SingaporePersonal Data Protection Act, comprehensive consent-based regime
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- User location
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Singapore must obtain the individual's consent, or rely on a Part 3 or Schedule exception, and must state its purpose for the collection, use, or disclosure.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commission of Singapore (PDPC) (guidance, recorded ); Piper, Martin v Singapore Kindness Movement [2025] SGHC 173, General Division of the High Court of Singapore, judgment of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://www.elitigation.sg/gd/s/2025_SGHC_173
- Guidance link
- https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf
- Case citation
- Piper, Martin v Singapore Kindness Movement [2025] SGHC 173, General Division of the High Court of Singapore, judgment of
- Guidance body
- Personal Data Protection Commission of Singapore (PDPC)
- Open questions
- How long a period to opt out must an organisation give before it may rely on deemed consent by notification to use individuals’ voice data or facial images?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Section 22A(1) makes an organisation that refuses an access request preserve a complete and accurate copy of the personal data concerned for not less than a prescribed period, and section 43(4)(b) makes the consent that excuses a message to a Singapore number one that is evidenced in written or other form accessible for later reference. The prescribed period is set in subsidiary legislation the row does not cite, so no retention figure is coded. The Commission may require an organisation to produce a specified document under paragraph 1 of the Ninth Schedule when it investigates under section 50. Parts 3 to 6A name no log or register of their own: the data-breach assessment of section 26C and the retention limit of section 25 are not records. Part 9 reaches a message to a Singapore telephone number where its recipient is present in Singapore when it is accessed, which is coded as the hook; its other prong, that the sender is present in Singapore, is a location of the sender and is left out.
- Kind
- Implicit
- As of
- Provision
- Section 22A(1) (a copy of personal data preserved after a refused access request), with section 43(4)(b) (consent to a specified message evidenced so as to be accessible)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
PDPA applies a single consent-based framework to all personal data processing by organisations in Singapore: collection, use, or disclosure requires consent or a Part 3 or Schedule exception, and the Act does not distinguish controller from processor by name, instead regulating organisations directly with pass-through duties on data intermediaries.
There is no statutory sensitive-category or biometric-specific tier; every category of personal data, including a faceprint or voiceprint, is regulated under this one uniform standard.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .