration. The following provisions apply to all declarations submitted in connection with Data Bureau certification:
Certification by Data Bureau represents an assessment of conformance to defined standards at the time of assessment. It is not a guarantee of future performance, ongoing compliance, financial stability, or the absence of future adverse events.
Data Bureau's liability in relation to any certification decision, including renewal, suspension, revocation, or appeals outcome, is limited to the certification fees paid by the applicant or Certificate Holder for the relevant assessment. Data Bureau accepts no liability for consequential loss, reputational damage, or loss of business arising from any certification decision.
| Attribute | Detail |
|---|---|
| Policy Owner | Chairman & CEO, Data Bureau (Singapore) Pte. Ltd. |
| Effective Date | 17 April 2026 |
| Version | 1.0.0 |
| Review Cycle | Annual, or upon material change to any applicable certification standard |
| Amendment | Amendments to this Policy are published on the Data Bureau website with a minimum of 30 days' notice to Certificate Holders prior to the effective date of the amendment. Certificate Holders who do not object within 30 days of notification are deemed to have accepted the amendment. |
| Supersession | This Policy supersedes all prior renewal, revocation, and appeals provisions contained in individual certification standards where those provisions are inconsistent with this Policy. |
| Purpose | Contact |
|---|---|
| Renewal Applications | certify@databureau.com.sg |
| Material Change Notifications | certify@databureau.com.sg |
| Suspension or Revocation Enquiries | certify@databureau.com.sg |
| Appeals (Notice of Appeal) | certify@databureau.com.sg — Subject: DB-POL-001 Appeal |
| General Certification Enquiries | databureau.com.sg |