Singapore

Section 377BE makes it an offence for any person to intentionally or knowingly distribute, or knowingly threaten to distribute, an intimate image or recording of another person without that person's consent, knowing or having reason to believe the distribution or threat will or is likely to cause humiliation, alarm or distress. The section was inserted by the Criminal Law Reform Act 2019 (Act 15 of 2019).

Section 377BE(5)(b), most recently amended with effect from 17 August 2026, defines an intimate image or recording to include an image or recording in any form that has been altered or generated to appear to show a person's intimate depiction, excluding an image so altered or generated that no reasonable person would believe it depicts that person; the section's own illustration is a face copied and pasted onto another body to appear that the person engaged in a sexual act.

A person convicted is liable to imprisonment for up to 5 years, or a fine, or caning, or a combination. Where the depicted person is below 14 years of age, imprisonment for up to 5 years is mandatory, and the person is also liable to a fine or to caning.

Section 61MA of the Parliamentary Elections Act 1954, inserted by the Elections (Integrity of Online Advertising) (Amendment) Act 2024 (Act 34 of 2024), makes it an offence to publish, or cause to be published, in Singapore during the election period of an election in an electoral division online election advertising that contains an audio, visual or audiovisual representation of a candidate saying or doing something that the candidate did not in fact say or do.

The representation must be realistic enough that some members of the general public would reasonably believe the candidate said or did that thing, and must have been created wholly or partly with content generated or manipulated using digital means. The section's illustration states that generative artificial intelligence is an example of such digital means.

The publisher must know, or ought reasonably to have known, that the content is or includes online election advertising that relates to the election. A person guilty of the offence is liable on conviction by a District Court to a fine not exceeding $1,000, to imprisonment for a term not exceeding 12 months, or to both.

It is a defence for the person charged to prove, on a balance of probabilities, that the person did not know and had no reason to believe that the candidate did not in fact say or do the thing. The section does not apply to a private or domestic communication of content between two or more individuals by electronic means, to a publication of election news by an authorised news agency, or in other circumstances that the election advertising regulations prescribe. The section came into operation on 22 January 2025.

Part 6A, added by the 2020 amendment, makes a data breach notifiable if it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale; an internal-only breach is deemed not notifiable.

The organisation must notify the PDPC as soon as practicable, and in any case no later than 3 calendar days after assessing the breach is notifiable, and must also notify each affected individual, subject to exceptions where technological measures render significant harm unlikely or a law-enforcement agency or the PDPC directs otherwise.

PDPA applies a single consent-based framework to all personal data processing by organisations in Singapore: collection, use, or disclosure requires consent or a Part 3 or Schedule exception, and the Act does not distinguish controller from processor by name, instead regulating organisations directly with pass-through duties on data intermediaries.

There is no statutory sensitive-category or biometric-specific tier; every category of personal data, including a faceprint or voiceprint, is regulated under this one uniform standard.

Section 26(1) bars an organisation from transferring personal data to a country or territory outside Singapore except in accordance with requirements ensuring a standard of protection comparable to the PDPA; the PDPC may grant exemptions on application under s.26(2) and (3). This is a comparability-based mechanism, not a flat prohibition or a data-localization mandate; the specific instruments accepted as satisfying comparable protection sit in PDPA Regulations not read.

Section 26 sits in the original 2012 Act's Part 6 (Care of Personal Data), which the Act's own consolidated text records as having commenced 2 July 2014 alongside the rest of Parts 3 to 7.

Part 5 grants a data subject the statutory rights of access (s.21) and correction (s.22) of their personal data; the Act's own consolidated commencement note records Part 5 as having commenced 2 July 2014 with the rest of Parts 3 to 7.

A data portability right, headed Part 6B and added by the Personal Data Protection (Amendment) Act 2020, does not appear anywhere in the Act's own table of contents on Singapore Statutes Online, which lists every Part from Part 1 through Part 10 and goes directly from Part 6A to Part 7 with no Part 6B heading between them, so no Part 6B data portability right is asserted here as a numbered Part of the Act.

That conflicts with a quotation elsewhere, in the enforcement instrument, which names Part 6B among the Parts whose contravention grounds a private right of action; that quotation is not independently verified against primary text, because Singapore Statutes Online serves only the table of contents at this URL and not the section body, so the conflict is left open rather than resolved either way. No distinct statutory deletion or erasure right was found in the table of contents structure surveyed.

The Personal Data Protection Commission (PDPC) is Singapore's supervisory authority. Financial penalties under s.48J, added by the 2020 amendment and commencing 1 October 2022, reach up to 10 percent of Singapore annual turnover for an organisation with turnover exceeding S$10 million (otherwise up to S$1 million), and up to S$200,000 for an individual, or up to 5 percent of turnover exceeding S$20 million.

Section 48O(1), also added by the 2020 amendment, gives a person who suffers loss or damage directly from a contravention of the Consent Obligation (Part 4), Access and Correction (Part 5), Care of Personal Data (Part 6), Notification of Data Breaches (Part 6A), or Data Portability (Part 6B) provisions a right of action for relief in civil proceedings; its own specific commencement date within the 2020 amendment was not independently isolated.

Section 48F makes it an offence for an individual to take any action to re-identify, or cause the re-identification of, the person to whom anonymised information in the possession or under the control of an organisation or a public agency relates, where the organisation or agency has not authorised the re-identification and the individual knows that it is unauthorised or is reckless as to whether it is.

On conviction the penalty is a fine not exceeding $5,000, imprisonment for up to 2 years, or both. The offence binds individuals, and Part 9B does not apply to a relevant public official in a Singapore public sector agency, or to a director, officer or employee of the Monetary Authority of Singapore in respect of information acquired in the performance of their duties.

The accused has a defence, to be proved on a balance of probabilities, where the information on the affected person's identity is publicly available, where another law permits or requires the re-identification or a court order authorises or requires it, where the accused reasonably believed it was for a specified purpose and notified the Commission or the organisation as soon as practicable, or where the accused reasonably believed they had the legal right to do it for a purpose other than a specified purpose.

Where a public agency shares anonymised information under a data sharing and use direction, a re-identification that the direction or a further authorisation under it does not authorise is treated as unauthorised.

Section 3(1) makes it an offence for any person to knowingly cause a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer, punishable on a first conviction by a fine not exceeding $5,000 or imprisonment not exceeding 2 years or both, and on a second or subsequent conviction by a fine not exceeding $10,000 or imprisonment not exceeding 3 years or both.

Where the offence causes damage, section 3(2) raises the penalty to a fine not exceeding $50,000 or imprisonment not exceeding 7 years or both. Access is unauthorised under section 2(5) where the person is not entitled to control access of that kind and has no consent from someone who is so entitled; no reported Singapore decision has tested whether reading a public, unauthenticated web page without defeating any access control falls within this offence. The Act commenced on 30 August 1993.

Section 244 makes it a permitted use for a person to copy a work or a recording of a protected performance for computational data analysis, or to prepare it for computational data analysis, including using the work as an example of a type of data to improve the functioning of a computer program (the Act's own illustration is training a computer program to recognise images), provided the copier does not use the copy for any other purpose, does not supply the copy except to verify the results or for collaborative research or study, and has lawful access to the material.

Section 244(2)(d)'s illustrations state that lawful access excludes access gained by circumventing paywalls or breaching a database's terms of use. Section 187 makes any contract term void to the extent it purports to exclude or restrict this permitted use, so a website's terms of service cannot override the exception, though they can still govern how the first copy was lawfully obtained. The Act carries no sui generis database right distinct from ordinary copyright protection.

Sections 187, 243 and 244 fall outside the two carve-outs in the Act's own commencement clause, so they came into force with the rest of the Act on 21 November 2021.

Section 35A(1)(a) of the Act lets the Commissioner of Cybersecurity issue or approve codes of practice and standards of performance for owners of provider-owned critical information infrastructure, designated providers responsible for third-party-owned critical information infrastructure, owners of systems of temporary cybersecurity concern, entities of special cybersecurity interest and major foundational digital infrastructure service providers.

Section 35A(6) requires each of those persons to comply with the codes of practice and standards of performance that apply to the person, subject to section 35A(4) and (7). Section 35A(7) lets the Commissioner waive the application of a code of practice or standard of performance to a person, generally or for a stated time, and the amended section took effect on 31 October 2025.

Paragraph 5 of the Notice requires a bank to make all reasonable effort to maintain high availability for critical systems and to keep unscheduled downtime for each critical system to no more than a total of 4 hours in any period of 12 months. Paragraph 6 requires a bank to establish a recovery time objective of not more than 4 hours for each critical system. Paragraph 9 requires a bank to implement IT controls to protect customer information from unauthorised access or disclosure.

The Notice is issued under section 29(1) of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. The Notice is effective from 10 May 2024.

Paragraph 4.1 of the Notice requires a bank to secure every administrative account on any operating system, database, application, security appliance or network device against unauthorised access or use. Paragraph 4.2(a) requires a bank to apply security patches to every system within a timeframe commensurate with the risk each vulnerability poses.

Paragraph 4.6 requires a bank to implement multi-factor authentication for administrative accounts on critical systems and for all accounts on any system it uses to access customer information through the internet. The Notice is issued under section 29(1) of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. The Notice takes effect on 10 May 2024.

Section 14(1) of the Act requires the owner of provider-owned critical information infrastructure to notify the Commissioner of Cybersecurity of a prescribed cybersecurity incident, in the prescribed form and manner and within the prescribed period after becoming aware of it. Regulation 5(1)(a) requires the owner to submit the first details of the incident within 2 hours after becoming aware of it.

Regulation 5(1)(b) requires supplementary details within 72 hours after becoming aware of the incident. Regulation 5(1)(c) requires a final incident report within 30 days, including any Sunday and public holiday, after the supplementary submission. Section 14(2) requires the owner to establish the mechanisms and processes for detecting cybersecurity threats and incidents that an applicable code of practice sets out.

Failing without reasonable excuse to comply with section 14(1) is an offence punishable by a fine of up to 100,000 Singapore dollars or imprisonment of up to 2 years or both. The first version of the Act in the statute database is dated 31 August 2018.

Section 16I(4) of the Act requires a designated provider responsible for third-party-owned critical information infrastructure to notify the Commissioner of a prescribed cybersecurity incident, in the prescribed form and manner and within the prescribed period after becoming aware of it. Section 16I(1) requires the provider to obtain a legally binding commitment from the infrastructure's owner to notify the provider of prescribed incidents within the prescribed period.

Section 16I(5) requires the provider to establish the mechanisms and processes for becoming aware of cybersecurity threats and incidents that an applicable code of practice sets out. Failing without reasonable excuse to comply with section 16I(4) is an offence punishable by a fine of up to 100,000 Singapore dollars or imprisonment of up to 2 years or both, and the section took effect on 31 October 2025.

Paragraph 7 of the Notice requires a bank to notify the Monetary Authority of Singapore as soon as possible, and not later than 1 hour, after discovering a relevant incident. Paragraph 8 requires the bank to submit a root cause and impact analysis report within 14 days of discovering the relevant incident, or a longer period the Authority allows.

The Notice defines a relevant incident as a system malfunction or IT security incident with a severe and widespread impact on the bank's operations or a material impact on its service to customers. The Notice is issued under section 29(1) of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. The Notice is effective from 10 May 2024.

The Code applies to Social Media Services designated or to be designated under section 45K(1) of the Broadcasting Act 1994; six services (Facebook, HardwareZone, Instagram, TikTok, X and YouTube) were designated when it took effect.

It requires a designated service to minimise all end-users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through published community guidelines and content moderation. Beyond that baseline, the Code requires additional measures for children, defined as anyone below 18.

Unless the service restricts child access entirely, a child's account must have age-appropriate default settings that are more restrictive than a general account, tools for the child or a parent or guardian to manage exposure and limit the visibility of and interaction with the account, and a clear warning before the child or parent opts out of those protective defaults.

A designated service must also use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.

The Code applies to App Distribution Services designated or to be designated under section 45K(1) of the Broadcasting Act 1994. It requires the provider of a designated service to minimise all users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through content guidelines and content moderation of the apps it distributes.

For children, defined as anyone below 18, the provider must have systems and processes, including age verification or another means of age assurance, so that a user's age or age range can be established with reasonable accuracy. Unless the service restricts children's access entirely, a child's account must have differentiated, more restrictive default settings.

Age assurance must be implemented consistently with the Personal Data Protection Act 2012's data-protection provisions and the Personal Data Protection Commission's guidelines on children's personal data, including data minimisation. A provider that has not yet implemented age assurance must submit an implementation plan and timeline to IMDA for its agreement. The provider must also use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.

Section 190 makes it a permitted use of a work, or of a protected performance or a recording of one, to make fair use of it. Section 191 lists the relevant matters for deciding fairness. These include the purpose and character of the use, including whether it is commercial or non-profit and educational, and the nature of the work. They also include the amount and substantiality of the portion used relative to the whole.

A further matter is the effect of the use on the potential market for, or value of, the work. The Act carries no separate quotation or news-summary exception, no headline-length or short-extract cap, and no press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates.

Whether reproducing a headline or a short extract from another outlet's reporting is a fair use turns on this general four-factor test, and no reported Singapore decision has applied it to a systematic news aggregator. Sections 190 and 191 fall outside the two carve-outs in the Act's own commencement clause, so they came into force with the rest of the Act on 21 November 2021.