Singapore's Personal Data Protection Act 2012 governs how organisations collect, use, disclose and look after personal data. It sets out accountability, consent, purpose, access, care and transfer duties, a mandatory breach notification regime, Do Not Call rules, and financial penalties and offences that the Personal Data Protection Commission enforces.
Free account needed to download. You come straight back to the file.
Who it is for. Organisations that collect, use or disclose personal data in Singapore, including Indian and other overseas firms that do so there, and the service providers that process data for them.
What this list covers. Personal Data Protection Act 2012, 2020 Revised Edition (in operation 31 December 2021), read on Singapore Statutes Online as the informal consolidation in force from 16 October 2026, which includes amendments by Act 19 of 2025 and Act 2 of 2026. Breach notification details are from the Notification of Data Breaches Regulations 2021 (an archived copy of the Statutes Online text) and PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026). Read 7 November 2026. Check the current text for later changes.: 101 provisions. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it requires |
|---|---|---|
| s. 4(1) | Who is outside the rules | The core duties do not bind individuals acting in a personal or domestic capacity, employees acting in the course of their job, or public agencies. Work out whether you are the organisation, because the duties fall on the organisation. |
| s. 4(2) | Data intermediaries under a written contract | A processor working for you under a written contract is bound only by the security duty, the retention duty and the duty to tell you promptly of a breach. Put the contract in writing and spell out those duties. |
| s. 4(3) | Your processors count as you | You carry the same duties for personal data a data intermediary handles for you as if you handled it yourself, so choose, instruct and monitor processors accordingly. |
| s. 4(5) | Business contact information | Business contact details, such as a work email or phone number, fall outside most of the data protection duties unless a section names them. Treat them separately from other personal data. |
| Ref | Control | What it requires |
|---|---|---|
| s. 11(1) | Reasonable person test | In meeting your duties, weigh what a reasonable person would think appropriate in the circumstances. Write down how that judgement was made for any contested handling of personal data. |
| s. 11(2) | Responsible for data you hold or control | You answer for personal data in your possession or under your control, including data held for you elsewhere. Keep an inventory of where it sits. |
| s. 11(3)-(4) | Designate a person for compliance | Name one or more individuals to make sure the organisation complies with the Act. They may delegate the work to others, so keep the roles and delegations on record. |
| s. 11(5)-(5A) | Publish business contact details | Make the business contact details of at least one designated or delegated individual available to the public, in any manner the regulations prescribe, for example on your website. |
| s. 11(6) | Designation does not pass on liability | Naming a compliance lead does not relieve the organisation of any duty under the Act. Keep board and management ownership in place. |
| s. 12(a) | Policies and practices | Develop and put into operation the policies and practices the organisation needs to meet its duties under the Act, and keep them up to date. |
| s. 12(b) | Complaints process | Set up a process to receive and answer complaints about how the Act applies to your handling of personal data. |
| s. 12(c) | Tell staff | Communicate your data protection policies and practices to your staff, so they know what to do in day-to-day work. |
| s. 12(d) | Information on request | On request, provide information about your data protection policies and practices and about your complaints process. |
| s. 13 | Consent required | Collect, use or disclose personal data only with the person's consent, actual or deemed, or where the Act or another written law requires or allows it without consent. |
| s. 14(1) | Valid consent needs notice | Consent is not valid unless the person has first been given the purpose information the Act requires and has consented for that purpose in the way the Act sets out. |
| s. 14(2)-(3) | No overreaching or deceptive consent | Do not make consent a condition of a product or service beyond what is reasonable to provide it, and do not get consent through false, misleading or deceptive practices. Consent so obtained is not valid. |
| s. 14(4) | Consent through someone acting for the person | Consent given by a person validly acting for an individual counts as the individual's consent. Keep evidence of the authority of anyone who consents on another's behalf. |
| s. 15(1)-(2) | Deemed consent by conduct | Where a person volunteers data for a purpose and it is reasonable that they would, consent is deemed for that purpose. Consent to a disclosure to another organisation extends to that organisation's collection, use or disclosure for that purpose. |
| s. 15(3)-(4) | Deemed consent to enter a contract | A person giving data with a view to entering a contract is deemed to consent to onward disclosure and use by other organisations where reasonably necessary to conclude it. Check the contract does not restrict that. |
| s. 15(6)-(7) | Deemed consent to perform a contract | A person who contracts and gives data is deemed to consent to disclosure to others where reasonably necessary to perform that contract or a related one made at their request or in their interest, and to those others' use. |
| s. 15(9) | Contract terms can narrow deemed consent | Deemed consent for contracts does not override a contract term that limits which data you may disclose, or the purposes for which you may disclose it. Check your contract terms before relying on it. |
| s. 15A(1)-(3) | Deemed consent by notification | From 1 February 2021 you may treat a person as consenting if you notify them and they do not object in time. It is not available for purposes the regulations prescribe, so check the prescribed list first. |
| s. 15A(4) | Before relying on notification | Before collecting, using or disclosing, assess that it is unlikely to harm the person, tell them your intention, the purpose and a reasonable period and way to object, and meet any further prescribed requirements. |
| s. 15A(5) | The adverse-effect assessment | In the assessment, identify the adverse effects the activity may have on the person, then put reasonable measures in place to remove, reduce or lessen them. Keep the assessment on file. |
| s. 16(1)-(3) | Withdrawal of consent | Let people withdraw consent at any time on reasonable notice. Tell them the likely consequences when they do, and never forbid withdrawal, though legal consequences of withdrawing can still follow. |
| s. 16(4) | Stop after withdrawal | After consent is withdrawn, stop collecting, using or disclosing the data, and make your data intermediaries and agents stop, unless the Act or another written law allows it without consent. Retention is still governed by s. 25. |
| s. 17(1) | Collection, use and disclosure without consent | You may collect, use or disclose without consent only in the circumstances, for the purposes and on the conditions the First Schedule and Second Schedule set out. Record which exception you rely on. |
| s. 17(2) | Consistent onward use and disclosure | Data you receive by a permitted disclosure, or collect under an exception, may be used or disclosed for purposes consistent with the original disclosure or collection, or for another purpose the Act permits. |
| First Sch. Pt 1 | Vital interests | Where it clearly serves a person's interests and consent cannot be had in time, or they would not be expected to refuse, you may use their data. Tell them as soon as practicable. Emergencies and next-of-kin contact are also covered. |
| First Sch. Pt 3 | Legitimate interests | To rely on legitimate interests, assess beforehand that your interests, or another's, outweigh the effect on the person, reduce any adverse effect, and give people reasonable access to information on the use. It cannot cover direct marketing messages. |
| First Sch. Pt 4 | Business asset transactions | In a sale, merger or similar deal, the parties may share personal data without consent if they meet the conditions. A prospective buyer may take only what it needs to decide, under an agreement limiting the use to the deal. |
| First Sch. Pt 5 | Business improvement between related corporations | Related corporations may share data to improve products and processes or understand customer behaviour, subject to the Schedule's conditions. Check the conditions before relying on it. |
| Second Sch. Pt 2 Div 2 | Business improvement use | An organisation may use data without consent to improve goods, services or processes, or to understand and personalise offers, if the aim cannot reasonably be met without identifiable data and a reasonable person would accept it. Companies are carved out. |
| Second Sch. Pt 2 Div 3 | Research use | Use personal data without consent for research only if identifiable data is needed, there is a clear public benefit, results will not be used to decide anything about the person, and any published results do not identify them. |
| Second Sch. Pt 3 Div 2 | Research disclosure | Disclose personal data without consent for research only if identifiable data is needed, asking for consent is impracticable, there is clear public benefit, no decision about the person follows, and published results do not identify them. |
| Ref | Control | What it requires |
|---|---|---|
| s. 18 | Purpose limitation | Collect, use or disclose personal data only for purposes a reasonable person would consider appropriate and that you have told the person about, where telling them is required. |
| s. 19 | Data collected before 2 July 2014 | You may keep using personal data collected before 2 July 2014 for the purpose it was collected for, unless consent was withdrawn or the person has otherwise indicated they do not agree. |
| s. 20(1) | Notify purposes | Tell the person the purposes on or before collecting their data, tell them any other purpose before you use or disclose for it, and on request give the business contact details of someone who can answer their questions. |
| s. 20(2) | Tell the source when collecting without consent | When collecting personal data from another organisation without the person's consent, give that organisation enough information about your purpose for it to judge whether its disclosure is lawful. |
| s. 20(3) | Where the notice duty does not apply | You need not give the purpose notice where consent is deemed under s. 15 or s. 15A, or where you collect, use or disclose without consent under s. 17. Note that s. 20(4) still applies to employment. |
| s. 20(4)-(5) | Notice for employment purposes | Even without consent, tell a person your purpose, and on request who can answer questions, when you collect, use or disclose their data to enter, manage or end an employment relationship or appointment. |
| Ref | Control | What it requires |
|---|---|---|
| s. 21(1) | Access to personal data | On request, give the person their personal data that you hold or control, and how it has been used or disclosed in the year before the request. Reply as soon as reasonably possible. PDPC guidance expects a reply within 30 days. |
| s. 21(2)-(4) | Exceptions and mandatory refusals | Do not give access to what the Fifth Schedule exempts. You must refuse where it could threaten safety or health, reveal another person's data or identity, or be against the national interest, and never reveal certain disclosures to law enforcement. |
| s. 21(5) | Give what you can | If you can give access with the excluded material removed, you must do so, rather than refusing the whole request. |
| s. 21(6)-(7) | Tell the person about refusals and exclusions | For requests from 1 February 2021, notify the person within the prescribed time if you reject the request, and tell them when you have left out some data or information. |
| s. 22(1)-(2) | Correction of errors | On request, correct an error or omission in the person's data as soon as practicable, unless you are satisfied on reasonable grounds that it should not be corrected. Send the correction to organisations you disclosed it to in the past year. |
| s. 22(3)-(4) | Sending corrections on | Where the person agrees, a non-credit-bureau may send the correction only to chosen recipients. An organisation told of a correction must correct its own copies, unless it is satisfied on reasonable grounds not to. |
| s. 22(5)-(7) | Annotate and exceptions | If you decide not to correct, annotate the data with the request. You need not alter an opinion, including an expert opinion, nor correct data that the Sixth Schedule exempts. |
| s. 22A | Keep a copy of refused data | If you refuse a request to give someone their data, keep a complete and accurate copy for at least the prescribed period. PDPC guidance gives this as 30 calendar days, in case the person seeks a review. |
| Ref | Control | What it requires |
|---|---|---|
| s. 23 | Accuracy | Make a reasonable effort to keep personal data you collect accurate and complete when it is likely to feed a decision about the person or to be disclosed to another organisation. |
| s. 24(a) | Protect against misuse | Protect personal data you hold or control with reasonable security arrangements against unauthorised access, collection, use, disclosure, copying, modification or disposal, and similar risks. |
| s. 24(b) | Protect against loss of devices | Use reasonable security arrangements to prevent the loss of any storage medium or device holding personal data, such as laptops, phones and drives, for example through encryption and device controls. |
| s. 25 | Retention limitation | Stop keeping documents with personal data, or remove the means of linking them to individuals, once it is reasonable to assume the purpose is no longer served and keeping them is not needed for legal or business reasons. |
| s. 26(1) | Transfer limitation | Move personal data out of Singapore only in line with the prescribed requirements, so that the data gets protection comparable to the Act's. Record the basis for each transfer. |
| PDP Regs 2021, Pt 3 | Bases for overseas transfers | Per PDPC guidance, you can rely on legally enforceable obligations on the recipient (law, contract, binding corporate rules) or a specified certification such as APEC or Global CBPR. Consent and other bases exist as a fallback. |
| s. 26(2)-(4) | Exemption from transfer rules | The Commission may exempt an organisation, on its application and by written notice, from a transfer requirement. It can attach conditions, change them and revoke the exemption at any time. |
| Ref | Control | What it requires |
|---|---|---|
| s. 26A | What counts as a data breach | Treat unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data as a breach, and so too the loss of a device or medium where such unauthorised actions are likely. |
| s. 26B(1) | Notifiable data breach | A breach is notifiable if it results, or is likely to result, in significant harm to an affected individual, or is or is likely to be of significant scale. Build both tests into your incident triage. |
| s. 26B(2) | Deemed significant harm | Harm is deemed significant where the breach involves prescribed data. Under the 2021 Regulations that is a name or ID number with certain financial, health or sensitive data, or an account identifier with its password or access code. |
| s. 26B(3) | Deemed significant scale | A breach is of significant scale where it affects at least the prescribed number of individuals. The Notification of Data Breaches Regulations 2021 set that number at 500. |
| s. 26B(4) | Breaches inside the organisation | A breach that stays within the organisation, meaning unauthorised access, use or similar only internally, is deemed not notifiable. Document why you concluded it stayed internal. |
| s. 26C(2) | Assess promptly | When you have reason to believe a breach has happened, assess in a reasonable and expeditious way whether it is notifiable. PDPC guidance says to finish within 30 calendar days and be ready to explain a longer time. |
| s. 26C(3) | Processor tells the client | A data intermediary that believes a breach has occurred must tell the organisation it processes for without undue delay. That organisation must then assess whether the breach is notifiable. |
| s. 26C(4) | Assess to the prescribed standard | Carry out the assessment in line with any prescribed requirements. PDPC guidance expects you to document every step so you can show the assessment was reasonable and expeditious. |
| s. 26D(1) | Notify the Commission within three calendar days | Notify the Commission as soon as practicable, and in any case no later than 3 calendar days after the day you assess the breach as notifiable. Late notices must give reasons and supporting evidence (Regulation 5(2)). |
| s. 26D(2) | Notify affected individuals | On or after notifying the Commission, tell each affected individual, in a reasonable manner, where the breach is notifiable because of likely significant harm. Subsections (5) to (7) set the exceptions. |
| s. 26D(3)-(4) | Content and form of notice | Notices must carry the prescribed information, to the best of your knowledge at the time. Regulations 5 and 6 list it, and the Commission sets the form and manner for its own notice on its website. |
| s. 26D(5)-(7) | When you need not or must not tell individuals | You need not tell a person if you took action that makes significant harm unlikely or had technological protection beforehand. You must not tell them if law enforcement or the Commission says so. The Commission can waive on application. |
| s. 26D(8)-(9) | Secrecy protection and other laws | Notifying under this Part is not by itself a breach of a secrecy duty, contract or professional rule. Your duties to tell the Commission and individuals apply alongside any duty under another written law to notify others. |
| s. 26E | Processors of public agencies | If you process personal data for a public agency and believe a breach has occurred, tell the agency without undue delay. |
| Ref | Control | What it requires |
|---|---|---|
| s. 37 | What counts as a specified message | A message is covered if one purpose is to offer or promote goods, services, land, business or investment opportunities, or their suppliers (Tenth Schedule). Authorising an agent to promote for you counts as authorising its messages. |
| s. 38 | Reach of the registry rules | The rules cover a specified message addressed to a Singapore telephone number where the sender is in Singapore when it is sent or the recipient is in Singapore when it is accessed. |
| s. 43(1)-(2) | Check the register | Do not send a specified message to a Singapore number unless you hold valid confirmation, when you send, that it is not on the relevant register. Get it from the Commission or a checker, within the prescribed time. |
| s. 43(4) | Consent as an alternative | You do not breach the check duty if the subscriber or user gave clear and unambiguous consent to the messages and the consent is evidenced in a form you can refer back to. Keep consent records. |
| s. 43A | Duties of checkers | If you charge to tell others whether numbers are on the register, make sure what you tell them is accurate and given in the prescribed manner. Passing on the Commission's reply within the prescribed period meets the accuracy duty. |
| s. 44 | Contact information in the message | Each specified message must clearly and accurately identify who sent or authorised it, say how the recipient can readily reach them, meet any regulations, and stay valid for at least 30 days after sending. |
| s. 45 | Do not hide caller identity | For a voice call carrying a specified message, do not hide or withhold the calling line identity, and do not use any operation or instruction that has that purpose or effect. |
| s. 46 | No coerced or deceptive marketing consent | Do not make consent to marketing messages a condition of supplying something beyond what is reasonable, and do not obtain it by false, misleading or deceptive means. Consent so obtained is not valid. |
| s. 47(1)-(3) | Withdrawal of marketing consent | Allow a subscriber or user to withdraw consent to specified messages at any time, never forbid withdrawal, and stop the messages, and have your agents stop, once the prescribed period after notice has passed. |
| s. 48B | No dictionary attacks or number harvesting | Do not send, cause to be sent or authorise messages with a Singapore link to numbers made by trying number combinations or by software that harvests numbers from the internet. |
| Ref | Control | What it requires |
|---|---|---|
| s. 48D | Unauthorised disclosure by an individual | Make it clear to staff and contractors that knowingly or recklessly disclosing personal data without the organisation's authority is an offence for the person, with a fine up to S$5,000 or two years in prison. |
| s. 48E | Improper use for gain or harm | Make it clear that using personal data without authority, knowingly or recklessly, and thereby gaining, harming someone or causing loss, is an offence for the individual, with the same maximum penalties. |
| s. 48F | Unauthorised re-identification | Make it clear that re-identifying anonymised information without authority, knowingly or recklessly, is an offence for the individual. Define who may test or re-identify, and for what, and keep approvals. |
| Ref | Control | What it requires |
|---|---|---|
| s. 48G | Mediation of complaints | Expect the Commission to refer a complaint to mediation under a dispute resolution scheme, even without consent, or to direct you and the complainant to try to resolve it as it directs. |
| s. 48H | Review of access, correction and fee disputes | The Commission can review your refusal or delay on an access or correction request, and any fee charged. It may order you to give access, correct the data in a set way and time, or reduce or refund a fee. |
| s. 48I | Directions for non-compliance | If you breach Parts 3 to 6A, the Commission may direct you to comply, including to stop collecting, using or disclosing data in breach, or destroy data collected in breach. Keep the ability to act quickly on such directions. |
| s. 48J(1)-(2) | Financial penalty for intentional or negligent breach | The Commission may impose a financial penalty on an organisation that intentionally or negligently breaches Parts 3 to 6A. It does not apply where the breach is itself an offence under the Act. |
| s. 48J(3) | Penalty ceiling for organisations | The ceiling is 10% of annual turnover in Singapore if that turnover exceeds S$10 million, and otherwise S$1 million. Turnover is taken from the latest audited accounts available when the penalty is imposed (s. 48J(5A)). |
| s. 48J(4)-(4A) | Penalty ceilings for Part 9 breaches | For Part 9 contraventions, the ceiling is S$200,000 for an individual and S$1 million otherwise. For s. 48B(1), a person with Singapore turnover above S$20 million faces up to 5% of it. Actual maximums are set by regulations. |
| s. 48J(6) | What the Commission weighs | In setting a penalty the Commission considers gravity and duration, data type, any gain, your mitigation, whether you had adequate measures anyway, past breaches, compliance with directions, proportionality and your capacity to carry on. |
| s. 48K | Notice and representations | Before directing you or imposing a penalty, the Commission must give written notice and time to make written representations, at least 14 days for a penalty. A penalty is payable no earlier than 28 days after notice. |
| s. 48L | Voluntary undertakings | Where the Commission has grounds to believe you have breached or are likely to breach the Act, you may offer a written voluntary undertaking, which it can accept. Failure to honour it can bring directions, and publicity at your cost. |
| s. 48M | Court enforcement | The Commission can register a direction, or a written notice for a financial penalty and interest, in a District Court, where it is enforceable as a court order. The court can make orders to secure compliance. |
| s. 48N | Reconsideration | You may ask the Commission in writing, within the prescribed period, to reconsider a direction or a financial penalty. A reconsideration request on a penalty suspends it. There is no reconsideration of the outcome. |
| s. 48O | Private right of action | A person who suffers loss or damage directly from your breach of Parts 4, 5, 6 or 6A can sue for an injunction, a declaration, damages or other relief, once any Commission decision on the breach is final. |
| s. 48Q-48R | Appeals | Directions and penalties can be appealed within the prescribed period to the Appeal Panel's chairperson, and then to the High Court on a point of law or on the amount of a penalty. |
| s. 50 | Investigations and record keeping | Cooperate with Commission investigations under the Ninth Schedule powers, and keep records relating to an investigation for one year after it ends, or longer if the Commission specifies in writing. |
| s. 51(1)-(2) | Requests for another person's data | Do not make an access or correction request for another individual's data without their authority. It is an offence, with a fine up to S$5,000 or 12 months in prison. Verify the identity and authority of requesters. |
| s. 51(3)-(6) | Evasion, obstruction and false statements | Do not destroy, alter or hide records to avoid an access or correction request, obstruct the Commission, ignore its demands, or give it false information. Fines for non-individuals run up to S$50,000, S$100,000 or S$10,000 by offence. |
| s. 52 | Officers and corporate offences | Where a company commits an offence, officers and managers who consented, connived or failed to take reasonable steps to prevent it can be guilty too. Staff members' state of mind can be treated as the company's. |
| s. 53 | Employer liability for staff | Acts of staff in the course of employment are treated as the employer's. A defence exists if you took practicable steps to prevent the conduct, so give staff training, instructions and controls and keep a record of them. |
Alongside the list above, SecureXcel keeps a unified set of practical controls. For each control the workbook gives the risk it addresses, the objective, a description, whether it is preventive or detective, how often to run it, the design and operating test procedures, and the evidence to collect, with the references it covers in this framework. There is one workbook per framework, supplied as it is, with a Version History sheet for document control. Free account needed; you come straight back to the file.
If an organisation assesses a breach as notifiable, it must tell the Personal Data Protection Commission as soon as practicable and no later than 3 calendar days after the day it makes that assessment (s. 26D(1)). It must tell affected people where the breach is likely to cause them significant harm. The Act does not fix the time to assess. PDPC guidance says to do so within 30 calendar days.
An organisation must designate at least one individual to ensure it complies with the Act and make the business contact details of at least one such individual available to the public (s. 11). That person is often called the DPO. Designating someone does not pass the organisation's liability to them.
For breaches of Parts 3 to 6A, the Act caps the penalty at 10% of annual turnover in Singapore where that turnover exceeds S$10 million, and otherwise at S$1 million (s. 48J(3)). The Commission sets the maximum by regulations within those caps, and it weighs the factors in s. 48J(6) when setting an amount.
Yes, if you send marketing messages by voice call, text or fax to Singapore telephone numbers. Unless you hold evidenced clear consent, you must check the register before sending, and every message must identify you and be reachable for at least 30 days (ss. 43 and 44).
Both set consent, purpose, access, security and breach duties. The PDPA also lets organisations rely on deemed consent and legitimate interests in defined cases. Check which regime applies to the people whose data you handle.
No. It is a plain-English summary in our own words, and it leaves out transitional rules, definitions and the regulations' detail. The Act, its regulations and PDPC's guidelines are the authority, so read them before relying on a requirement.