Duty LXD-1011
Processes personal data, in Singapore
Personal Data Protection Act, cross-border transfersince 1 line
Personal Data Protection Act 2012, s.26 · Read the law's page
- An app transferring the personal data of an individual in Singapore, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Singapore must ensure the recipient provides a standard of protection comparable to the PDPA, through a PDPC-prescribed mechanism, unless the PDPC has granted an exemption.
Personal Data Protection Act, data subject rightssince 1 line
Personal Data Protection Act 2012, ss.21-22 · Read the law's page
- An app holding the personal data of an individual in Singapore must give that individual a way to access and correct their personal data on request.
Personal Data Protection Act, comprehensive consent-based regimesince 1 line
Act 26 of 2012 (Singapore), as amended by the Personal Data Protection (Amendment) Act 2020, Act 40 of 2020 · Read the law's page
- An app that collects, uses, or discloses the personal data of an individual in Singapore must obtain the individual's consent, or rely on a Part 3 or Schedule exception, and must state its purpose for the collection, use, or disclosure.
Personal Data Protection Act, data breach notificationsince 1 line
Personal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020 · Read the law's page
- An app that experiences a data breach affecting an individual's personal data in Singapore must assess whether the breach is likely to cause significant harm or is of significant scale, and if so must notify the PDPC as soon as practicable and in any case within 3 calendar days of that assessment, and must also notify each affected individual unless a statutory exception applies.
Personal Data Protection Act, offence of unauthorised re-identification of anonymised informationsince 1 line
Personal Data Protection Act 2012, s.48F (Part 9B), as added by Act 40 of 2020 · Read the law's page
- Do not re-identify, or cause the re-identification of, the person to whom anonymised information held by an organisation or a public agency relates unless the organisation or agency authorises it, knowing that it is unauthorised or reckless as to whether it is (section 48F(1)).
Personal Data Protection Act, enforcement and private right of actionsince 1 line
Personal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020 · Read the law's page
- An app processing the personal data of an individual in Singapore must be prepared to answer to the PDPC for a Part 4 through 6B violation, facing a financial penalty of up to 10 percent of Singapore annual turnover for a serious contravention, and an individual harmed by such a violation may bring a civil claim for relief directly.