Singapore PDPA: Your Personal Data Protection Rights Explained

Singapore's Personal Data Protection Act (PDPA) is the cornerstone of data privacy law in the Lion City. Whether you're a resident, a business owner, or simply someone who shops online, the PDPA shapes how organisations collect, use, and disclose your personal information. Yet many people remain unaware of the specific rights the law grants them, or how to exercise those rights when something goes wrong.

This guide breaks down the Singapore PDPA rights in clear, practical terms. You'll learn what counts as personal data, which obligations organisations must follow, and what you can do if your data is mishandled.

What Is the Singapore PDPA?

The Personal Data Protection Act 2012 is Singapore's primary data protection law, administered by the Personal Data Protection Commission (PDPC). It establishes a baseline standard for how private-sector organisations must handle personal data, balancing individual privacy with the legitimate needs of businesses.

The PDPA was significantly amended in 2020 and 2021 to introduce mandatory breach notification, higher financial penalties (up to 10% of annual turnover in Singapore), and new rights such as data portability. These updates brought Singapore closer to international standards like the EU's GDPR, while keeping a distinctly pro-innovation tone.

Who Does the PDPA Apply To?

The PDPA applies to all private-sector organisations that collect, use, or disclose personal data in Singapore, regardless of whether the organisation is physically located there. Public agencies are governed by a separate framework (the Public Sector Governance Act), though they still must meet similar standards.

What Counts as Personal Data Under the PDPA?

Personal data is any data, whether true or false, about an individual who can be identified from that data, or from that data combined with other information the organisation has or is likely to have access to.

Examples include:

• Full name, NRIC or FIN number, passport number
• Mobile phone number and personal email address
• Residential address
• Photographs and video recordings where individuals are identifiable
• Biometric data such as fingerprints and facial scans
• Online identifiers like IP addresses when linked to a person

Business contact information (name, business title, business email) is generally excluded when used in a work capacity.

The Core Singapore PDPA Rights You Need to Know

The PDPA grants individuals several key rights that give you control over your personal information. Understanding these is the first step to protecting yourself.

1. The Right to Be Informed (Notification Obligation)

Before an organisation collects your personal data, it must inform you of the purposes for which the data will be collected, used, or disclosed. Hidden or vague purposes are not permitted. Look out for privacy notices at sign-up forms, retail counters, and app onboarding screens.

2. The Right to Give or Withdraw Consent

Organisations must obtain your consent before collecting, using, or disclosing your personal data, unless an exception applies (such as legal obligations or clearly in your interest). Importantly, you can withdraw your consent at any time by giving reasonable notice. Once withdrawn, the organisation must stop using your data for those purposes.

3. The Right of Access

You can request access to the personal data an organisation holds about you, as well as information about how that data has been used or disclosed in the past year. Organisations generally must respond within 30 days and may charge a reasonable fee.

4. The Right of Correction

If your personal data is inaccurate or incomplete, you have the right to request correction. The organisation must correct the data as soon as practicable and notify other organisations that received the incorrect data, unless you agree otherwise.

5. The Right to Data Portability (2021 Amendment)

Introduced through the 2020 amendments, the data portability right allows you to request that your data be transmitted to another organisation in a commonly used machine-readable format. This right becomes fully operational as the PDPC rolls out sector-specific guidance.

6. The Right to Be Notified of Data Breaches

Since February 2021, organisations must notify affected individuals and the PDPC when a data breach is likely to result in significant harm or affects 500 or more individuals. You should expect clear communication about what happened and what steps you can take.

7. Protection from Unsolicited Marketing (Do Not Call Registry)

The PDPA's Do Not Call (DNC) provisions let you register your Singapore phone number on the DNC Registry to stop telemarketing calls, text messages, and faxes from local organisations.

The 11 PDPA Obligations Organisations Must Follow

The PDPA imposes eleven main obligations on organisations. Knowing these helps you recognise when a company is falling short of its duties.

Obligation	What It Means
Consent	Obtain valid consent before collecting, using, or disclosing data
Purpose Limitation	Only use data for purposes a reasonable person would consider appropriate
Notification	Inform individuals of collection purposes
Access and Correction	Allow individuals to access and correct their data
Accuracy	Ensure personal data is accurate and complete
Protection	Implement reasonable security arrangements
Retention Limitation	Stop retaining data when no longer needed
Transfer Limitation	Ensure overseas transfers meet comparable protection standards
Accountability	Appoint a Data Protection Officer (DPO) and publish contact details
Data Breach Notification	Notify PDPC and affected individuals of significant breaches
Data Portability	Transmit data to another organisation on request (when in force)

How to Exercise Your PDPA Rights: A Step-by-Step Guide

Exercising your rights doesn't require a lawyer. Most requests can be submitted directly to an organisation's Data Protection Officer.

1. Identify the organisation's DPO. Check the company's privacy policy or website footer for DPO contact details.
2. Submit a written request. Clearly state whether you want access, correction, withdrawal of consent, or data portability. Include your identity verification.
3. Wait for a response. Organisations typically must respond within 30 days. If they need more time, they must tell you why.
4. Pay any reasonable fee. Access requests may incur a small fee, but correction requests must generally be free.
5. Escalate if needed. If the organisation refuses or ignores you, you can file a complaint with the PDPC.

What to Do If Your Data Is Mishandled

If you believe an organisation has breached the PDPA, you have several options.

Step 1: Raise the Issue Directly

Contact the organisation's DPO in writing and explain the concern. Many disputes are resolved at this stage once the company becomes aware of the problem.

Step 2: File a Complaint with the PDPC

If direct engagement fails, you can lodge a complaint on the PDPC website. The Commission can investigate, issue directions, and impose financial penalties. Serious breaches can result in fines of up to 10% of an organisation's annual Singapore turnover or S$1 million, whichever is higher.

Step 3: Private Right of Action

If you suffer loss or damage from a PDPA contravention, you may bring a civil action in the Singapore courts for relief, including damages, injunctions, or declarations.

Common PDPA Scenarios in Everyday Life

Scenario 1: Lucky Draw Forms at Shopping Malls

When you drop your name card into a lucky draw box, the organiser must clearly state how your data will be used. If the form only mentions "the draw" but you later receive marketing calls from unrelated companies, that's a likely breach of the purpose limitation and consent obligations.

Scenario 2: Mobile Apps Asking for Excessive Permissions

An app that requests access to your contacts, location, and microphone for a function that doesn't need them may be violating the purpose limitation obligation. You can withdraw consent by revoking permissions or deleting your account.

Scenario 3: Property Agents Sharing Your Details

A real estate agent who shares your phone number with mortgage brokers without explicit consent is likely in breach. You can request a list of third parties who received your data and demand they stop.

How Businesses Can Stay PDPA Compliant

For organisations, PDPA compliance is both a legal duty and a trust-builder. Key practical steps include appointing a DPO, keeping an up-to-date data inventory, running regular Data Protection Impact Assessments (DPIAs), and training staff on secure handling of personal data.

Smart use of tools can also reduce risk. For example, when sharing links to internal documents or marketing campaigns, a privacy-focused link management platform like Lunyb helps teams control, track, and revoke shared URLs without exposing underlying systems. If you're evaluating link tools for PDPA-conscious workflows, our 2026 URL shortener buyer's guide covers the main contenders.

PDPA vs GDPR: Quick Comparison

Many Singapore businesses also serve European customers, so understanding how the PDPA differs from the GDPR is useful.

Feature	Singapore PDPA	EU GDPR
Consent Standard	Deemed consent allowed in some cases	Explicit, freely given consent required
Max Penalty	10% of SG turnover or S$1M	4% of global turnover or €20M
Breach Notification	Within 3 days of assessment	Within 72 hours
Right to Erasure	Not an explicit right (withdrawal + retention limit)	Explicit "right to be forgotten"
Data Portability	Being phased in	Fully in force
DPO Requirement	Mandatory for all organisations	Only in specific cases

Pros and Cons of the Singapore PDPA Framework

Pros

• Clear, business-friendly obligations that scale with risk
• Mandatory DPO ensures every organisation has an accountable contact
• Do Not Call Registry provides direct relief from telemarketing
• Penalties strong enough to deter repeat offenders
• Guided enforcement with substantial PDPC educational resources

Cons

• No explicit right to erasure, unlike GDPR
• Deemed consent provisions can be confusing for consumers
• Data portability still being operationalised
• Public sector operates under a separate regime

Practical Tips to Protect Your Personal Data in Singapore

1. Read privacy notices. Skim at minimum for the purposes of collection and third-party sharing.
2. Register on the DNC Registry. It takes two minutes and blocks most local telemarketing.
3. Use strong, unique passwords and enable two-factor authentication on key accounts.
4. Limit app permissions to only what each app genuinely needs.
5. Review account settings yearly to withdraw consent from services you no longer use.
6. Keep records of data requests you send, including dates and responses.

Frequently Asked Questions

Can I request deletion of my personal data under the PDPA?

The PDPA does not grant an explicit "right to erasure" like the GDPR. However, you can withdraw consent, and the Retention Limitation Obligation requires organisations to stop retaining data when the original purpose is fulfilled and there is no legal reason to keep it. In practice, this often achieves the same result.

How long does an organisation have to respond to my access request?

Organisations must respond to a personal data access request as soon as reasonably possible, generally within 30 days. If more time is needed, they must inform you in writing of the expected response date.

Do I have PDPA rights if the organisation is based overseas?

Yes. The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of whether the organisation is physically located in the country. Overseas companies serving Singapore customers must comply.

What is the penalty for an organisation that breaches the PDPA?

Under the updated framework, the PDPC can impose financial penalties of up to 10% of an organisation's annual Singapore turnover or S$1 million, whichever is higher. The Commission can also issue directions to stop specific practices or undertake remedial action.

Is business contact information protected by the PDPA?

Business contact information such as a work email, job title, or office phone number used for work purposes is generally excluded from most PDPA obligations. However, if the same information is used for personal purposes or combined with personal data, protections may apply.

Final Thoughts

The Singapore PDPA gives individuals meaningful control over their personal data, from the moment it's collected to the point it's deleted. By understanding your rights to consent, access, correction, portability, and breach notification, you can hold organisations accountable and make informed choices about who you share your information with.

For businesses, respecting these rights isn't just about avoiding fines, it's about building the kind of trust that keeps customers loyal in an increasingly privacy-aware market. Whether you're a consumer protecting your inbox or a company protecting your reputation, the PDPA is a framework worth knowing well.