Singapore PDPA: Your Personal Data Protection Rights Explained

Singapore's Personal Data Protection Act (PDPA) is the country's cornerstone data privacy law, governing how organisations collect, use, disclose, and protect the personal data of individuals. Whether you are shopping online, signing up for a loyalty programme, or interacting with a service provider, the PDPA gives you concrete rights over your information. This guide explains what those rights are, how to exercise them, and what to do when an organisation gets it wrong.

What Is the Singapore PDPA?

The Personal Data Protection Act 2012 (PDPA) is Singapore's baseline data protection law, enforced by the Personal Data Protection Commission (PDPC). It sets out how private sector organisations must handle personal data and gives individuals enforceable rights over their own information.

The PDPA came into full effect on 2 July 2014 and was significantly strengthened by amendments in 2020 and 2021, introducing mandatory data breach notification, higher financial penalties, and a new data portability obligation. It works alongside the Do Not Call (DNC) Registry provisions, which govern telemarketing to Singapore telephone numbers.

Who Does the PDPA Apply To?

The PDPA applies to all private sector organisations that collect, use, or disclose personal data in Singapore, regardless of whether the organisation itself is based in Singapore. It also covers data intermediaries processing data on behalf of another organisation. Public agencies are governed separately by the Public Sector (Governance) Act.

What Counts as Personal Data?

Personal data is defined as data, whether true or not, about an individual who can be identified from that data, or from that data together with other information the organisation has or is likely to have access to. Examples include:

• Full name and NRIC or FIN number
• Residential address and mobile number
• Email address and IP address (in some contexts)
• Photographs, CCTV footage, and voice recordings
• Financial details, health information, and biometric data

Your Core Rights Under the PDPA

The PDPA grants individuals in Singapore several enforceable rights over how their personal data is handled. These rights are backed by obligations that organisations must meet, with real financial and reputational consequences for non-compliance.

1. The Right to Be Informed (Notification Obligation)

Before or at the point of collecting your personal data, an organisation must inform you of the purposes for which the data will be collected, used, or disclosed. This is why you see privacy notices, consent checkboxes, and data collection statements on registration forms.

2. The Right to Give (and Withdraw) Consent

Organisations generally cannot collect, use, or disclose your personal data without your consent. Equally important, you have the right to withdraw consent at any time by giving reasonable notice. Once you withdraw, the organisation must stop using your data for the withdrawn purpose, although it may retain data required by law or for legitimate business reasons such as ongoing contracts.

3. The Right of Access

You can request access to the personal data an organisation holds about you and ask how that data has been used or disclosed in the past year. The organisation must respond as soon as reasonably possible, typically within 30 days, and may charge a reasonable fee to cover retrieval costs.

4. The Right of Correction

If you believe personal data held about you is inaccurate or incomplete, you can ask the organisation to correct it. Once corrected, the organisation is generally required to send the corrected data to every other organisation it disclosed the data to in the previous year, unless you consent otherwise.

5. The Right to Data Portability

Introduced in the 2020 amendments, this right (once fully operational) allows you to request that an organisation transmit your data to another organisation in a commonly used machine-readable format. It supports greater choice and switching between service providers.

6. The Right to Be Notified of Data Breaches

Under the mandatory Data Breach Notification obligation, organisations must notify the PDPC of a notifiable data breach within 3 calendar days, and notify affected individuals if the breach is likely to result in significant harm.

7. The Right to Opt Out of Telemarketing (DNC Registry)

You can register your Singapore telephone number on the Do Not Call Registry to stop most marketing calls, SMS, and faxes. Organisations must check the DNC Registry before sending marketing messages unless they have clear and unambiguous consent from you.

The 11 Data Protection Obligations at a Glance

Your rights are enforced through eleven data protection obligations that organisations must comply with. Understanding them helps you know what to expect when you hand over your data.

Obligation	What It Means for You
Consent	Your data cannot be collected or used without valid consent (or a legal exception).
Purpose Limitation	Data can only be used for purposes a reasonable person would consider appropriate.
Notification	You must be told why your data is being collected.
Access & Correction	You can view and fix your personal data.
Accuracy	Organisations must make reasonable effort to keep data accurate.
Protection	Reasonable security arrangements must guard your data.
Retention Limitation	Data must be deleted or anonymised when no longer needed.
Transfer Limitation	Overseas transfers require comparable protection standards.
Accountability	A Data Protection Officer (DPO) must be appointed and contactable.
Data Breach Notification	Serious breaches must be reported to you and the PDPC.
Data Portability	You can request your data be sent to another organisation.

How to Exercise Your PDPA Rights

Exercising your rights under the PDPA is straightforward if you follow the correct process. Here is a step-by-step approach that works for most requests.

1. Find the organisation's Data Protection Officer (DPO). Every organisation must designate a DPO whose contact details are publicly available, usually on the company's website in a privacy policy or data protection page.
2. Submit a written request. Send an email or letter clearly stating which right you are exercising (access, correction, withdrawal of consent, etc.) and provide enough detail for the organisation to identify you and locate the relevant data.
3. Verify your identity if asked. Organisations are entitled to confirm you are who you say you are before releasing personal data. Do not be alarmed by this step; it protects you.
4. Wait for a response. The organisation should respond as soon as reasonably possible, and in any case within 30 days. If they need more time, they must tell you why.
5. Escalate to the PDPC if unresolved. If the organisation refuses without valid reason, ignores your request, or handles it poorly, you can file a complaint with the PDPC through its online portal.

Data Breach Notification: What You Should Receive

Since 1 February 2021, mandatory breach notification has been part of Singapore law. A data breach is "notifiable" if it results in, or is likely to result in, significant harm to affected individuals, or if it affects 500 or more individuals.

When you receive a breach notification, it should clearly explain:

• What personal data was affected
• When and how the breach occurred (to the extent known)
• What the organisation is doing in response
• What steps you can take to protect yourself, such as changing passwords or monitoring bank statements
• Contact details for further questions

If you receive a breach notice, act quickly. Update credentials, enable two-factor authentication where possible, and be alert to phishing attempts that may leverage the leaked information.

Penalties for Non-Compliance

The 2021 amendments significantly increased financial penalties. Organisations with annual turnover in Singapore exceeding S$10 million can now be fined up to 10% of that turnover, while smaller organisations face a maximum penalty of S$1 million. Individuals responsible for egregious mishandling of data can also face personal liability, including fines and, in some cases, imprisonment for offences such as unauthorised disclosure or re-identification of anonymised data.

Protecting Your Personal Data in Practice

Your PDPA rights are strongest when combined with sensible personal security habits. Even the best law cannot fully protect data you have willingly shared with insecure services.

Practical Steps You Can Take Today

1. Read privacy notices before agreeing. Look for what data is collected, how long it is kept, and whether it is shared with third parties.
2. Use unique, strong passwords. A password manager makes this painless and prevents credential-stuffing attacks if one service is breached.
3. Enable two-factor authentication. This single step blocks the vast majority of account takeover attempts.
4. Be cautious with shortened links. Malicious actors often hide phishing URLs behind link shorteners. Choose reputable services such as Lunyb, which provides secure link shortening with click analytics and transparent handling of data. See our honest review of Lunyb for more detail.
5. Register on the DNC Registry. A five-minute registration blocks most unwanted marketing calls and SMS.
6. Limit what you share on forms. If a field is not marked mandatory, consider leaving it blank. Never provide your NRIC unless legally required.
7. Review app permissions regularly. Revoke access for apps you no longer use.

Choosing Privacy-Respecting Tools

Everyday tools such as URL shorteners, analytics platforms, and cloud storage all touch personal data. Prefer providers that publish clear privacy policies, comply with the PDPA, and offer minimal data collection by default. Our 2026 buyer's guide to URL shorteners compares options with privacy considerations in mind, and our Rebrandly review covers one of the popular alternatives.

Special Considerations for Businesses in Singapore

If you run a business, PDPA compliance is not optional. At minimum, you should:

• Appoint and publicly identify a Data Protection Officer
• Publish a clear, accessible privacy policy
• Maintain a data inventory and retention schedule
• Train staff on data handling and phishing awareness
• Have an incident response plan for potential breaches
• Vet vendors and data intermediaries for equivalent standards
• Review cross-border transfer arrangements against the Transfer Limitation Obligation

The PDPC publishes free guides, checklists, and a Data Protection Trustmark certification that can help demonstrate compliance to customers and partners.

PDPA vs Other Data Protection Laws

Singapore's PDPA is often compared with the EU's GDPR and other regional laws. While the PDPA takes a more principles-based, business-friendly approach, the rights afforded to individuals are broadly similar in intent.

Feature	Singapore PDPA	EU GDPR
Regulator	PDPC	National DPAs
Max Fine	10% of SG turnover or S$1M	4% of global turnover or €20M
Breach Notification	Within 3 days	Within 72 hours
Right to Erasure	Limited (via consent withdrawal)	Explicit right
Data Portability	Yes (once operational)	Yes
DPO Requirement	Mandatory for all organisations	Conditional

Frequently Asked Questions

Does the PDPA apply to overseas companies that collect data from Singapore residents?

Yes. The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of where the organisation is based. Overseas companies serving Singapore customers must comply with the same obligations as local firms and can be investigated by the PDPC.

Can I ask a company to delete all my personal data?

The PDPA does not provide an explicit "right to erasure" like the GDPR, but you can withdraw consent for further use and disclosure. The organisation must also stop retaining data once the purpose for which it was collected is no longer served and there is no legal reason to keep it. In practice, withdrawing consent often results in deletion of non-essential data.

How long does an organisation have to respond to my access request?

The organisation should respond as soon as reasonably possible. If it cannot respond within 30 days, it must inform you in writing of the estimated time needed. Excessive delay without justification can be reported to the PDPC.

What should I do if I suspect a company has mishandled my data?

Start by contacting the organisation's Data Protection Officer with your concerns in writing. If you are not satisfied with the response, or if the organisation does not respond within a reasonable time, you can lodge a complaint with the PDPC through its online complaint portal. Include copies of your correspondence and any evidence of harm.

Are photos taken in public places covered by the PDPA?

Photos of identifiable individuals are personal data, but the PDPA includes exceptions for personal or domestic use, artistic or journalistic purposes, and situations where consent can reasonably be deemed given. Commercial use of identifiable images generally requires consent from the individuals shown.

Is my NRIC number specially protected?

Yes. Since 1 September 2019, organisations are generally prohibited from collecting, using, or disclosing NRIC numbers or copies of NRICs except where required by law or necessary to accurately establish or verify identity to a high degree of fidelity. Do not hand over your NRIC casually, such as for lucky draws or basic membership sign-ups.

Conclusion

The PDPA gives you meaningful, enforceable control over how your personal data is handled in Singapore. Knowing your rights to access, correction, consent withdrawal, breach notification, and data portability puts you in a strong position, but rights only matter if you use them. Read privacy notices, ask questions, and escalate to the PDPC when organisations fall short. Combine those legal protections with strong personal security habits, careful tool selection, and awareness of common online threats, and you will be well-placed to keep your data safe in 2026 and beyond.