Singapore PDPA: Your Personal Data Protection Rights Explained

Singapore's Personal Data Protection Act (PDPA) gives every individual meaningful control over how organisations collect, use, and disclose their personal data. Whether you're a Singapore resident, an expatriate working in the country, or simply someone whose data is handled by a Singapore-based business, knowing your PDPA rights is the first step to protecting your digital identity. This guide breaks down every right the PDPA gives you, how to exercise them, and what to do when an organisation fails to comply.

What Is the Singapore PDPA?

The Personal Data Protection Act 2012 (PDPA) is Singapore's primary data protection law. It governs how private sector organisations collect, use, disclose, and care for personal data, and it is enforced by the Personal Data Protection Commission (PDPC), a division of the Infocomm Media Development Authority (IMDA).

The PDPA was significantly amended in 2020 and 2021, introducing mandatory data breach notification, a data portability right, increased financial penalties (up to 10% of annual turnover in Singapore for organisations with revenue above S$10 million), and a new offence framework for the mishandling of personal data. These changes brought the PDPA closer to global standards such as the EU's GDPR while keeping a distinctly Singaporean balance between business innovation and individual protection.

Who Does the PDPA Apply To?

The PDPA applies to all private sector organisations operating in Singapore, regardless of whether they are incorporated locally or based overseas, as long as they collect, use, or disclose personal data in Singapore. Public agencies are covered by a separate framework — the Public Sector (Governance) Act — but the principles are broadly similar.

What Counts as Personal Data?

Personal data is any data, true or false, about an individual who can be identified from that data or from that data combined with other information the organisation has or is likely to have access to. Examples include:

Full name, NRIC or FIN number, and passport details
Residential address, phone number, and email address
Photographs, voice recordings, and CCTV footage
Bank account numbers and financial transaction history
Medical records, biometric data, and genetic information
Device identifiers, IP addresses, and online behavioural data when linked to an identified person

Your Core PDPA Rights at a Glance

The PDPA grants individuals a defined set of rights. Below is a quick reference table summarising each right, what it allows you to do, and the typical response timeframe organisations must meet.

Right	What It Means	Response Window
Right to Be Informed	Organisations must tell you why they collect your data before or at the point of collection.	At point of collection
Right of Access	You can request a copy of personal data an organisation holds about you.	Within 30 days (or notify of delay)
Right of Correction	You can ask for inaccurate or incomplete data to be corrected.	As soon as practicable
Right to Withdraw Consent	You can withdraw consent for the collection, use, or disclosure of your data.	Effective within reasonable time
Right to Data Portability	You can request a copy of your data be sent to another organisation in a machine-readable format.	Subject to PDPC operational guidelines
Right to Be Notified of Breaches	You must be notified if a breach is likely to cause significant harm.	Within 3 calendar days of assessment
Right to Lodge a Complaint	You can complain to the PDPC if an organisation breaches the PDPA.	No statutory limit, but file promptly

1. The Right to Be Informed (Notification Obligation)

Before an organisation collects your personal data — or as soon as is reasonably practical thereafter — it must tell you the purposes for which the data will be collected, used, or disclosed. This is the foundation of consent under the PDPA. If an organisation cannot explain a purpose clearly, it generally cannot rely on your consent to process the data.

In practice, this notification is usually delivered through a privacy policy, a consent checkbox on a sign-up form, or a verbal explanation at a service counter. Look for these notices before submitting your NRIC, signing forms, or handing over photocopies of identity documents.

2. The Right of Access

You have the right to ask any organisation what personal data it holds about you and how that data has been used or disclosed in the past year. This is sometimes called a Subject Access Request (SAR).

How to Submit an Access Request

Identify the organisation's Data Protection Officer (DPO). Their contact details should appear in the privacy policy.
Send a written request (email is acceptable) clearly stating you are exercising your right of access under the PDPA.
Provide enough information to verify your identity and locate the records.
The organisation must respond within 30 days, or notify you of the reason for delay along with an estimated response time.
A reasonable fee may be charged to cover the cost of retrieval, but the fee must not be used to discourage the request.

When Access Can Be Refused

Organisations may refuse access in limited situations, such as when disclosure would reveal personal data about another individual, threaten safety, or compromise an ongoing investigation. The refusal must be justified and explained in writing.

3. The Right of Correction

If you discover that data held about you is inaccurate, outdated, or incomplete, you can request a correction. The organisation must correct the data as soon as practicable and inform every other organisation it disclosed the data to in the past year — unless you agree it isn't necessary.

Common correction scenarios include outdated addresses, misspelled names on insurance policies, incorrect employment history on credit reports, and wrong medical notes. Keep evidence of your correction request and the organisation's response, as this paper trail is essential if you later need to escalate to the PDPC.

4. The Right to Withdraw Consent

Consent is at the heart of the PDPA. You can withdraw your consent at any time by giving the organisation reasonable notice. Once you do, the organisation must stop collecting, using, or disclosing your data for the purposes you withdrew consent for — though it may need to retain certain records for legal or contractual reasons.

Before honouring the withdrawal, the organisation must inform you of the likely consequences (for example, that you can no longer use a particular service). It cannot, however, prohibit you from withdrawing consent. The right to withdraw is absolute, even if it means you lose access to a paid service.

Practical Examples

Unsubscribing from marketing SMS or email lists
Asking a gym to stop using your photo in promotional material
Telling a retailer to stop sharing your purchase history with affiliate brands
Withdrawing biometric consent at a fitness centre that uses facial recognition

5. The Right to Data Portability

Introduced in the 2020 amendments, the data portability right will allow you to request that an organisation transmit your data — in a commonly used, machine-readable format — to another organisation of your choice. This empowers consumers to switch service providers without losing their data history, particularly in banking, telecommunications, and digital services.

Operational guidelines from the PDPC determine exactly which categories of data are portable. While implementation has been progressive, the right gives you long-term leverage to escape vendor lock-in and shop for better services.

6. The Right to Be Notified of Data Breaches

Since 1 February 2021, organisations are legally required to notify the PDPC and affected individuals when a notifiable data breach occurs. A breach is notifiable if it:

Results in, or is likely to result in, significant harm to affected individuals; or
Is of significant scale, meaning it affects 500 or more individuals.

Notification to the PDPC must happen within 3 calendar days of the organisation assessing the breach as notifiable. Affected individuals must be notified at the same time or after, unless law enforcement or the PDPC instructs otherwise.

7. The Right to Lodge a Complaint

If you believe an organisation has mishandled your personal data, you can file a complaint with the PDPC. Before doing so, the PDPC generally expects you to have first raised the issue directly with the organisation's DPO and given them a reasonable chance to resolve it.

How to File a PDPC Complaint

Contact the organisation's DPO in writing and clearly describe the issue.
Wait for their response. The PDPC suggests allowing at least 30 days.
If unresolved, submit the PDPC's online complaint form via the PDPC website, including copies of all correspondence.
The PDPC may attempt mediation or open a formal investigation.
If a breach is confirmed, the organisation can be fined, ordered to change its practices, or required to compensate affected individuals.

The Do Not Call (DNC) Registry: A Related PDPA Right

The PDPA also operates the Do Not Call Registry, which lets you opt out of telemarketing calls, text messages, and faxes sent to your Singapore phone numbers. You can register your number for free at the DNC Registry website. Once listed, organisations must check the registry before sending marketing messages or face penalties.

The three DNC registers cover voice calls, text messages, and faxes separately, so register your number on all three for full coverage. Existing customer relationships have some exemptions, but you can always tell a business to stop messaging you directly.

How to Protect Your Personal Data Online

Knowing your rights is essential, but proactive protection is just as important. Here are practical steps Singapore residents can take to reduce the amount of personal data that ends up in the wrong hands:

Audit your accounts. Review which services hold your NRIC, address, and payment details. Close dormant accounts and ask each provider to delete your data.
Use Singpass Myinfo carefully. Only authorise data sharing with organisations you trust. Review the access log periodically.
Be careful what you click and share. Phishing scams remain one of the top breach vectors. Hover over links before clicking. When sharing links yourself, use a privacy-friendly URL shortener such as Lunyb to mask sensitive query parameters and avoid leaking referrer data. Read our honest review of Lunyb for details.
Enable two-factor authentication on every important account, especially banking, SingPass, and email.
Use a private DNS resolver such as Cloudflare 1.1.1.1 or Quad9 to reduce tracking by your internet provider.
Switch to a privacy-focused browser like Brave or Firefox with tracking protection enabled.

If you're a small business owner in Singapore, you can also explore privacy-respecting tools for your marketing — our 2026 buyer's guide to URL shorteners compares the options with PDPA compliance in mind.

What Organisations Must Do Under the PDPA

To understand your rights, it helps to know the obligations organisations have. The PDPA imposes nine main obligations:

Obligation	Summary
Consent	Obtain valid consent before collecting, using, or disclosing data.
Purpose Limitation	Only use data for purposes a reasonable person would consider appropriate.
Notification	Inform individuals of the purposes for data collection.
Access & Correction	Allow individuals to access and correct their data.
Accuracy	Take reasonable steps to ensure data is accurate and complete.
Protection	Implement reasonable security arrangements to protect data.
Retention Limitation	Stop retaining data once it is no longer needed.
Transfer Limitation	Only transfer data overseas if comparable protection is ensured.
Accountability	Appoint a DPO and put policies in place to comply with the PDPA.

Penalties for PDPA Non-Compliance

Following the 2020 amendments, the PDPC can impose financial penalties of up to:

10% of an organisation's annual turnover in Singapore, for organisations with local turnover exceeding S$10 million; or
S$1 million, whichever is higher.

Individuals working for organisations can also be personally liable for offences such as knowingly disclosing personal data without authorisation, with fines up to S$5,000 and/or imprisonment of up to two years.

Frequently Asked Questions

Does the PDPA apply to foreign companies that handle my data?

Yes. The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of whether the company is incorporated locally. If a foreign e-commerce site sells to Singapore customers and processes their data, it must follow the PDPA. Cross-border transfers must also offer protection comparable to the PDPA.

How long do organisations have to respond to my access request?

Organisations must respond to access requests within 30 days. If they cannot meet this deadline, they must notify you in writing of the reason and give an estimated response date. Unreasonable delays can be reported to the PDPC.

Can I sue an organisation directly for a PDPA breach?

Yes. The PDPA includes a private right of action. If you suffer loss or damage directly as a result of an organisation's breach of certain PDPA obligations, you can pursue civil proceedings in the Singapore courts for relief such as damages, injunctions, or declarations — typically after the PDPC has made a relevant decision.

What's the difference between the PDPA and the GDPR?

Both laws protect personal data, but the GDPR (the EU's framework) tends to be stricter on lawful bases for processing, has wider extraterritorial reach, and imposes higher maximum penalties (up to 4% of global turnover). The PDPA is more business-friendly in some areas, such as deemed consent and legitimate interests, but the 2020 amendments narrowed the gap considerably.

Is my NRIC number specially protected under the PDPA?

Yes. Since 1 September 2019, organisations are generally prohibited from collecting, using, or disclosing NRIC numbers, or retaining physical NRICs, except where required by law or necessary to accurately establish or verify identity to a high degree of fidelity. If a business asks for your NRIC without a clear legal basis, you can refuse and report them.

Final Thoughts

The Singapore PDPA gives you real, enforceable rights over your personal data — but those rights only matter if you exercise them. Read privacy policies, ask questions, register on the DNC Registry, and don't hesitate to file a complaint when something feels wrong. Combined with sensible online habits and privacy-aware tools, the PDPA forms a strong foundation for your digital safety in Singapore.