Singapore PDPA: Your Personal Data Protection Rights Explained

Singapore's Personal Data Protection Act (PDPA) is the cornerstone law governing how organisations collect, use, and disclose your personal data. If you live, work, or do business in Singapore, understanding your PDPA rights is essential — not only to protect your privacy, but also to hold companies accountable when they mishandle your information. This guide breaks down the key rights the PDPA grants individuals, how to exercise them, and what to do when things go wrong.

What Is the Singapore PDPA?

The Personal Data Protection Act 2012 (PDPA) is Singapore's primary data protection law. It establishes a baseline standard for the collection, use, disclosure, and care of personal data by private sector organisations, and it is enforced by the Personal Data Protection Commission (PDPC).

The PDPA has been updated several times since its original passage, with major amendments in 2020 and additional guidance issued through 2024 and 2025. These updates introduced mandatory data breach notification, expanded consent frameworks, and higher financial penalties for serious breaches — up to 10% of an organisation's annual turnover in Singapore or S$1 million, whichever is higher.

The law applies to all private sector organisations handling personal data in Singapore, regardless of where the organisation is based. Public agencies are governed separately under the Public Sector (Governance) Act.

What counts as "personal data" under the PDPA?

Personal data is any data, true or false, about an individual who can be identified from that data, or from that data combined with other information the organisation has access to. Examples include:

Full name, NRIC number, or FIN
Residential address, phone number, personal email
Photographs, video, or voice recordings
Biometric data such as fingerprints or facial scans
Online identifiers like IP addresses when linked to a person

Your Core Rights Under the Singapore PDPA

The PDPA grants individuals several enforceable rights over their personal data. Below are the most important rights every Singapore resident should know.

1. The Right to Be Informed (Notification Obligation)

Before an organisation collects your personal data, it must inform you of the purposes for which the data will be collected, used, or disclosed. This is usually done through a privacy policy, consent form, or notice at the point of collection. If you can't find a clear notification, that itself may be a PDPA violation.

2. The Right to Consent (and to Withdraw It)

Organisations must obtain your consent before collecting, using, or disclosing your personal data, unless an exception applies (such as for investigations, emergencies, or legitimate interests under the 2020 amendments). Importantly, you have the right to withdraw consent at any time, with reasonable notice.

Once you withdraw consent, the organisation must stop collecting, using, or disclosing your data for the stated purposes. They cannot penalise you for withdrawal, although they may inform you of the consequences (for instance, that a service can no longer be provided).

3. The Right of Access

You can request access to:

The personal data an organisation holds about you.
Information on how that data has been used or disclosed within the past year.

Organisations must respond as soon as reasonably possible, and typically within 30 days. If they can't meet the deadline, they must inform you in writing. A reasonable fee may be charged, but it cannot be excessive.

4. The Right to Correction

If your personal data is inaccurate or incomplete, you can request a correction. The organisation must correct the data as soon as practicable and send the corrected data to every other organisation it was disclosed to within the past year (unless you consent otherwise).

5. The Right to Data Portability (Phased In)

The 2020 amendments introduced a data portability obligation, which allows you to request that your data be transmitted to another organisation in a commonly used machine-readable format. While the operational details are still being phased in by the PDPC, this right is increasingly relevant for banking, telecoms, and digital services.

6. The Right to Be Notified of a Data Breach

Since 1 February 2021, organisations are legally required to notify affected individuals and the PDPC when a data breach:

Results in, or is likely to result in, significant harm to affected individuals; or
Is of a significant scale (500 or more individuals affected).

Notification must happen without undue delay and generally within 3 calendar days of assessing the breach as notifiable.

Obligations Organisations Must Follow

Your PDPA rights are supported by specific obligations that organisations must comply with. Understanding these helps you recognise when a company is falling short.

Obligation	What It Means for You
Consent	Your permission is required before data is collected, used, or disclosed.
Purpose Limitation	Your data can only be used for purposes a reasonable person would consider appropriate.
Notification	You must be told why your data is being collected.
Access & Correction	You can see and fix your data on request.
Accuracy	Organisations must take reasonable steps to keep data accurate and complete.
Protection	Reasonable security arrangements must protect your data from misuse or loss.
Retention Limitation	Data must be deleted or anonymised when no longer needed.
Transfer Limitation	Overseas transfers require comparable protection standards.
Accountability	Organisations must appoint a Data Protection Officer (DPO) and publish contact details.
Data Breach Notification	Serious breaches must be reported to you and the PDPC.

How to Exercise Your PDPA Rights: A Step-by-Step Process

Exercising your rights under the PDPA is more straightforward than many people assume. Here's a practical workflow.

Identify the organisation's DPO. Every organisation operating in Singapore must appoint a Data Protection Officer. Look at the company's website — typically on the Privacy Policy page — for a DPO email address.
Submit a written request. Send a clear, dated email specifying whether you are requesting access, correction, withdrawal of consent, or data portability. Include your identifying information so they can locate your records.
Specify the scope. If you want access, state the time period and categories of data you're interested in. Vague requests are harder to action.
Wait up to 30 days. The organisation should respond within this time frame. If they need more time, they must inform you.
Pay a reasonable fee if required. Access requests may incur a modest fee. Correction and withdrawal are typically free.
Escalate if unsatisfied. If the organisation refuses or ignores your request, you can file a complaint with the PDPC.

Sample language for an access request

"Dear Data Protection Officer, under Section 21 of the Personal Data Protection Act 2012, I am requesting access to the personal data your organisation holds about me, as well as information on how it has been used or disclosed in the past 12 months. My identifying details are [name, account number, email on file]. Please acknowledge receipt and advise on any applicable fees."

What to Do If Your PDPA Rights Are Violated

If an organisation refuses to comply, mishandles your data, or suffers a breach that affects you, you have several avenues of recourse.

Filing a complaint with the PDPC

You can submit a complaint directly to the PDPC through their official website at pdpc.gov.sg. Before filing, the PDPC generally expects you to have first raised the issue with the organisation and allowed a reasonable time for response. Include:

A clear description of the incident
Dates and supporting documents (emails, screenshots)
The organisation's response, or lack thereof
What outcome you are seeking

Private right of action

The PDPA provides individuals with a statutory right to seek relief in civil proceedings if they suffer loss or damage directly from a contravention of the law. This includes financial loss, emotional distress, or other quantifiable harm. Courts can order damages, injunctions, or declarations.

Alternative dispute resolution

The PDPC often encourages mediation through the Singapore Mediation Centre or similar bodies before formal enforcement. This can be faster and less adversarial than a tribunal or court process.

Practical Tips to Protect Your Personal Data in Singapore

Beyond knowing your legal rights, there are practical steps you can take to minimise your data exposure day-to-day.

Audit the services you use

Make a list of apps, websites, and services that hold your personal data. For each, ask: Do I still use this? Is the data they hold necessary? If not, request deletion or withdraw consent.

Be careful with shortened links and tracking

Shortened URLs are everywhere — in SMS, emails, QR codes, and social media. Not all link shorteners treat your click data the same way. Some aggressively harvest device, location, and behavioural data. If you create short links for your own business, newsletter, or campaigns, choose a service with transparent data practices and strong security. Tools like Lunyb focus on privacy-aware link management, and you can read an independent perspective in our honest Lunyb review or compare options in our 2026 URL shortener buyer's guide.

Use secure channels for sensitive data

Avoid sending NRIC numbers, financial details, or health information via unencrypted channels like plain SMS or basic email. Prefer secure portals, encrypted messaging, or official e-services like Singpass.

Review consent regularly

Many organisations rely on consent you gave years ago. Periodically review your marketing preferences, cookie consents, and app permissions. Under the PDPA, withdrawal is your right.

Lock down your digital identity

Enable two-factor authentication (2FA) on all critical accounts.
Use a password manager to avoid reusing credentials.
Freeze your credit profile with credit bureaus if you suspect identity theft.
Monitor your Singpass activity log regularly.

PDPA vs GDPR: A Quick Comparison

Many Singapore businesses also need to comply with the EU's General Data Protection Regulation (GDPR). While the two laws share similar principles, there are important differences.

Feature	PDPA (Singapore)	GDPR (EU)
Regulator	PDPC	National Data Protection Authorities
Max Penalty	Up to 10% of annual Singapore turnover or S$1M	Up to 4% of global turnover or €20M
Consent Basis	Consent, deemed consent, legitimate interests, exceptions	Six lawful bases including consent and legitimate interests
Right to Erasure	Not explicit; achieved via consent withdrawal and retention limits	Explicit "right to be forgotten"
Data Portability	Being phased in	Established right
Breach Notification	Within 3 days of assessment	Within 72 hours of awareness
DPO Requirement	Mandatory for all organisations	Mandatory only in certain cases

Recent Developments and What's Next

The PDPC continues to refine the PDPA framework. Recent focus areas include:

AI and automated decision-making: New advisory guidelines on the responsible use of personal data in AI systems.
Children's data: Stricter expectations for services targeting minors, including age-appropriate design.
Cross-border transfers: Expanded recognition of certification schemes like the ASEAN Model Contractual Clauses and APEC CBPR.
Enforcement: A visible increase in financial penalties against organisations with weak security practices or inadequate breach response.

For individuals, this means your rights are getting stronger, and the practical cost of ignoring them is rising for organisations. Staying informed puts you in a much better position to protect yourself.

Frequently Asked Questions

Does the PDPA apply to foreign companies serving Singapore customers?

Yes. The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of where the organisation is incorporated. A foreign e-commerce platform selling to Singapore customers must comply with the PDPA for those customers' data.

Can I ask a company to delete all my personal data?

The PDPA doesn't contain an explicit "right to erasure" like the GDPR, but you can achieve a similar outcome by withdrawing your consent. Once consent is withdrawn, the organisation must stop processing the data, and under the retention limitation obligation, they must delete or anonymise it when it is no longer needed.

How much can an organisation charge for an access request?

Organisations may charge a reasonable fee to recover the incremental cost of responding to the request. The fee cannot be used to deter requests. If you think a fee is excessive, you can ask for an itemised breakdown or raise it with the PDPC.

What happens if I'm affected by a data breach?

If the breach meets the notification threshold (significant harm or 500+ affected individuals), the organisation must notify you and the PDPC. You should change any compromised passwords, monitor your accounts, and consider making a complaint to the PDPC if you believe the organisation failed to protect your data adequately. You may also have grounds for a private civil claim if you suffered loss.

Do I need a lawyer to file a PDPA complaint?

No. The PDPC complaint process is designed to be accessible to individuals without legal representation. However, if you are pursuing a civil claim for damages or dealing with a complex cross-border matter, legal advice can be valuable.

Where can I verify the latest PDPA rules?

The authoritative source is the PDPC's official website (pdpc.gov.sg), which publishes the Act, advisory guidelines, and enforcement decisions. Guidelines are updated regularly, so check back before relying on older guidance.