🇸🇬Personal Data Protection Act 2012

← Back to laws in Singapore

A practical accountability law with consent, security and breach notification at its centre

Singapore's Personal Data Protection Act 2012 is built around a pragmatic balance: individuals have a right to protect their personal data, while organisations must be able to collect, use and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances. That balance is visible throughout the Act. It does not ban data use. It requires accountable, proportionate and secure data use.

The PDPA should not be read as a simple consent statute. Consent is important, but the law also recognises deemed consent, exceptions from consent, accountability obligations, access and correction rights, protection duties, retention limits, overseas transfer controls, breach notification, data portability architecture, Do Not Call rules and enforcement powers. A compliant organisation needs a working operating model, not just a consent checkbox.

Who the PDPA covers — and who it excludes

The PDPA applies to an organisation, a term defined broadly to include any individual, company, association or body of persons, corporate or unincorporated, whether or not formed or recognised under Singapore law, resident in Singapore, or having an office or place of business in Singapore. Personal data means data, whether true or not, about an individual who can be identified from that data or from that data and other information to which the organisation has or is likely to have access.

The core obligations in Parts 3, 4, 5, 6, 6A and 6B do not apply to individuals acting in a personal or domestic capacity, employees acting in the course of employment, public agencies, and prescribed excluded organisations or personal data. The Act also excludes most business contact information from the main obligations unless business contact information is expressly mentioned.

Data intermediaries are treated differently. Where an organisation processes personal data on behalf of and for the purposes of another organisation under a written contract, most of the core data protection obligations do not apply directly to the intermediary. However, data intermediaries are still not outside the Act. Protection, retention and certain breach notification duties remain important, and the organisation on whose behalf data is processed remains responsible as if it processed the data itself.

Accountability — the first compliance obligation

Section 11 requires an organisation to consider what a reasonable person would consider appropriate in the circumstances. The organisation remains responsible for personal data in its possession or under its control. It must designate one or more individuals to be responsible for ensuring compliance with the PDPA, and it must make available to the public the business contact information of at least one of those individuals.

Section 12 turns accountability into operational work. Organisations must develop and implement policies and practices necessary to meet their obligations, develop a process to receive and respond to complaints, communicate those policies and practices to staff, and make information available on request about those policies and the complaint process.

This is the part many organisations underestimate. The PDPA expects governance to be visible and usable. If a customer asks how the organisation handles personal data or how to complain, the organisation should not be improvising. It should already have an accountable contact point, written policies, trained staff and an internal response process.

Consent, deemed consent and withdrawal

Section 13 provides the main consent rule: an organisation must not collect, use or disclose personal data unless the individual gives or is deemed to have given consent, or unless collection, use or disclosure without consent is required or authorised under the PDPA or another written law.

Section 14 explains when consent is valid. An individual has not given consent for a purpose unless the individual has been given the required purpose information and has provided consent for that purpose. An organisation must not require consent beyond what is reasonable to provide a product or service. It must also not obtain or attempt to obtain consent through false or misleading information or deceptive practices. Consent obtained in those circumstances is invalid.

The PDPA also recognises deemed consent. Under section 15, consent may be deemed where an individual voluntarily provides personal data for a purpose and it is reasonable that the individual would do so. The Act also includes deemed consent rules for contract-related disclosures and downstream collection, use and disclosure where reasonably necessary for the conclusion or performance of contracts. Section 15A provides deemed consent by notification where the organisation conducts the required assessment, gives proper notice of the intended collection, use or disclosure, provides a reasonable opt-out period and the individual does not object.

Withdrawal remains important. Section 16 allows an individual to withdraw consent on reasonable notice. The organisation must inform the individual of likely consequences and must stop, and cause its data intermediaries and agents to stop, collecting, using or disclosing the data for the withdrawn purpose unless continued processing without consent is required or authorised by law.

Purpose limitation and notification

Section 18 limits collection, use and disclosure to purposes that a reasonable person would consider appropriate in the circumstances and, where applicable, purposes of which the individual has been informed. This means purpose is not purely a drafting issue. Even if a purpose is stated in a notice, it must still be objectively appropriate.

Section 20 requires organisations to inform individuals of the purposes for collecting, using or disclosing personal data on or before collection, and to inform them before any use or disclosure for another purpose not previously notified. On request, the organisation must provide business contact information of a person who can answer questions about the collection, use or disclosure.

Where personal data is collected from another organisation without the individual's consent, the collecting organisation must provide sufficient purpose information to the disclosing organisation so that the disclosing organisation can determine whether disclosure would comply with the Act. This prevents organisations from treating indirect collection as a compliance shortcut.

Access, correction and preservation

Section 21 gives individuals the right to request access to personal data in the organisation's possession or control, and information about how that personal data has been or may have been used or disclosed within the year before the request. The Act contains exceptions, including situations involving another individual's data, safety risks, national interest, prescribed law enforcement disclosures and matters listed in the Fifth Schedule.

Section 22 gives individuals the right to request correction of errors or omissions in their personal data. Unless the organisation is satisfied on reasonable grounds that a correction should not be made, it must correct the personal data as soon as practicable and send the corrected data to other organisations to which it disclosed the data within the previous year, unless those organisations no longer need it for legal or business purposes. If the organisation does not correct the data, it must annotate the personal data with the requested but unmade correction.

Section 22A requires preservation of copies of personal data in certain circumstances where an organisation refuses to provide requested personal data. This is a litigation and accountability safeguard: refusal to provide access should not result in the data disappearing before review or dispute resolution.

Accuracy, protection, retention and overseas transfers

Section 23 requires reasonable efforts to ensure that personal data collected by or on behalf of the organisation is accurate and complete if it is likely to be used to make a decision affecting the individual or disclosed to another organisation.

Section 24 requires reasonable security arrangements to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks, and against loss of storage media or devices. This obligation applies to organisations and is one of the key obligations that also matters directly for data intermediaries.

Section 25 requires organisations to stop retaining documents containing personal data, or remove the means by which personal data can be associated with particular individuals, once the purpose is no longer served and retention is no longer necessary for legal or business purposes. Section 26 restricts transfers of personal data outside Singapore unless the prescribed requirements are met to ensure a comparable standard of protection.

Notifiable data breaches

The PDPA contains a mandatory data breach notification regime. A data breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or if it is or is likely to be of significant scale. An organisation that has reason to believe a breach has occurred must conduct a reasonable and expeditious assessment of whether the breach is notifiable.

Once an organisation assesses that a breach is notifiable, it must notify the Personal Data Protection Commission as soon as practicable and no later than three calendar days after making that assessment. Where the notifiable breach is likely to result in significant harm to affected individuals, the organisation must also notify affected individuals in a reasonable manner, unless an exception applies.

Data intermediaries must notify the organisation on whose behalf they process personal data without undue delay when they have reason to believe that a data breach has occurred. The principal organisation then carries out the notifiability assessment. Where a data intermediary processes personal data on behalf of a public agency, it must notify the public agency without undue delay.

Do Not Call rules and marketing controls

The PDPA includes a separate Do Not Call regime. The Commission maintains Do Not Call registers of Singapore telephone numbers. A person must not send a specified message to a Singapore telephone number unless the person has valid confirmation that the number is not listed on the relevant register, or unless the subscriber or user has given clear and unambiguous consent evidenced in written or other accessible form.

The DNC regime is not the same as the consent rules for ordinary personal data processing. A marketing team may satisfy one layer and still fail another. Organisations that send promotional calls, texts or other specified messages to Singapore numbers need a workflow for checking the register, preserving consent evidence, identifying the sender and not concealing calling line identity.

The Act also prohibits dictionary attacks and address-harvesting software for applicable messages with a Singapore link. It further creates offences for unauthorised disclosure, improper use of personal data and unauthorised re-identification of anonymised information.

Enforcement and penalties

The Personal Data Protection Commission administers and enforces the Act. It may review matters, give directions for non-compliance, accept voluntary undertakings, order organisations to stop collecting, using or disclosing personal data in contravention of the Act, order destruction of personal data collected unlawfully, and enforce directions through court mechanisms.

Financial penalties are significant. For contraventions of the main data protection obligations by an organisation whose annual turnover in Singapore exceeds S$10 million, the maximum may be up to 10% of annual turnover in Singapore. In other cases, the maximum is S$1 million. For certain contraventions by individuals, the maximum may be S$200,000. The Commission must consider factors such as the nature, gravity and duration of non-compliance, the type of data affected, mitigation, prior failures, cooperation, proportionality and deterrence.

The Act also provides a right of private action. A person who suffers loss or damage directly as a result of a contravention of specified PDPA provisions may bring proceedings in court, subject to the structure and limits of the Act.