Singapore PDPA: Your Personal Data Protection Rights Explained

Singapore's Personal Data Protection Act (PDPA) is the cornerstone of personal data protection in the country, giving individuals meaningful control over how organisations collect, use, and disclose their personal information. Whether you're a Singapore resident wanting to understand your rights, or a business owner trying to stay compliant, this guide breaks down everything you need to know about your PDPA rights in 2026.

What Is the Singapore PDPA?

The Personal Data Protection Act 2012 (PDPA) is Singapore's primary data protection law that governs the collection, use, and disclosure of personal data by organisations. It is enforced by the Personal Data Protection Commission (PDPC), a statutory body under the Infocomm Media Development Authority (IMDA).

The PDPA came into full effect on 2 July 2014 and was significantly amended in 2020 to introduce stronger penalties, mandatory data breach notification, and new rights such as data portability. The law applies to all private sector organisations operating in Singapore, regardless of whether they are based locally or overseas, as long as they handle the personal data of individuals in Singapore.

Who Does the PDPA Cover?

The PDPA covers:

Individuals in Singapore whose personal data is collected, used, or disclosed by organisations.
Private sector organisations, including companies, sole proprietorships, partnerships, and foreign entities handling Singaporean data.
Data intermediaries, such as third-party service providers that process data on behalf of others.

Public agencies like government ministries are not subject to the PDPA but are instead governed by the Public Sector (Governance) Act.

Core PDPA Rights for Individuals in Singapore

The PDPA grants individuals in Singapore a set of enforceable rights designed to give them transparency and control over their personal data. Here are the key rights you should know.

1. Right to Be Informed (Notification Obligation)

Before an organisation collects your personal data, it must inform you of the purposes for which your data will be collected, used, or disclosed. This notification must happen on or before collection, and the organisation can only use your data for purposes a reasonable person would consider appropriate in the circumstances.

2. Right to Give or Withhold Consent

Organisations must obtain your consent before collecting, using, or disclosing your personal data. Consent can be:

Express consent – clearly given through a tick-box, signature, or verbal confirmation.
Deemed consent – inferred when you voluntarily provide data for an obvious purpose (e.g., giving your address for a delivery).

Under the 2020 amendments, deemed consent by contractual necessity and deemed consent by notification were also introduced, allowing organisations to rely on consent in defined scenarios after notifying individuals.

3. Right to Withdraw Consent

You can withdraw your consent to the collection, use, or disclosure of your personal data at any time, with reasonable notice. The organisation must inform you of the likely consequences (such as being unable to continue providing a service) and then stop processing your data accordingly.

4. Right of Access

You have the right to request access to:

The personal data an organisation holds about you.
Information about how your data has been used or disclosed in the past year.

The organisation must respond as soon as reasonably possible, typically within 30 days. They may charge a reasonable fee for providing access.

5. Right of Correction

If you discover that your personal data held by an organisation is inaccurate or incomplete, you can request a correction. The organisation must correct the data as soon as practicable and send the corrected data to every other organisation it was disclosed to within the past year, unless you consent otherwise.

6. Right to Data Portability (New under 2020 Amendments)

The data portability obligation, introduced in the 2020 amendments, allows you to request that an organisation transmit your personal data to another organisation in a commonly used machine-readable format. This gives you more freedom to switch service providers without losing your data history. Note that specific sector regulations may apply once this provision is fully operationalised.

7. Right to Be Notified of Data Breaches

Under the mandatory data breach notification regime (effective from 1 February 2021), organisations must notify both the PDPC and affected individuals of any data breach that:

Results in, or is likely to result in, significant harm to affected individuals, or
Is of a significant scale (affecting 500 or more individuals).

Notification to the PDPC must be made within 3 calendar days of determining a notifiable breach.

Key Obligations Organisations Must Follow

To protect your rights, the PDPA imposes nine key data protection obligations on organisations. Understanding these helps you recognise when your rights are being violated.

Obligation	What It Means
Consent	Obtain valid consent before collecting, using, or disclosing data.
Purpose Limitation	Only use data for purposes a reasonable person would consider appropriate.
Notification	Inform individuals of purposes before or at collection.
Access & Correction	Provide access and allow correction upon request.
Accuracy	Make reasonable effort to ensure data is accurate and complete.
Protection	Implement reasonable security arrangements to protect data.
Retention Limitation	Cease retaining data when no longer needed for business or legal purposes.
Transfer Limitation	Ensure comparable protection when transferring data overseas.
Accountability	Appoint a Data Protection Officer (DPO) and implement policies.

Do Not Call (DNC) Provisions

The PDPA also includes the Do Not Call Registry, which allows Singapore telephone number subscribers to opt out of receiving marketing messages, calls, and faxes. Organisations must check the DNC Registry before sending marketing messages to Singapore numbers unless they have clear and unambiguous consent in writing.

How to Exercise Your PDPA Rights

Knowing your rights is only half the battle. Here's a practical step-by-step guide to exercising them.

Step 1: Identify the Organisation and Its DPO

Every organisation must designate a Data Protection Officer (DPO) and make their contact details publicly available. Check the organisation's website, privacy policy, or ask customer service for the DPO's email or phone number.

Step 2: Submit a Written Request

Send your request in writing (email is acceptable). Clearly state:

Your full name and identification details.
The nature of your request (access, correction, withdrawal of consent, etc.).
Any specific data or time period you're referring to.
Your preferred mode of response.

Step 3: Allow Reasonable Response Time

Organisations typically have up to 30 days to respond. If they need more time, they must inform you in writing of the extended timeline and reasons for delay.

Step 4: Escalate to the PDPC If Needed

If the organisation refuses your request without valid reason, delays unreasonably, or you believe your rights have been violated, you can lodge a complaint with the PDPC via their official website at pdpc.gov.sg.

Penalties for PDPA Violations

The 2020 amendments significantly increased financial penalties for PDPA breaches. Organisations can face fines of up to:

10% of annual turnover in Singapore for organisations with local turnover exceeding S$10 million, or
S$1 million, whichever is higher.

In addition, individuals who knowingly disclose, use, or re-identify personal data without authorisation can face personal fines of up to S$5,000 and/or imprisonment of up to 2 years under the mishandling provisions.

PDPA vs GDPR: Key Differences at a Glance

Many Singapore businesses also deal with EU data and need to understand how the PDPA compares to the GDPR.

Aspect	Singapore PDPA	EU GDPR
Regulator	PDPC	Supervisory authorities in each EU member state
Scope	Personal data of individuals in Singapore	Personal data of EU residents
Max Fine	Up to S$1M or 10% of SG turnover	Up to €20M or 4% of global turnover
Breach Notification	Within 3 days to PDPC	Within 72 hours to authority
Data Portability	Introduced in 2020 amendments	Established right since 2018
Right to Erasure	Not explicit; via consent withdrawal	Explicit "right to be forgotten"

Protecting Your Personal Data in Everyday Life

Beyond legal rights, you can take practical steps to safeguard your personal data online. Here are a few strategies that work especially well in Singapore's highly digital environment.

Be Selective With What You Share

Before filling out any form online or offline, ask yourself whether the organisation truly needs each piece of information. Under the PDPA, organisations can only collect data that is reasonable for the stated purpose. You can refuse to provide excessive data.

Use Privacy-First Online Tools

When sharing links on social media, messaging apps, or marketing campaigns, consider using a reputable URL shortener that respects user privacy. Services like Lunyb allow you to shorten and share links without the aggressive tracking that some larger platforms employ. If you're evaluating options, our 2026 buyer's guide to URL shorteners compares the top services on privacy, features, and pricing.

Review Privacy Policies Regularly

Organisations are required to maintain clear and accessible privacy policies. Take time to review the policies of services you use frequently, especially banking apps, e-commerce platforms, and social media. Look for how long they retain your data and whether they share it with third parties.

Register with the Do Not Call Registry

If you're tired of marketing calls and SMS messages, register your Singapore mobile and fixed-line numbers with the DNC Registry at dnc.gov.sg. Registration is free and takes only a few minutes.

Enable Strong Authentication

Use two-factor authentication (2FA) on all accounts that offer it. Singpass, Singapore's national digital identity, offers biometric and face verification options that are far more secure than passwords alone.

Business Compliance: What Organisations Need to Do

If you run a business in Singapore, PDPA compliance isn't optional. Here's a condensed roadmap.

Appoint a DPO and publish their contact details.
Draft a privacy policy covering all nine data protection obligations.
Implement data inventory – know what data you collect, where it's stored, and how long you keep it.
Train staff on PDPA principles and incident response.
Review third-party vendors and data intermediary agreements.
Set up a breach response plan to meet the 3-day notification deadline.
Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities.

The PDPC provides free resources, including the Data Protection Trustmark certification, which organisations can use to demonstrate strong data protection practices to customers and partners.

Recent Developments and the Future of PDPA

Singapore continues to refine its data protection framework. Recent focus areas include:

Artificial Intelligence governance – the PDPC released the Model AI Governance Framework, with updates addressing generative AI.
Children's data – increasing scrutiny on how platforms handle data of minors.
Cross-border data flows – Singapore remains part of the APEC Cross-Border Privacy Rules system and continues to strengthen bilateral data agreements.
Enforcement actions – the PDPC has imposed multi-million-dollar fines on major organisations, signalling a strict enforcement posture.

Frequently Asked Questions

Does the PDPA apply to foreign companies that don't have an office in Singapore?

Yes. The PDPA has extraterritorial reach. Any organisation that collects, uses, or discloses personal data of individuals in Singapore must comply with the PDPA, regardless of whether they have a physical presence in the country.

Can an organisation refuse my access request?

Yes, but only on specific grounds set out in the PDPA, such as when disclosure would reveal personal data of another individual, threaten safety, or compromise ongoing investigations. The organisation must inform you of the refusal and its reasons in writing.

How long does it take to receive a response to a PDPA request?

Organisations should respond as soon as reasonably possible, generally within 30 days. If they cannot meet this timeline, they must notify you in writing of the extended deadline.

What's the difference between the PDPA and the Do Not Call Registry?

The PDPA governs the overall collection, use, and disclosure of personal data, while the Do Not Call (DNC) provisions within the PDPA specifically regulate telemarketing messages to Singapore telephone numbers. Think of DNC as a subset of the broader PDPA framework.

Can I sue an organisation that mishandles my personal data?

Yes. The PDPA provides a private right of action, allowing individuals who suffer loss or damage due to an organisation's PDPA breach to seek relief in court, including injunctions and damages. However, you must first allow the PDPC to complete its investigation or decline to investigate the matter.

Conclusion

The Singapore PDPA empowers you with meaningful rights over your personal data, from accessing and correcting information to withdrawing consent and demanding breach notifications. As Singapore continues to position itself as a trusted digital hub, these rights will only grow in importance.

Take time this month to review the privacy policies of services you rely on, register with the DNC Registry if you haven't already, and don't hesitate to exercise your rights when something feels off. If you're sharing links or building digital campaigns, choose privacy-respecting tools – you can read our honest review of Lunyb to see how a privacy-first URL shortener compares to alternatives.

Your personal data is yours. The PDPA simply makes sure organisations treat it that way.