Singapore

Section 377BE makes it an offence for any person to intentionally or knowingly distribute, or knowingly threaten to distribute, an intimate image or recording of another person without that person's consent, knowing or having reason to believe the distribution or threat will or is likely to cause humiliation, alarm or distress.

The section was inserted by the Criminal Law Reform Act 2019 (Act 15 of 2019); the specific day section 377BE itself came into operation is not confirmed in the primary text and so is not stated here.

Section 377BE(5)(b), most recently amended with effect from 17 August 2026, defines an intimate image or recording to include an image or recording in any form that has been altered or generated to appear to show a person's intimate depiction, excluding an image so altered or generated that no reasonable person would believe it depicts that person; the section's own illustration is a face copied and pasted onto another body to appear that the person engaged in a sexual act.

A person convicted is liable to imprisonment for up to 5 years, or a fine, or caning, or a combination, rising to a mandatory fine or caning alongside imprisonment where the depicted person is below 14 years of age.

Part 6A, added by the 2020 amendment, makes a data breach notifiable if it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale; an internal-only breach is deemed not notifiable.

The organisation must notify the PDPC as soon as practicable, and in any case no later than 3 calendar days after assessing the breach is notifiable, and must also notify each affected individual, subject to exceptions where technological measures render significant harm unlikely or a law-enforcement agency or the PDPC directs otherwise.

PDPA applies a single consent-based framework to all personal data processing by organisations in Singapore: collection, use, or disclosure requires consent or a Part 3 or Schedule exception, and the Act does not distinguish controller from processor by name, instead regulating organisations directly with pass-through duties on data intermediaries.

There is no statutory sensitive-category or biometric-specific tier; every category of personal data, including a faceprint or voiceprint, is regulated under this one uniform standard.

Section 26(1) bars an organisation from transferring personal data to a country or territory outside Singapore except in accordance with requirements ensuring a standard of protection comparable to the PDPA; the PDPC may grant exemptions on application under s.26(2) and (3). This is a comparability-based mechanism, not a flat prohibition or a data-localization mandate; the specific instruments accepted as satisfying comparable protection sit in PDPA Regulations not read.

Section 26 sits in the original 2012 Act's Part 6 (Care of Personal Data), which the Act's own consolidated text records as having commenced 2 July 2014 alongside the rest of Parts 3 to 7.

Part 5 grants a data subject the statutory rights of access (s.21) and correction (s.22) of their personal data; the Act's own consolidated commencement note records Part 5 as having commenced 2 July 2014 with the rest of Parts 3 to 7.

A data portability right, headed Part 6B and added by the Personal Data Protection (Amendment) Act 2020, does not appear anywhere in the Act's own table of contents on Singapore Statutes Online, which lists every Part from Part 1 through Part 10 and goes directly from Part 6A to Part 7 with no Part 6B heading between them, so no Part 6B data portability right is asserted here as a numbered Part of the Act.

That conflicts with a quotation elsewhere, in the enforcement instrument, which names Part 6B among the Parts whose contravention grounds a private right of action; that quotation is not independently verified against primary text, because Singapore Statutes Online serves only the table of contents at this URL and not the section body, so the conflict is left open rather than resolved either way. No distinct statutory deletion or erasure right was found in the table of contents structure surveyed.

The Personal Data Protection Commission (PDPC) is Singapore's supervisory authority. Financial penalties under s.48J, added by the 2020 amendment and commencing 1 October 2022, reach up to 10 percent of Singapore annual turnover for an organisation with turnover exceeding S$10 million (otherwise up to S$1 million), and up to S$200,000 for an individual, or up to 5 percent of turnover exceeding S$20 million.

Section 48O(1), also added by the 2020 amendment, gives a person who suffers loss or damage directly from a contravention of the Consent Obligation (Part 4), Access and Correction (Part 5), Care of Personal Data (Part 6), Notification of Data Breaches (Part 6A), or Data Portability (Part 6B) provisions a right of action for relief in civil proceedings; its own specific commencement date within the 2020 amendment was not independently isolated.

Section 3(1) makes it an offence for any person to knowingly cause a computer to perform any function for the purpose of securing access without authority to any program or data held in any computer, punishable on a first conviction by a fine not exceeding $5,000 or imprisonment not exceeding 2 years or both, and on a second or subsequent conviction by a fine not exceeding $10,000 or imprisonment not exceeding 3 years or both.

Where the offence causes damage, section 3(2) raises the penalty to a fine not exceeding $50,000 or imprisonment not exceeding 7 years or both. Access is unauthorised under section 2(5) where the person is not entitled to control access of that kind and has no consent from someone who is so entitled; no reported Singapore decision has tested whether reading a public, unauthenticated web page without defeating any access control falls within this offence. The Act commenced on 30 August 1993.

Section 244 makes it a permitted use for a person to copy a work or a recording of a protected performance for computational data analysis, or to prepare it for computational data analysis, including using the work as an example of a type of data to improve the functioning of a computer program (the Act's own illustration is training a computer program to recognise images), provided the copier does not use the copy for any other purpose, does not supply the copy except to verify the results or for collaborative research or study, and has lawful access to the material.

Section 244(2)(d)'s illustrations state that lawful access excludes access gained by circumventing paywalls or breaching a database's terms of use. Section 187 makes any contract term void to the extent it purports to exclude or restrict this permitted use, so a website's terms of service cannot override the exception, though they can still govern how the first copy was lawfully obtained. The Act carries no sui generis database right distinct from ordinary copyright protection.

Sections 187, 243 and 244 fall outside the two carve-outs in the Act's own commencement clause, so they came into force with the rest of the Act on 21 November 2021.

The Code applies to Social Media Services designated or to be designated under section 45K(1) of the Broadcasting Act 1994; six services (Facebook, HardwareZone, Instagram, TikTok, X and YouTube) were designated when it took effect.

It requires a designated service to minimise all end-users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through published community guidelines and content moderation. Beyond that baseline, the Code requires additional measures for children, defined as anyone below 18.

Unless the service restricts child access entirely, a child's account must have age-appropriate default settings that are more restrictive than a general account, tools for the child or a parent or guardian to manage exposure and limit the visibility of and interaction with the account, and a clear warning before the child or parent opts out of those protective defaults.

A designated service must also use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.

The Code applies to App Distribution Services designated or to be designated under section 45K(1) of the Broadcasting Act 1994. It requires the provider of a designated service to minimise all users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through content guidelines and content moderation of the apps it distributes.

For children, defined as anyone below 18, the provider must have systems and processes, including age verification or another means of age assurance, so that a user's age or age range can be established with reasonable accuracy. Unless the service restricts children's access entirely, a child's account must have differentiated, more restrictive default settings.

Age assurance must be implemented consistently with the Personal Data Protection Act 2012's data-protection provisions and the Personal Data Protection Commission's guidelines on children's personal data, including data minimisation. A provider that has not yet implemented age assurance must submit an implementation plan and timeline to IMDA for its agreement. The provider must also use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.

Section 190 makes it a permitted use of a work, or of a protected performance or a recording of one, to make fair use of it. Section 191 lists the relevant matters for deciding fairness. These include the purpose and character of the use, including whether it is commercial or non-profit and educational, and the nature of the work. They also include the amount and substantiality of the portion used relative to the whole.

A further matter is the effect of the use on the potential market for, or value of, the work. The Act carries no separate quotation or news-summary exception, no headline-length or short-extract cap, and no press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates.

Whether reproducing a headline or a short extract from another outlet's reporting is a fair use turns on this general four-factor test, and no reported Singapore decision has applied it to a systematic news aggregator. Sections 190 and 191 fall outside the two carve-outs in the Act's own commencement clause, so they came into force with the rest of the Act on 21 November 2021.