Public Consultation
Consultation Scope
The public consultation covered the proposed assessment framework for the Certificate of Verified Platform Operator (VPO-16). The draft standard was published on 4 August 2025 via the Data Bureau (Singapore) consultations portal at databureau.com.sg/consultations. The consultation invited responses from digital platform operators, marketplace administrators, technology service providers, and any member of the public with a substantive interest in the proposed framework.
The draft standard proposed a multi-domain assessment architecture covering Platform Identity and Registration, Operational Governance, User Protection Mechanisms, Data Handling Practices, Dispute Resolution Infrastructure, and Financial and Legal Standing. A 100-point scoring model was proposed with a minimum pass threshold of 75 points and a Distinction threshold of 90 points. Domain zero-score floor provisions were included for Platform Identity and Registration and for Operational Governance, reflecting that a platform without verifiable identity or basic operational governance cannot credibly be assessed on remaining criteria.
Submissions Received
Data Bureau (Singapore) received six (6) substantive written responses during the consultation period. Respondents included platform operators, a technology legal practitioner, and a consumer technology practitioner. Respondents are referenced anonymously as R1 through R6. No identifying information is published.
Themes Raised
Responses were reviewed and categorised into five substantive themes.
Three respondents (R1, R2, R5) raised questions about the boundary between what a platform operator is responsible for and what is attributable to sellers or users operating on the platform. The concern was that platform operators would be assessed against conduct they do not directly control — for example, listings posted by third-party sellers or user-generated content.
Two respondents (R3, R4) noted that the Data Handling Practices domain appeared to overlap with obligations under the Personal Data Protection Act (PDPA) administered by the PDPC. These respondents asked whether a platform holding DPTM certification would satisfy this domain by default.
Two respondents (R2, R6) raised that early-stage platforms may not yet have formalised dispute resolution infrastructure comparable to established marketplace operators. These respondents asked whether the criteria for this domain would disadvantage platforms that were operational but had not yet encountered the scale that typically drives formalisation of dispute resolution processes.
One respondent (R1) noted that digital platform features, policies, and operational structures change rapidly and asked how the assessment would remain current between certification cycles.
One respondent (R5) asked for a more precise definition of what constitutes a platform operator for the purposes of VPO-16, specifically whether software-as-a-service (SaaS) providers whose products are used by businesses to build their own platforms would fall within scope.
Data Bureau's Response to Each Theme
Theme 1 — Platform Operator Scope
The assessment criteria were revised to make explicit that the VPO-16 assessment evaluates the platform operator's governance of the platform environment — not the conduct of individual sellers, users, or third parties operating within it. The assessment focuses on what mechanisms the platform operator has in place to govern conduct, not on individual instances of third-party conduct.
This distinction was incorporated into the domain scope statements of the adopted standard.
Theme 2 — PDPA and DPTM Overlap
The Data Handling Practices domain assesses platform operators' practical data handling conduct within the context of their platform operations — it does not duplicate PDPA compliance assessment. DPTM certification is not treated as satisfying this domain by default. However, where a platform operator holds a current DPTM certification, this is a considered positive indicator within the domain. The assessment evaluates conduct, not certification held.
This was clarified in the adopted standard's domain description.
Theme 3 — Dispute Resolution for Early-Stage Platforms
The Dispute Resolution Infrastructure domain criteria were revised to assess the presence and accessibility of a dispute resolution pathway — not the volume or complexity of the mechanism. An early-stage platform that maintains a documented, accessible process for user disputes satisfies the foundational criteria for this domain. Scale-specific infrastructure is reflected in higher scoring bands, not in the pass threshold. This amendment was incorporated into the adopted standard.
Theme 4 — Assessment Currency
The continuous monitoring provision of VPO-16 addresses this concern. Platform operators are subject to ongoing monitoring throughout the certificate's validity period. Material changes to a platform's operational governance, user protection mechanisms, or public-facing policies that affect the criteria under which certification was issued may trigger a review before the renewal date.
This existing provision was clarified in the adopted standard's compliance section.
Theme 5 — Definition of Platform Operator
The VPO-16 standard applies to entities that operate a digital platform through which third parties transact, interact, or exchange value — including marketplace operators, service platform operators, and comparable entities. SaaS providers whose software is used by other entities to build and operate their own platforms are not within the scope of VPO-16 in their SaaS capacity. The entity that operates the platform — not the entity that provides the underlying software — is the relevant subject.
A clarified definition was incorporated into the adopted standard's defined terms.
Material Changes Made to the Adopted Standard
The following changes were made to the VPO-16 standard as a direct result of consultation feedback:
Domain scope statements revised to make explicit that the assessment evaluates platform governance mechanisms, not third-party conduct on the platform (Theme 1).
Data Handling Practices domain description revised to clarify that DPTM certification is a considered positive indicator within the domain, not a domain-satisfying credential (Theme 2).
Dispute Resolution Infrastructure domain criteria revised to assess the presence of an accessible dispute resolution pathway rather than scale-specific infrastructure (Theme 3).
Compliance section clarified to confirm that material operational changes to a platform's governance, user protection mechanisms, or public-facing policies may trigger a monitoring review before renewal (Theme 4).
Definition of platform operator incorporated into the standard's defined terms to exclude SaaS providers acting in a software supply capacity (Theme 5).
Feedback Considered and Not Adopted
DPTM as Domain-Satisfying Credential (Theme 2)
One respondent proposed that a current DPTM certification should satisfy the Data Handling Practices domain entirely, removing the need for separate assessment of that domain. This was considered and not adopted. The DPTM assesses data protection practices against the PDPA framework. The VPO-16 Data Handling Practices domain assesses practical data handling conduct within the platform context, which is a related but distinct scope. Treating one certification as satisfying an independent assessment domain would compromise the integrity of the VPO-16 assessment model. The adopted approach — treating DPTM as a positive indicator within the domain — appropriately recognises the credential without creating an equivalence that does not exist.
Conclusion
Data Bureau (Singapore) thanks all respondents for their engagement with the VPO-16 consultation. The feedback received informed five material amendments to the adopted standard. The institution considers that the adopted VPO-16 framework provides a rigorous and practically applicable assessment for digital platform operators in the Singapore market.
The adopted VPO-16 standard is published in the Data Bureau (Singapore) Publications & Intelligence section at databureau.com.sg/resources/publications.