SingaporePersonal Data Protection Act, data subject rights
Personal Data Protection Act 2012, ss.21-22
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- An app holding the personal data of an individual in Singapore must give that individual a way to access and correct their personal data on request.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commission of Singapore (PDPC) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf
- Guidance body
- Personal Data Protection Commission of Singapore (PDPC)
- Open questions
- When does a repeated access request for the same personal data "unreasonably interfere" with the operations of the organisation?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Access record
Logging duty
Section 21(1)(b) makes an organisation tell an individual who asks how the individual’s personal data has been or may have been used or disclosed within the year before the request, which cannot be done without a record of use and disclosure; the clause names no log and sets no period for keeping one, so no retention value is coded. Section 22 corrects data and notifies recipients of a correction and names no record. Section 22A (preserving a copy of data after a refused request) sits just outside the two sections this row cites and is outside this row.
- Kind
- Implicit
- As of
- Provision
- Section 21(1)(b) (information on the ways personal data has been used or disclosed within a year before an access request)
- Trigger
- personal_data_processing
What this law does
Part 5 grants a data subject the statutory rights of access (s.21) and correction (s.22) of their personal data; the Act's own consolidated commencement note records Part 5 as having commenced with the rest of Parts 3 to 7.
A data portability right, headed Part 6B and added by the Personal Data Protection (Amendment) Act 2020, does not appear anywhere in the Act's own table of contents on Singapore Statutes Online, which lists every Part from Part 1 through Part 10 and goes directly from Part 6A to Part 7 with no Part 6B heading between them, so no Part 6B data portability right is asserted here as a numbered Part of the Act.
That conflicts with a quotation elsewhere, in the enforcement instrument, which names Part 6B among the Parts whose contravention grounds a private right of action; that quotation is not independently verified against primary text, because Singapore Statutes Online serves only the table of contents at this URL and not the section body, so the conflict is left open rather than resolved either way. No distinct statutory deletion or erasure right was found in the table of contents structure surveyed.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .