Data protection
The Personal Data Protection Act 2012, amended in 2020, governs the collection, use and disclosure of personal data by organisations. It includes the Do Not Call registry, mandatory notification of notifiable data breaches, and financial penalties calculated by reference to turnover for larger organisations.
Key points
| Rights | Access and correction, with statutory exceptions |
|---|---|
| Consent | Required, with deemed consent and legitimate interests exceptions added in 2020 |
| Do Not Call | Register your number to stop marketing calls and messages |
| Breach notification | Mandatory to the PDPC and affected individuals for significant breaches |
| Penalties | Up to 10 % of annual turnover in Singapore for larger organisations |
| Data portability | Provided for in the Act, with implementation staged |
| Regulator | Personal Data Protection Commission |
| Do Not Call registry | Registering stops marketing calls, texts and faxes |
| Accountability obligations | Organisations must publish policies and appoint a data protection officer |
| Private right of action | Available for loss or damage caused by a contravention |
| Public agencies excluded | They are covered by a separate government framework |
In practice
- Register on the Do Not Call list; it is free and effective.
- Name the data protection officer in your request — organisations must publish the contact.
Cost and coverage
Access requests may attract a reasonable fee; complaints to the PDPC are free.
Recent changes
The PDPC publishes its enforcement decisions in detail, which makes it unusually easy to see what practices have been found unlawful.
Where to go
- Personal Data Protection Commission — online complaints.
- Do Not Call registry.
- Consumers Association of Singapore for related commercial disputes.
Worth knowing
Singapore allows a reasonable fee for access requests, unlike the GDPR. Ask for the fee estimate in advance so it cannot be used to deter the request. The Act does not cover public agencies. Complaints about a government body go through a different framework entirely.
The general article: Data protection · Compare with another country
Privacy
The Personal Data Protection Act 2012 governs collection, use and disclosure of personal data by organisations, and includes a Do Not Call registry and mandatory breach notification since 2021. Singapore courts have not recognised a general tort of privacy; harassment is dealt with by the Protection from Harassment Act, which offers fast protection orders.
Key points
| Statute | Personal Data Protection Act 2012, amended in 2020 |
|---|---|
| Regulator | Personal Data Protection Commission |
| Breach notification | Mandatory since 2021 for notifiable breaches |
| Harassment | Protection from Harassment Act: protection orders from the Protection from Harassment Court |
| No privacy tort | The courts have declined to recognise one |
| Breach of confidence | Reformulated to protect private information in a 2020 decision |
| Protection from Harassment | Covers unlawful stalking, including surveillance |
In practice
- Frame a claim as breach of confidence rather than privacy: that is the recognised cause of action.
Where to go
- Personal Data Protection Commission.
- Protection from Harassment Court.
- Community Justice Centre.
Worth knowing
The Act does not apply to public agencies, which are covered by a separate government framework: complaints about a government body follow a different route. The absence of a privacy tort means the claim must be framed as confidence or harassment. The label matters to whether the claim survives.
Image rights
The Criminal Law Reform Act 2019 introduced offences of voyeurism and of distributing or threatening to distribute intimate images, closing gaps that had previously required prosecutors to rely on obscenity provisions. The Protection from Harassment Act provides civil protection orders, and the Online Safety framework allows directions to platforms.
Key points
| Penal Code | Voyeurism and distribution of intimate images, introduced in 2019 |
|---|---|
| Threats | Threatening to distribute an intimate image is itself an offence |
| Protection orders | From the Protection from Harassment Court, including expedited orders |
| Platforms | Directions can require removal or disabling of access |
| Public photography | Generally lawful; no general image right |
| Support | SHE, the Sexual Assault Care Centre and other services provide help |
| Expedited protection order | Available where publication is threatened |
| Doxxing | Publishing identity information to harass is an offence |
| Disposal orders | Courts can order destruction of recordings |
In practice
- Apply for an expedited order the moment a threat to publish is made.
Where to go
- Singapore Police Force.
- Protection from Harassment Court.
- SG Her Empowerment (SHE) and AWARE Sexual Assault Care Centre.
Worth knowing
An expedited protection order can be obtained quickly where there is a risk of publication: that is the tool to reach for when someone is threatening to post. The threat to distribute is itself an offence, so you do not have to wait until the image has been shared.
The general article: Image rights · Compare with another country
Speech and online harassment
POFMA correction directions, a fast harassment court, and criminal defamation alongside civil claims.
The Protection from Online Falsehoods and Manipulation Act 2019 allows ministers to issue correction or takedown directions for false statements of fact against the public interest, subject to appeal. The Protection from Harassment Act gives individuals a rapid civil route against harassment and false statements, through a dedicated Protection from Harassment Court.
Key points
| POFMA | Ministerial correction and takedown directions, appealable to the courts |
|---|---|
| Protection from Harassment Act | Protection orders and false statement orders through a dedicated court |
| Defamation | Both civil and criminal defamation exist |
| Online Criminal Harms Act | Enables directions against online criminal activity, including scams |
| Intimate images | Criminal offences introduced in 2019 |
| Expedited orders | Available in urgent harassment cases |
In practice
- Apply to the Protection from Harassment Court for an order: it is designed for self-represented applicants.
- Preserve evidence with timestamps before requesting removal.
Cost and coverage
The Protection from Harassment Court is designed to be used without a lawyer and has low fees.
Recent changes
The Online Criminal Harms Act 2023 added powers aimed principally at scams and malicious cyber activity.
Where to go
- Protection from Harassment Court, Singapore Courts.
- SHE (SG Her Empowerment) and AWARE for support with online harms.
- Police for criminal matters, including intimate image offences.
Worth knowing
The harassment court can issue expedited protection orders within days and is deliberately designed for self-represented applicants — the fastest civil route in Singapore. POFMA applies to false statements of fact, not opinions, and directions are issued by ministers rather than courts. It is not a route an individual can trigger directly.
The general article: Speech and online harassment · Compare with another country
Copyright
A new Copyright Act came into force in 2021, adding a right of attribution and an open-ended factors test.
The Copyright Act 2021 replaced the 1987 statute. It sets a term of life plus seventy years, introduced a new right of attribution for creators and performers, made creators the default first owners of commissioned photographs and portraits, and created a general permitted-use exception assessed by reference to statutory factors, closer to fair use than to fair dealing.
Key points
| Statute | Copyright Act 2021, in force since November 2021 |
|---|---|
| Term | Life plus 70 years |
| Attribution right | New statutory right to be identified as creator or performer |
| Commissioned works | The creator is now the default owner of commissioned photographs and portraits |
| Permitted use | Open factors test, closer to fair use |
| Text and data mining | Specific exception for computational data analysis |
| Computational data analysis | A specific exception, subject to lawful access |
| Term for unpublished works | Now limited, ending perpetual protection |
In practice
- Put a written assignment in place when commissioning photographs: the default changed in 2021.
Recent changes
The Copyright Act 2021 was the first full rewrite since 1987 and changed several default rules, including ownership of commissioned works.
Where to go
- Intellectual Property Office of Singapore.
- COMPASS and other collecting societies.
- IPOS mediation and adjudication services.
Worth knowing
The 2021 reversal of ownership for commissioned photographs matters for anyone hiring a photographer: without a written assignment the photographer now owns the images. The 2021 Act reversed ownership of commissioned photographs. Anyone hiring a photographer now needs an express assignment.
The general article: Copyright · Compare with another country
Identity theft
Cheating by personation under the Penal Code, with Singpass misuse treated very seriously.
Identity fraud is prosecuted as cheating by personation and under the Computer Misuse Act. Misuse of Singpass credentials — the national digital identity — is prosecuted aggressively, and it is an offence to hand your Singpass details to someone else, even willingly. ScamShield and the police anti-scam centre support victims.
Singapore prosecutes identity misuse as cheating by personation under the Penal Code, and treats misuse of Singpass — the national digital identity — with particular severity, because it unlocks government services, banking and contracts. Disclosing your Singpass credentials to someone else is itself an offence, even if you were deceived into it, which is a point many people learn too late.
Key points
| Penal Code | Cheating by personation and forgery offences |
|---|---|
| Computer Misuse Act | Unauthorised access and use of a computer |
| Singpass | Disclosing your credentials to another person is itself an offence |
| Anti-Scam Centre | Can freeze recipient accounts quickly if reported fast |
| Credit | Credit Bureau Singapore report can be obtained for a small fee |
| Banking | Shared responsibility framework governs losses from phishing scams |
| Shared responsibility framework | Allocates losses between banks, telecom operators and customers |
| Money lock | Funds can be locked so they cannot be transferred digitally |
In practice
- Call the police anti-scam hotline immediately; speed determines whether funds can be held.
- Change your Singpass password and review the transaction history in the app.
- Ask your bank to block cards and review recent applications.
- Obtain your credit bureau report to check for accounts opened in your name.
- Use the money lock feature to ring-fence savings from digital transfers.
Where to go
- Singapore Police Force anti-scam helpline.
- ScamShield.
- Credit Bureau Singapore.
Worth knowing
Never give Singpass credentials to anyone, including people claiming to offer a job or a loan: doing so is an offence in itself and has led to prosecutions of victims. Never share Singpass credentials, even with an employer or a supposed lender. Doing so is an offence and has led to prosecution of victims.
Frequently asked questions
What happens if someone uses my Singpass?
Report immediately to the Singpass helpdesk to suspend the account and to the police. Be aware that handing over your Singpass details to another person is itself an offence: people recruited to open accounts or take loans have been prosecuted, and claiming you were tricked is not a complete answer.
The general article: Identity theft · Compare with another country
Romance scams
A single national scam portal with a 24-hour helpline, and a framework splitting losses between banks and telecoms.
A national scam portal combines a helpline, an app that blocks known scam numbers, and an online reporting route. A shared responsibility framework allocates losses between banks and telecommunications operators where they failed defined anti-scam duties. A police report can be filed online. Banks operate a kill switch allowing an account to be frozen instantly by the customer.
Singapore runs a single national scam portal and a 24-hour helpline, and has gone further than most by setting out a framework that splits losses between banks and telecommunications operators where each has failed in defined duties — a shared responsibility model rather than a blanket reimbursement rule. Banks apply cooling-off periods and transfer limits, which stop a substantial share of losses.
Key points
| National portal | Scam checking, blocking and reporting in one place |
|---|---|
| Helpline | Available around the clock |
| Shared responsibility | Losses allocated to banks and telecoms that failed their duties |
| Kill switch | Customer-triggered instant account freeze at major banks |
| Police report | Can be filed online |
| Blocking app | Filters known scam numbers and messages |
| Cryptocurrency | Effectively unrecoverable |
In practice
- Trigger the bank kill switch first: it freezes the account instantly and stops further outflows.
- Use the national portal to check a number or a website before acting, not only after.
- Cite the shared responsibility framework when claiming: it creates duties that did not previously exist.
- File the police report online and keep the reference.
Cost and coverage
All reporting channels are free.
Where to go
- National scam portal and its 24-hour helpline.
- Your bank's kill switch and fraud line.
- Police online reporting.
- National crime prevention council resources.
Worth knowing
The kill switch is the fastest tool available in any country covered here, and most customers do not know their bank offers one. Find out how to trigger yours before you need it.
Frequently asked questions
Who bears the loss in Singapore?
Under the shared responsibility framework, a bank or a telecommunications operator that has failed in specified anti-scam duties may bear part of the loss; otherwise the customer does. It is narrower than the British rule and applies to defined phishing scenarios rather than to all authorised payments.
Sources
- ScamShield — check, block and report; helpline 1799
- Singapore Police Force — scams — online police report
The general article: Romance scams · Compare with another country
General sources
- gov.sg — official government portal
- Singapore Statutes Online — legislation in force