Singapore PDPA: Your Personal Data Protection Rights Explained

Singapore's Personal Data Protection Act (PDPA) is the cornerstone law governing how organisations collect, use, disclose, and protect personal data in the city-state. First enacted in 2012 and significantly strengthened in 2020, the PDPA gives every individual in Singapore meaningful control over their personal data — but only if they understand the rights available to them. This guide breaks down your Singapore PDPA rights, explains what organisations must do, and shows you exactly how to exercise those rights when something goes wrong.

What Is the Singapore PDPA?

The Personal Data Protection Act (PDPA) is Singapore's primary data protection law, administered by the Personal Data Protection Commission (PDPC). It applies to all private-sector organisations handling personal data in Singapore, regardless of where the organisation is headquartered. Public agencies are governed separately under the Public Sector (Governance) Act.

The PDPA balances two goals: safeguarding individuals' personal data and enabling organisations to use data responsibly for legitimate business purposes. It sets out nine main data protection obligations and a Do Not Call (DNC) regime that restricts unsolicited marketing messages to Singapore telephone numbers.

Who Does the PDPA Protect?

The PDPA protects any identifiable individual whose personal data is handled by an organisation in Singapore. You do not need to be a Singapore citizen or Permanent Resident — tourists, work-pass holders, and overseas customers of Singapore-based companies are all covered when their data is processed here.

What Counts as Personal Data?

Personal data means any data, true or false, about an individual who can be identified from that data (or from that data combined with other information the organisation has access to). Common examples include:

Full name, NRIC or FIN number, passport number
Residential address, personal phone number, personal email
Photographs, CCTV footage, voice recordings
Bank account details, credit card numbers
Medical records, biometric data, GPS location
Online identifiers such as IP addresses and cookie IDs when linked to a person

Your Core Rights Under the Singapore PDPA

The PDPA grants individuals four principal rights that you can actively exercise. These rights sit on top of the obligations organisations already owe you, such as using data only for notified purposes and keeping it secure.

1. The Right to Be Informed (Notification Obligation)

Before or at the time of collecting your personal data, an organisation must tell you the purposes for which it will be collected, used, and disclosed. If purposes change later, they must notify you again and obtain fresh consent unless an exception applies. In practice, this is why you see privacy notices on sign-up forms, at reception counters, and on websites.

2. The Right to Give or Withdraw Consent

Consent is the default legal basis for processing personal data in Singapore. You have the right to:

Refuse to provide consent in the first place (though the organisation may then decline to provide the service).
Give consent only for specific purposes, not blanket consent for everything.
Withdraw consent at any time by giving reasonable notice. The organisation must inform you of the likely consequences and then stop processing within a reasonable period.

The 2020 amendments also introduced deemed consent by notification and legitimate interests as alternative bases, but organisations relying on these must still meet strict assessment and transparency requirements.

3. The Right of Access

You can request a copy of personal data about you that an organisation holds, together with information about how that data has been used or disclosed in the past year. Organisations must respond as soon as reasonably possible, generally within 30 days, or explain in writing why more time is needed.

4. The Right of Correction

If you believe personal data held about you is inaccurate or incomplete, you can request a correction. The organisation must either make the correction (and share it with other organisations the data was disclosed to in the past year) or document its reasons for refusing.

5. The Right to Data Portability (Coming Into Force)

The 2020 amendments introduced a Data Portability Obligation that, once operationalised through regulations, will allow you to request that your data be transmitted in a commonly used machine-readable format to another organisation of your choice. This is similar in spirit to the right under the EU GDPR.

The Nine PDPA Obligations Organisations Owe You

Your rights are reinforced by nine data protection obligations imposed on organisations. Knowing these helps you spot when a company is falling short.

Obligation	What It Means for You
Consent	Data can only be collected, used, or disclosed with your consent (or a valid exception).
Purpose Limitation	Data must only be used for purposes a reasonable person would consider appropriate.
Notification	You must be told the purposes before or at the time of collection.
Access and Correction	You can request access to and correction of your data.
Accuracy	Organisations must make reasonable efforts to keep data accurate and complete.
Protection	Reasonable security arrangements must prevent unauthorised access or loss.
Retention Limitation	Data must be deleted or anonymised when no longer needed.
Transfer Limitation	Data sent overseas must receive comparable protection to the PDPA.
Accountability	Organisations must appoint a Data Protection Officer (DPO) and publish contact details.

The Mandatory Data Breach Notification Regime

Since 1 February 2021, organisations in Singapore have been legally required to notify both the PDPC and affected individuals if a data breach meets either of these thresholds:

The breach results in, or is likely to result in, significant harm to affected individuals (for example, exposure of NRIC numbers, financial details, or health information).
The breach is of a significant scale — affecting 500 or more individuals.

Notification to the PDPC must occur as soon as practicable, and no later than 3 calendar days after the organisation assesses the breach is notifiable. Affected individuals must be notified at the same time or after, unless law enforcement or remediation reasons justify a delay.

What You Should Expect in a Breach Notification

A clear description of what happened and when.
The categories of personal data involved.
The potential consequences for you.
Steps the organisation has taken and recommended actions you should take (such as changing passwords or monitoring bank statements).
Contact details of the DPO for follow-up.

The Do Not Call (DNC) Registry

The PDPA includes a separate Do Not Call regime that lets you block unsolicited telemarketing to your Singapore telephone number. There are three registers you can join free of charge at dnc.pdpc.gov.sg:

No Voice Call Register — blocks marketing phone calls.
No Text Message Register — blocks marketing SMS and MMS.
No Fax Message Register — blocks marketing faxes.

Once registered, organisations must check the registry before sending marketing messages (unless they have your clear and unambiguous consent in writing). Breaches can attract significant financial penalties.

How to Exercise Your PDPA Rights: A Step-by-Step Guide

Exercising your rights is more straightforward than many people assume. Here is the practical process:

Identify the organisation's Data Protection Officer. By law, every organisation must publish DPO contact details, usually in the privacy policy or on a dedicated contact page.
Submit a written request. Email is the most common channel. Clearly state whether you want access, correction, withdrawal of consent, or something else. Include enough information for the organisation to identify you (but avoid sending unnecessary sensitive data).
Wait for a response. Organisations should respond as soon as reasonably possible, generally within 30 days. A reasonable fee may be charged for access requests, but it must be reasonable and notified upfront.
Escalate if unsatisfied. If the organisation refuses, delays unreasonably, or fails to protect your data, you can lodge a complaint with the PDPC via the online complaints portal.
Consider private action. The PDPA gives individuals a statutory right to bring civil proceedings for loss or damage suffered as a direct result of a PDPA contravention, once the PDPC has made a finding.

Penalties for Non-Compliance

The 2020 amendments substantially increased the maximum financial penalties the PDPC can impose. Organisations with annual Singapore turnover exceeding S$10 million can be fined up to 10% of that turnover, while smaller organisations face a cap of S$1 million. These penalty levels came into effect on 1 October 2022.

In addition, individuals (including directors and employees) can face personal liability for specific offences such as unauthorised disclosure of personal data, improper use of personal data, and unauthorised re-identification of anonymised data. Penalties include fines of up to S$5,000 and, in some cases, imprisonment of up to 2 years.

Protecting Your Own Data: Practical Steps for Singapore Residents

Legal rights are powerful, but personal habits still form your first line of defence. Here is a short checklist that complements your PDPA rights:

Read privacy notices before you tick the box. Pay particular attention to what data is shared with third parties and for marketing.
Minimise what you share. Do not provide your NRIC unless the organisation is legally required or authorised to collect it. The PDPC's NRIC guidelines are quite restrictive.
Use strong, unique passwords and enable multi-factor authentication wherever possible, especially on SingPass, banking, and email accounts.
Be cautious with shortened links. Phishing attempts often use link shorteners to disguise malicious destinations. Choose services that are transparent about the destination URL and offer click-level security — for example, when sharing links at work or in marketing campaigns, a privacy-conscious shortener like Lunyb can help by giving recipients a cleaner, verifiable preview before they click. You can also read our honest Lunyb review and our 2026 buyer's guide to URL shorteners for a side-by-side comparison.
Register with the DNC to cut down on unsolicited marketing.
Review app permissions regularly on your mobile devices and revoke access you no longer need.

How the PDPA Compares to Other Major Privacy Laws

Singapore's PDPA is often placed alongside the EU's GDPR and other APAC frameworks. The table below highlights a few headline differences:

Feature	Singapore PDPA	EU GDPR
Primary legal basis	Consent (plus deemed consent and legitimate interests)	Six lawful bases, including consent and legitimate interests
Breach notification deadline to regulator	Within 3 calendar days of assessment	Within 72 hours of becoming aware
Maximum fine	10% of annual Singapore turnover or S$1 million	€20 million or 4% of global annual turnover
Data Protection Officer	Mandatory for all organisations	Mandatory in specific scenarios
Data portability	Legislated in 2020, pending full operationalisation	Fully in force

Common PDPA Scenarios and What To Do

Scenario 1: A Shop Insists On Your NRIC for a Lucky Draw

Since 1 September 2019, organisations generally cannot collect, use, or disclose NRIC numbers (or copies of NRIC cards) unless required by law or necessary to accurately establish or verify identity to a high degree of fidelity. A lucky draw almost never meets that bar. Politely refuse and offer alternative contact details.

Scenario 2: Your Ex-Employer Still Sends You Marketing Emails

Withdraw consent in writing to the DPO. If marketing continues after a reasonable period, lodge a complaint with the PDPC.

Scenario 3: You Receive a Breach Notification

Follow the recommended steps immediately — change passwords, enable additional authentication, and monitor financial statements. Keep the notification email for your records in case you later need to demonstrate harm.

Frequently Asked Questions

Does the PDPA apply to foreign companies that collect data from people in Singapore?

Yes. The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of whether the organisation is formed or resident here. Overseas companies with Singapore customers should comply, and the PDPC has taken enforcement action in cross-border cases.

How long do organisations have to respond to an access or correction request?

Organisations must respond as soon as reasonably possible. If they cannot respond within 30 days, they must inform you in writing of the time by which they will respond. Unreasonable delays can be the subject of a complaint to the PDPC.

Can an organisation charge me for an access request?

Yes, but only a reasonable fee that reflects the incremental cost of responding, such as photocopying or staff time. The organisation must provide a written estimate before proceeding, and you can withdraw the request if you find the fee unacceptable.

What is the difference between the PDPA and the Spam Control Act?

The PDPA's Do Not Call provisions regulate direct marketing to Singapore telephone numbers (calls, SMS, MMS, fax). The Spam Control Act separately regulates unsolicited commercial electronic messages sent in bulk, including email and mobile messaging. Both can apply to the same campaign.

What should I do if I think my personal data has been misused?

Start by contacting the organisation's DPO in writing and giving them a reasonable opportunity to resolve the issue. If the response is unsatisfactory, submit a complaint to the PDPC through its online portal, attaching your correspondence and any supporting evidence. For financial loss directly caused by a confirmed PDPA breach, you may also consider civil action.

Final Thoughts

The Singapore PDPA has matured into a robust framework that gives individuals genuine control over their personal data, backed by meaningful penalties and a mandatory breach notification regime. Knowing your rights — notification, consent, access, correction, and (soon) data portability — puts you in a far stronger position when dealing with the organisations that handle your information every day. Combine those legal rights with sensible personal habits, and you will significantly reduce your exposure to the data misuse and scams that are unfortunately all too common.