The legal framework
The Personal Data Protection Act 2012, amended in 2020, governs the collection, use and disclosure of personal data by organisations. It includes the Do Not Call registry, mandatory notification of notifiable data breaches, and financial penalties calculated by reference to turnover for larger organisations.
Key points
| Rights | Access and correction, with statutory exceptions |
|---|---|
| Consent | Required, with deemed consent and legitimate interests exceptions added in 2020 |
| Do Not Call | Register your number to stop marketing calls and messages |
| Breach notification | Mandatory to the PDPC and affected individuals for significant breaches |
| Penalties | Up to 10 % of annual turnover in Singapore for larger organisations |
| Data portability | Provided for in the Act, with implementation staged |
| Regulator | Personal Data Protection Commission |
| Do Not Call registry | Registering stops marketing calls, texts and faxes |
| Accountability obligations | Organisations must publish policies and appoint a data protection officer |
| Private right of action | Available for loss or damage caused by a contravention |
| Public agencies excluded | They are covered by a separate government framework |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Register on the Do Not Call list; it is free and effective.
- Name the data protection officer in your request — organisations must publish the contact.
Cost and coverage
Access requests may attract a reasonable fee; complaints to the PDPC are free.
Recent changes
The PDPC publishes its enforcement decisions in detail, which makes it unusually easy to see what practices have been found unlawful.
Where to go
- Personal Data Protection Commission — online complaints.
- Do Not Call registry.
- Consumers Association of Singapore for related commercial disputes.
Worth knowing
Singapore allows a reasonable fee for access requests, unlike the GDPR. Ask for the fee estimate in advance so it cannot be used to deter the request. The Act does not cover public agencies. Complaints about a government body go through a different framework entirely.
Official sources and links
- gov.sg — official government portal
- Singapore Statutes Online — legislation in force