DxtraBETA
Latest edition

Dxtra SME Privacy Index — Singapore & Malaysia, Q4 2026

What business websites in Singapore and Malaysia show visitors about privacy, Q4 2026.

What the public websites of businesses in Singapore and Malaysia, found through public map and search listings, show about how they handle personal data: consent banners, the tags that load before any consent choice, the vendors those pages contact, the privacy notice, and the overall band under each country's law.

1,991 websites scanned (Singapore 1,000, Malaysia 991) · Methodology v1.19 · Dxtra Regulator Reference v2.0 · scanner build 562c60d

Read the methodologyDownload the data

Key findings

  1. About 7 in 10 websites (72.3%) offered no privacy-officer contact.
    Agent-coded, checked by a person on a sample.
  2. More than half (54.6%) loaded marketing tags, advertising pixels or non-cookie trackers before the visitor made any cookie choice. About 1 in 20 (5.3%) showed a consent banner the scan recognized.
  3. About 4 in 10 (37.9%) had no privacy notice found on the site.
  4. Of the websites with a form that collects personal data, about 8 in 10 (82.5%) showed no privacy notice at the form, including websites with no privacy notice found at all.

How to read these figures

Each figure is the share of businesses in the sample, with its 95% margin of error. Where fewer than five businesses fall on either side of a figure, no margin is given, and the figure reads “too few to give a margin”. A figure based on fewer than 50 businesses is not published. A series whose input is not yet available is marked withheld, never shown as zero. Each chart carries its label: register-backed figures rest on a provision of the law the site was graded under; observations are what our browser saw, reported without a legal grade. The Index describes what public websites showed on the day of the scan. It is a diagnostic indicator, not a legal opinion, and it does not state that any business complies, or fails to comply, with any law.

The overall band

The band each business's website was shown, under the law its scan was graded against. Four categories: Low, Medium, High, and No overall band, which is never folded into Low.

Linked by Dxtra to a provision of privacy lawRegister-backed

Overall band, by the law the site was scored under

All sites
Low 24.3%Medium 40.3%High 4.9%No overall band 30.4%
n = 1,948 · margins up to ±2.2 pts
Singapore
Low 24.5%Medium 35.9%High 4.6%No overall band 35.0%
n = 977 · margins up to ±3.0 pts
Malaysia
Low 24.2%Medium 44.7%High 5.3%No overall band 25.8%
n = 971 · margins up to ±3.1 pts
Low, Medium and High count the findings Dxtra could link to a provision of the law it graded the website against, each provision once. No overall band means none could be linked; it is not a Low result.
Low
At least one finding linked to the law, with no high-severity finding and no more than two medium ones.
Medium
One high-severity finding, or three or more medium ones.
High
Two or more high-severity findings.
No overall band
No finding linked to a provision of the law. It is not a Low result, and it does not mean the website has no issues.
Websites that handle sensitive data, such as health or financial data, are held to stricter thresholds. The band describes the website's public pages on the day of the scan, under Methodology v1.19. It is not a legal opinion.
How a band is decided →

Differences between the two countries partly reflect how many provisions of each country's law Dxtra's register grades, not only what the websites show. The figures should not be read as a ranking of the two countries.

Among: Businesses in the sample graded under Singapore or Malaysian law. How this is measured
Linked by Dxtra to a provision of privacy lawRegister-backed

Number of grounded provisions per site

All sites
0 30.4%1 63.1%2 6.4%3 0.1%4 or more 0.0%
n = 1,948 · margins up to ±2.1 pts
Singapore
0 35.0%1 59.7%2 5.3%3 0.0%4 or more 0.0%
n = 977 · margins up to ±3.1 pts
Malaysia
0 25.8%1 66.6%2 7.4%3 0.1%4 or more 0.0%
n = 971 · margins up to ±3.0 pts
Among: Businesses in the sample graded under Singapore or Malaysian law. How this is measured

Privacy-officer contact

Whether the website publishes a way to reach someone about personal data. Read from public pages by a reading agent; a person then checked a sample of the sites.

Read by our AI agent; a person checked a sampleAgent-coded, checked by a person on a sample

No privacy-officer contact on the website

All sites
72.3%
±2.0 pts · n = 1,990
Singapore
66.7%
±2.9 pts · n = 1,000
Malaysia
78.0%
±2.6 pts · n = 990
Among: Businesses in the sample, by country. How this is measured
Read by our AI agent; a person checked a sampleAgent-coded, checked by a person on a sample

How the website offers a privacy contact

All sites
Named privacy officer 2.2%Privacy or data-protection role or mailbox 12.3%Privacy request form 0.2%General inbox offered for privacy matters 13.1%General inbox for questions about the notice only 6.2%General contact details only 64.9%Someone else's contact only 0.1%No contact found 1.1%
n = 1,990 · margins up to ±2.1 pts
Singapore
Named privacy officer 3.5%Privacy or data-protection role or mailbox 19.0%Privacy request form 0.1%General inbox offered for privacy matters 10.7%General inbox for questions about the notice only 6.5%General contact details only 59.5%Someone else's contact only 0.1%No contact found 0.6%
n = 1,000 · margins up to ±3.0 pts
Malaysia
Named privacy officer 0.8%Privacy or data-protection role or mailbox 5.5%Privacy request form 0.2%General inbox offered for privacy matters 15.6%General inbox for questions about the notice only 6.0%General contact details only 70.4%Someone else's contact only 0.1%No contact found 1.5%
n = 990 · margins up to ±2.8 pts
Among: Businesses in the sample, by country, excluding sites the reading agent could not read. How this is measured

Who receives the data

The third-party vendors a website contacted before consent, named by the tracker catalog, and the categories they fall in.

Seen by our scan, not graded against the lawObservation

Third-party tracker vendors contacted before consent, per site

All sites
None 28.2%1 to 2 22.6%3 to 5 39.9%6 to 10 9.2%More than 10 0.2%
n = 1,801 · margins up to ±2.3 pts
Singapore
None 26.3%1 to 2 21.7%3 to 5 40.4%6 to 10 11.2%More than 10 0.4%
n = 904 · margins up to ±3.2 pts
Malaysia
None 30.0%1 to 2 23.5%3 to 5 39.4%6 to 10 7.1%More than 10 0.0%
n = 897 · margins up to ±3.2 pts
Among: Businesses in the sample, excluding sites where the browser pass did not run through a local residential address. How this is measured
Seen by our scan, not graded against the lawObservation

Share of sites contacting at least one vendor in each tracker category before consent

  1. 1Unclassified86.5%
  2. 2Advertising54.4%
  3. 3Analytics41.4%
  4. 4Customer interaction0.1%
  5. 5Email/marketing0.0%
  6. 6Social0.0%
  7. 7Telemetry0.0%
  8. Share of businesses where each appears · n = 1,801

86.5% of the websites contacted at least one tracker not yet assigned a category, so each category's share is a lower bound.

Among: Businesses in the sample, excluding sites where the browser pass did not run through a local residential address. How this is measured
Seen by our scan, not graded against the lawObservation

Most common third-party vendors contacted before consent

  1. 1Google Marketing46.6%
  2. 2Google37.2%
  3. 3Google Analytics36.1%
  4. 4Facebook27.2%
  5. 5Google AdServices7.3%
  6. 6TikTok Analytics2.8%
  7. 7Hotjar2.7%
  8. 8Klaviyo2.1%
  9. 9LinkedIn Analytics2.1%
  10. 10LinkedIn Ads1.7%
  11. 11HubSpot1.6%
  12. 12Google Syndication1.2%
  13. 13Bing Ads0.8%
  14. 14Amplitude0.3%
  15. 15Outbrain0.2%
  16. Share of businesses where each appears · n = 1,801
Among: Businesses in the sample, excluding sites where the browser pass did not run through a local residential address. How this is measured
Seen by our scan, not graded against the lawObservation

Vendors contacted before consent: the vendor's stated home country

VendorWebsites with a request to it before consentCompany named in the vendor's own privacy notice or termsThe vendor's stated home country
Google Marketing46.6%Google LLCUnited States
Google37.2%Google LLCUnited States
Google Analytics36.1%Google LLCUnited States
Facebook27.2%Meta Platforms, Inc.United States
Google AdServices7.3%Google LLCUnited States
TikTok Analytics2.8%TikTok Pte. Ltd.Singapore
Hotjar2.7%Withheld: the notice names a group of companies, not one company.
Klaviyo2.1%Klaviyo, Inc.United States
LinkedIn Analytics2.1%LinkedIn CorporationUnited States
LinkedIn Ads1.7%LinkedIn CorporationUnited States
HubSpot1.6%HubSpot, Inc.United States
Google Syndication1.2%Google LLCUnited States
Bing Ads0.8%Microsoft CorporationUnited States
Amplitude0.3%Amplitude, Inc.United States
Outbrain0.2%Teads Holding Co. (formerly Outbrain Inc.)United States
Share of businesses where each vendor appears · n = 1,801

This is where each vendor says it is based, in its own published privacy notice or terms, read between October 11 and 18, 2026. It is not where any website's data goes or is stored, and it is not a finding against any website. Each row was checked against the vendor's own notice or terms; no regulator has reviewed this table. For Google, the company Google's Terms of Service name for users of its services (country version: Malaysia, read October 18, 2026).

Among: Businesses in the sample, excluding sites where the browser pass did not run through a local residential address. How this is measured

The privacy notice

Whether a privacy notice was found, whether it is dated, and what it says about processors and transfers.

Linked by Dxtra to a provision of privacy lawRegister-backed

No privacy notice found on the site

All sites
37.9%
±2.1 pts · n = 1,991
Singapore
34.7%
±3.0 pts · n = 1,000
Malaysia
41.1%
±3.1 pts · n = 991
Among: Businesses in the sample. How this is measured
Seen by our scan, not graded against the lawObservation

No date found on the privacy notice

All sites
64.5%
±3.1 pts · n = 936
Singapore
61.8%
±4.2 pts · n = 521
Malaysia
68.0%
±4.5 pts · n = 415
Among: Businesses in the sample whose privacy notice the scan could read. How this is measured
Seen by our scan, not graded against the lawObservation

Privacy notice does not name the third-party services seen receiving requests

All sites
71.4%
±3.3 pts · n = 711
Singapore
72.3%
±4.4 pts · n = 397
Malaysia
70.4%
±5.1 pts · n = 314

This series does not count services from large platforms such as Google, Meta, Microsoft and Amazon, or consent tools, so it shows fewer websites than a full comparison would.

Among: Businesses in the sample with a privacy notice read and third-party requests seen before any consent choice, excluding sites where the browser pass did not run through a local residential address. How this is measured
Linked by Dxtra to a provision of privacy lawRegister-backed

No cross-border transfer disclosure

All sites
28.3%
±2.9 pts · n = 953
Singapore
28.4%
±3.8 pts · n = 528
Malaysia
28.2%
±4.3 pts · n = 425
Among: Businesses in the sample with a privacy notice read. How this is measured
Dxtra's view of good practice, not graded as a legal dutyDxtra benchmark priority

Age of the privacy notice

All sites
Undated 64.5%Under 6 months 12.2%6 to 12 months 3.3%12 to 24 months 3.7%Over 24 months 16.2%
n = 936 · margins up to ±3.1 pts
Singapore
Undated 61.8%Under 6 months 11.5%6 to 12 months 3.5%12 to 24 months 4.0%Over 24 months 19.2%
n = 521 · margins up to ±4.2 pts
Malaysia
Undated 68.0%Under 6 months 13.0%6 to 12 months 3.1%12 to 24 months 3.4%Over 24 months 12.5%
n = 415 · margins up to ±4.5 pts
Among: Businesses in the sample with a privacy notice found. How this is measured
Seen by our scan, not graded against the lawObservation

Privacy notice text identical to another site's notice

All sites
0.2%
too few to give a margin · n = 953
Singapore
0.4%
too few to give a margin · n = 528
Malaysia
0.0%
too few to give a margin · n = 425
Among: Businesses in the sample with a privacy notice read. How this is measured

Rights and collection

Routes for access and correction requests, and forms that collect personal data.

Seen by our scan, not graded against the lawObservation

No visible access or correction route (Singapore)

All sites
Not measured
Singapore
31.2%
±2.9 pts · n = 971
Malaysia
Not measured
Among: Businesses in the sample graded under Singapore law. How this is measured
Linked by Dxtra to a provision of privacy lawRegister-backed

No visible access or correction route (Malaysia)

All sites
Not measured
Singapore
Not measured
Malaysia
35.6%
±3.0 pts · n = 966
Among: Businesses in the sample graded under Malaysian law. How this is measured
Linked by Dxtra to a provision of privacy lawRegister-backed

Form collects personal data with no notice at the point of collection, including sites with no privacy notice found at all

All sites
82.5%
±2.3 pts · n = 1,034
Singapore
78.9%
±3.5 pts · n = 508
Malaysia
85.9%
±3.0 pts · n = 526
Among: Businesses in the sample with a form detected. How this is measured
Seen by our scan, not graded against the lawObservation

Where the notice is, for sites with a form

All sites
No privacy notice found on the site 36.5%A privacy notice on the site, but none found at the form 46.0%A privacy notice at the form or linked from it 17.5%
n = 1,034 · margins up to ±3.0 pts
Singapore
No privacy notice found on the site 34.3%A privacy notice on the site, but none found at the form 44.7%A privacy notice at the form or linked from it 21.1%
n = 508 · margins up to ±4.3 pts
Malaysia
No privacy notice found on the site 38.6%A privacy notice on the site, but none found at the form 47.3%A privacy notice at the form or linked from it 14.1%
n = 526 · margins up to ±4.3 pts
Among: Businesses in the sample with a form detected. How this is measured

AI

What privacy notices say about AI, and the chat widgets websites run.

Seen by our scan, not graded against the lawObservation

Privacy notice mentions artificial intelligence or automated decision-making

All sites
21.8%
±2.6 pts · n = 953
Singapore
21.2%
±3.5 pts · n = 528
Malaysia
22.6%
±4.0 pts · n = 425
Among: Businesses in the sample with a privacy notice read. How this is measured
Seen by our scan, not graded against the lawObservation

Live-chat or AI assistant widget on the homepage, by vendor

  1. 1HubSpot Chat1.7%
  2. 2Shopify Inbox1.4%
  3. 3Tawk.to1.0%
  4. 4Zendesk1.0%
  5. 5Tidio0.6%
  6. 6LiveChat0.4%
  7. 7Chatbase0.3%
  8. 8Freshchat0.2%
  9. 9Re:amaze0.2%
  10. 10Gorgias0.1%
  11. 11ElevenLabs ConvAI0.1%
  12. 12Help Scout0.1%
  13. 13JivoChat0.1%
  14. 14ManyChat0.1%
  15. 15Smartsupp0.1%
  16. Share of businesses where each appears · n = 1,991
Among: Businesses in the sample. How this is measured
Seen by our scan, not graded against the lawObservation

Notice describes significant automated decision-making

All sites
0.0%
too few to give a margin · n = 953
Singapore
0.0%
too few to give a margin · n = 528
Malaysia
0.0%
too few to give a margin · n = 425
Among: Businesses in the sample with a privacy notice read. How this is measured

What the law expects

The provisions of Singapore and Malaysian law that the scans engaged, in the words of the register.

Linked by Dxtra to a provision of privacy lawRegister-backed

Websites with at least one finding linked to a provision of the law they were graded against

All sites
69.6%
±2.0 pts · n = 1,948
Singapore
65.0%
±3.0 pts · n = 977
Malaysia
74.2%
±2.8 pts · n = 971

This is the other side of No overall band: on the same 1,948 websites, 69.6% had at least one finding Dxtra's register links to a provision of the law, and 30.4% had none.

Among: Businesses in the sample graded under Singapore or Malaysian law. How this is measured

What is working

Practices that go beyond the minimum.

What is working

Privacy notice updated within six months

All sites
12.2%
±2.1 pts · n = 936
Singapore
11.5%
±2.7 pts · n = 521
Malaysia
13.0%
±3.2 pts · n = 415
Among: Businesses in the sample with a privacy notice found. How this is measured
What is working

Transparency hub or center published

All sites
0.0%
too few to give a margin · n = 1,991
Singapore
0.0%
too few to give a margin · n = 1,000
Malaysia
0.0%
too few to give a margin · n = 991
Among: Businesses in the sample. How this is measured

Capability maturity

A secondary 0 to 100 indicator of the privacy practices seen on a website's public pages. Never the headline.

Secondary indicator

Capability maturity indicator (0 to 100), mean

All sites
19.1 of 100 · mean · n = 974
Singapore
19.1 of 100 · mean · n = 542
Malaysia
19.2 of 100 · mean · n = 432

A website scan can show at most 71 on this scale; the rest covers practices that cannot be seen from public pages.

Among: Businesses in the sample where the scan read a privacy notice; no score is given where none was read. How this is measured

Series not published in this edition, and why.

Tracker requests persist after Reject AllNot published: fewer than 50 businesses (n = 38)
Privacy notice does not mention third parties or service providers at all, on sites where third-party requests were seenNot published: the measured accuracy of this finding has not yet reached the publication gate
Live-chat widget with no noticeNot published: the measured accuracy of this finding has not yet reached the publication gate
Provisions most often engaged, by lawNot measured

Where these numbers come from

Published October 16, 2026. Websites were scanned between October 12 and October 14, 2026; 85 of them were measured in a second pass on October 14, 2026. Revision 1.0.2.

Made by the Dxtra Privacy Scanner at build 562c60d under Methodology v1.19 (snapshot SHA-256 8bc9466aa038…) — the methodology as it stood. Dxtra Regulator Reference v2.0 (Dxtra's own reference, not issued or reviewed by any regulator). Runs idx-2026q4-full-v119, idx-2026q4-stability-v119, idx-2026q4-topup-589. Data pack SHA-256 ef843a9e618b….

  • 2026-10-14: final pack from run(s) idx-2026q4-full-v119, idx-2026q4-topup-589
  • 2026-10-18: Revision 1.0.1: every share and margin is now kept exact and rounded once, half-up, from its count, so some figures move by 0.1 point (none of the headline figures); series labels as agreed (No privacy notice found on the site; No privacy-officer contact on the website; No date found on the privacy notice, now an observation). The counts, sample and method do not change.
  • 2026-10-19: Revision 1.0.2: the vendors' stated home countries are published, from a table Counsel checked against each vendor's own privacy notice or terms (14 of the 15 vendors named; Hotjar withheld). "No date found on the privacy notice" now uses the same reading as the age chart: a notice counts as undated where no date was read from it, by the scan or from its text, whatever its language. The counts of every other series do not change.
  • 2026-10-19: Display corrections; no count changes. No margin is given where fewer than five businesses fall on either side of a figure. The series on services not named in the privacy notice is labeled "Privacy notice does not name the third-party services seen receiving requests", with a note that it does not count large platforms or consent tools. Capability maturity is described as the privacy practices seen on a website's public pages, with its 71-point ceiling for a website scan and its base of websites where a privacy notice was read. The live-chat series' base is all businesses in the sample. The remainder of the vendor league is labeled "Other vendors (combined)" and is not ranked. A line under the age chart explains why it counts more notices as undated than "No date found on the privacy notice".