Singapore PDPA: Your Personal Data Protection Rights Explained (2026)

Singapore's Personal Data Protection Act (PDPA) is the country's main law governing how organisations collect, use, and disclose your personal data. Since it came into force in 2014 and was significantly strengthened in 2021, the PDPA has given individuals in Singapore a set of enforceable rights over their personal information. Yet many Singaporeans are still unsure what those rights actually are, how to use them, or what to do when a company ignores a request.

This guide explains your Singapore PDPA rights in plain English: what each right means, how to exercise it, which organisations are covered, and what happens when things go wrong. Whether you want to pull your data back from a marketing company, stop nuisance calls, or file a complaint with the Personal Data Protection Commission (PDPC), this article walks you through the full picture for 2026.

What Is the Singapore PDPA?

The Personal Data Protection Act 2012 is Singapore's baseline data protection law. It regulates how private-sector organisations handle personal data and sits alongside the Do Not Call (DNC) Registry provisions that restrict unsolicited telemarketing.

The PDPA is overseen by the Personal Data Protection Commission (PDPC), part of the Infocomm Media Development Authority (IMDA). It applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of where the organisation is based. That means a US-based app with Singapore users, a local SME, and a multinational bank all fall within its scope.

What Counts as Personal Data?

Under the PDPA, "personal data" is any data about an individual who can be identified from that data, or from that data combined with other information an organisation has or is likely to have access to. Common examples include:

• Full name, NRIC or FIN number, passport number
• Residential address, personal email, mobile number
• Photographs, video or voice recordings
• Bank account details, credit card numbers
• Medical records, biometric data, CCTV footage
• Online identifiers like IP addresses when linked to a person

Who Is Not Covered?

The PDPA does not generally apply to:

• Personal data handled by an individual for purely personal or domestic purposes
• Employees acting in the course of their employment with an organisation
• Public agencies (the government has its own Public Sector (Governance) Act)
• Business contact information such as a work email, job title, or office number

The Core PDPA Obligations Organisations Must Follow

Your rights only make sense in the context of the duties the PDPA places on organisations. There are nine main obligations, expanded after the 2020 amendments:

1. Consent Obligation – organisations must obtain your consent before collecting, using, or disclosing personal data, unless an exception applies.
2. Purpose Limitation – data can only be used for purposes a reasonable person would consider appropriate and that you've been informed of.
3. Notification Obligation – you must be told why your data is being collected before or at the time of collection.
4. Access and Correction Obligation – you can ask to see and correct your data.
5. Accuracy Obligation – organisations must make reasonable efforts to keep data accurate and complete.
6. Protection Obligation – reasonable security arrangements must protect your data.
7. Retention Limitation – data must be destroyed or anonymised once it's no longer needed.
8. Transfer Limitation – data sent overseas must receive comparable protection.
9. Data Breach Notification – significant breaches must be reported to the PDPC and, in some cases, to you.

Your Key Rights Under the Singapore PDPA

The PDPA gives you several concrete rights you can exercise against any organisation holding your personal data. Here are the most important ones.

1. The Right to Be Informed

Before an organisation collects your personal data, it must tell you the purposes for which the data will be collected, used, or disclosed. This is typically done through a privacy notice or policy. If the purpose changes later, you must be notified and, in most cases, give fresh consent.

2. The Right to Withdraw Consent

You can withdraw consent for the collection, use, or disclosure of your personal data at any time by giving reasonable notice. The organisation must inform you of the likely consequences (for example, that you can no longer use a particular service) but cannot prohibit the withdrawal itself. Once withdrawn, they must stop processing your data for that purpose within a reasonable period.

3. The Right of Access

You can request a copy of the personal data an organisation holds about you, along with information about how it has been used or disclosed in the past year. The organisation must respond as soon as reasonably possible, and generally within 30 days. A reasonable fee may be charged to cover the cost of providing the data.

4. The Right to Correction

If your personal data is inaccurate or incomplete, you can ask the organisation to correct it. If they agree, they must update the data and send the corrected version to every other organisation it was disclosed to in the past year (unless you consent otherwise). If they disagree, they must annotate the data with your requested correction.

5. The Right to Data Portability (New)

Introduced in the 2020 amendments, the Data Portability Obligation allows you to request that an organisation transmit your data in a commonly used machine-readable format to another organisation. This right is being phased in by sector and depends on regulations issued by the PDPC. It is particularly relevant in banking, telecommunications, and utilities, where switching providers used to mean losing your history.

6. The Right to Be Notified of Data Breaches

If an organisation suffers a data breach that is likely to result in significant harm to you, or that affects 500 or more individuals, it must notify the PDPC within 3 calendar days. Affected individuals must also be notified unless an exception applies (for example, if the data was encrypted and the key wasn't compromised).

7. The Right to Lodge a Complaint

If you believe an organisation has breached the PDPA, you can file a complaint with the PDPC after first trying to resolve the matter directly with the organisation. The PDPC can investigate, issue directions, and impose financial penalties of up to 10% of annual turnover in Singapore (for organisations with turnover above S$10 million) or S$1 million, whichever is higher.

Do Not Call Registry: Your Right to Stop Telemarketing

The DNC provisions are part of the PDPA but function as a separate regime. You can register your Singapore telephone number on three registries:

• No Voice Call Register – blocks marketing voice calls
• No Text Message Register – blocks marketing SMS and MMS
• No Fax Message Register – blocks marketing faxes

Registration is free via the DNC Registry website or the SingPass mobile app. Organisations must check the registry before sending marketing messages to any Singapore number, and penalties for breaches can reach S$200,000 per organisation.

Note that transactional messages (appointment reminders, delivery notifications, OTPs) are not restricted, and organisations with an ongoing relationship may send "specified messages" about related products if you haven't opted out.

How to Make a PDPA Request: Step-by-Step

Exercising your rights is more straightforward than many people assume. Here is a practical process.

1. Find the Data Protection Officer (DPO). Every organisation covered by the PDPA must appoint a DPO and publish their business contact information. Check the company's privacy policy or footer.
2. Write a clear request. Email the DPO stating whether you want to access, correct, withdraw consent for, or port your data. Include enough detail for them to identify you, but avoid sending more sensitive data than necessary.
3. Set a reasonable deadline. The law expects a response as soon as reasonably possible. If they need more than 30 days, they must tell you in writing.
4. Review the response. For access requests, check whether the data provided is complete. For correction requests, confirm the update has been made across all systems.
5. Escalate if needed. If the organisation refuses or ignores you, file a complaint with the PDPC using their online complaint form. Keep copies of all correspondence.

PDPA Compared to GDPR and Other Frameworks

Many Singapore organisations serve international customers and must juggle multiple regimes. Here is how the PDPA stacks up against the EU's GDPR and Australia's Privacy Act.

Feature	Singapore PDPA	EU GDPR	Australia Privacy Act
Max fine	10% of SG turnover or S$1M	4% of global turnover or €20M	A$50M or 30% of adjusted turnover
Breach notification	Within 3 days to PDPC	Within 72 hours to regulator	As soon as practicable
Right of access	Yes, fee allowed	Yes, usually free	Yes, limited fee
Right to erasure	Via consent withdrawal + retention limits	Explicit "right to be forgotten"	Limited
Data portability	Phased-in, sector-based	Broad right	Consumer Data Right (sectoral)
DPO required	Yes, for all organisations	Only in specific cases	Not mandated

Practical Tips to Protect Your Personal Data in Singapore

Knowing your rights is only half the battle. Everyday habits are what keep your data out of unnecessary hands in the first place.

Be Deliberate About What You Share

Avoid handing over your NRIC when it isn't strictly required. Since 2019, PDPC guidelines prohibit the indiscriminate collection, use, or disclosure of NRIC numbers. If a gym, retailer, or lucky draw asks for a full NRIC scan, push back and ask what alternative they can use.

Use Privacy-Respecting Tools

Choose services that minimise the data they collect. For example, when sharing links online, a privacy-first URL shortener like Lunyb avoids heavy third-party trackers and keeps analytics minimal. If you're evaluating options, our honest review of Lunyb walks through how it compares to mainstream competitors, and our Rebrandly review looks at a more marketing-focused alternative.

Enable Multi-Factor Authentication

SingPass, banking apps, and email accounts all support multi-factor authentication. Turn it on everywhere. A leaked password is far less dangerous when it's not the only barrier.

Review App Permissions Regularly

Mobile apps often request access to contacts, location, and the microphone when they don't really need it. Audit permissions every few months on both iOS and Android.

Watch Out for Phishing and Scam Calls

Singapore sees persistent scam campaigns impersonating banks, SingPost, and government agencies. The PDPC and Singapore Police Force publish regular alerts. When in doubt, hang up and call the organisation back on a verified number.

What Happens When Organisations Breach the PDPA

The PDPC publishes enforcement decisions on its website, and the trend is clear: financial penalties are growing, and cases now routinely involve poor access controls, unencrypted databases exposed to the internet, and inadequate vendor oversight. Recent decisions have involved healthcare providers, e-commerce platforms, and even community organisations.

Beyond regulatory penalties, individuals who suffer loss or damage directly as a result of a PDPA contravention now have a statutory right of private action. This means you can sue the organisation in court for compensation, though in practice most matters are resolved through the PDPC's complaint process first.

Frequently Asked Questions

Does the PDPA apply to foreign companies serving Singapore customers?

Yes. The PDPA applies to any organisation that collects, uses, or discloses personal data in Singapore, regardless of whether it has a physical presence here. Overseas e-commerce sites, social media platforms, and apps with Singapore users all fall under the law.

Can I ask a company to delete all my personal data?

The PDPA does not have an explicit "right to be forgotten" like the GDPR. However, you can withdraw consent, and the Retention Limitation Obligation requires organisations to destroy or anonymise data once the purpose it was collected for no longer exists and there is no legal need to retain it. In practice, withdrawing consent often leads to deletion.

How long does an organisation have to respond to my access request?

Organisations must respond as soon as reasonably possible. If they cannot respond within 30 days, they must inform you in writing of the expected time frame. Unreasonable delays can be reported to the PDPC.

Is my NRIC number protected under the PDPA?

Yes, and with extra safeguards. The PDPC's Advisory Guidelines on the NRIC and Other National Identification Numbers prohibit organisations from collecting, using, or disclosing full NRIC numbers unless required by law or necessary to accurately establish or verify identity to a high degree of fidelity. Lucky draws, Wi-Fi registration, and loyalty programmes generally should not require it.

What should I do if I receive a marketing call despite being on the DNC Registry?

Note the date, time, and caller's number, and ask which organisation they represent. Then file a complaint with the PDPC through the DNC complaint form. Organisations that call numbers on the register without valid consent can face significant financial penalties.

Can I claim compensation if my data is leaked?

Yes. If you suffer loss or damage directly because an organisation breached the PDPA, you have a statutory right of private action and can seek compensation in court. Many individuals first raise the issue with the PDPC, which can facilitate mediation.