The data behind the Index
Every published figure, with its sample size and margin, as JSON and as one table per metric. Aggregate figures only: no business is named in any file.
The data pack
/api/privacy-index/2026-q4 — the whole edition as JSON: the sample, every stratum, every metric definition and every cell. /api/privacy-index/latest always serves the newest edition.
SHA-256 ef843a9e618b2afc9aa59191863216f25f76666480d3e28b53616deeefc5dc9b
One table per metric (CSV)
Columns: metric, stratum, stratum label, category, n, k, p, margin of error, value, published, and the reason a cell is not published.
- Overall band, by the law the site was scored under · Register-backed
- Number of grounded provisions per site · Register-backed
- No privacy-officer contact on the website · Agent-coded, checked by a person on a sample
- How the website offers a privacy contact · Agent-coded, checked by a person on a sample
- Consent banner shown · Observation
- Consent banner shown, tracker requests fired before consent · Observation
- Tracker requests persist after Reject All · Observation
- Third-party tracker vendors contacted before consent, per site · Observation
- Share of sites contacting at least one vendor in each tracker category before consent · Observation
- Most common third-party vendors contacted before consent · Observation
- Vendors contacted before consent: the vendor's stated home country · Observation
- No privacy notice found on the site · Register-backed
- Privacy notice link present but the notice did not load · Observation
- No date found on the privacy notice · Observation
- Privacy notice does not mention third parties or service providers at all, on sites where third-party requests were seen · Register-backed
- Privacy notice does not name, by name, the third-party services seen receiving requests · Observation
- No cross-border transfer disclosure · Register-backed
- Age of the privacy notice · Dxtra benchmark priority
- Privacy notice text identical to another site's notice · Observation
- No visible access or correction route (Singapore) · Observation
- No visible access or correction route (Malaysia) · Register-backed
- Form collects personal data with no notice at the point of collection, including sites with no privacy notice found at all · Register-backed
- Where the notice is, for sites with a form · Observation
- Live-chat widget with no notice · Register-backed
- Websites with at least one finding linked to a provision of the law they were graded against · Register-backed
- Provisions most often engaged, by law · Register-backed
- Privacy notice updated within six months · What is working
- Transparency hub or center published · What is working
- Capability maturity indicator (0 to 100), mean · Secondary indicator
How to cite the Index
Dxtra (2026). Dxtra SME Privacy Index — Singapore & Malaysia, Q4 2026: What business websites in Singapore and Malaysia show visitors about privacy, Q4 2026. Methodology v1.19. Data pack SHA-256 ef843a9e618b. https://dxtra.ai/privacy-index/2026-q4
Quote a figure with its label (register-backed, observation, agent-coded and checked by a person on a sample, or Dxtra benchmark priority), its sample size and its margin.