Data Protection Monitor
Global Privacy & Data Protection Intelligence

Singapore (SG) · Module Detail

Singapore: Children & Vulnerable Groups

← Full Singapore overview Build report with Singapore Request deeper dive

#

Children's protections rest on PDPC advisory guidelines rather than statutory age-of-consent provisions, and dependent-adult protections are addressed only incidentally in breach-notification guidance.

Primary frameworkPDPC Advisory Guidelines on the PDPA for Children's Personal Data in the Digital Environment (non-statutory)
Supervisory authorityPersonal Data Protection Commission (PDPC)
Traffic-light rationale — AmberChildren's protections rest on PDPC advisory guidelines rather than statutory age-of-consent provisions, and dependent-adult protections are addressed only incidentally in breach-notification guidance.

Sub-modules (5)

Age VerificationAmber

No statutory age of consent; PDPC applies a 13-years-old practical threshold via guidance.

Claims (1):

  • The PDPA does not define 'child' or stipulate a statutory minimum age of consent; the PDPC applies a practical rule of thumb that a minor aged 13 or above typically has sufficient understanding to consent on their own behalf.

Minor Profiling BansAmber

Data-minimisation guidance limits children's profile visibility by default rather than imposing an outright profiling ban.

Claims (1):

  • PDPC guidance directs organisations handling children's personal data to adopt data minimisation policies, including ensuring that children's account information is not made public and searchable by default.

Education SettingsAmber

Education-context organisations may prefer parental consent even for 13-17 year-olds as a matter of prudence.

Claims (1):

  • In an education setting, an organisation may consider it more prudent to obtain parental consent for a 13-year-old rather than seeking the child's consent directly.

Dependent AdultsRed

Vulnerable-adult protection is addressed only within breach-notification guidance (adoption/vulnerable-individual cases), not as a standalone statutory regime.

Claims (1):

  • Where a data breach involves information related to adoption matters or the identification of vulnerable individuals, organisations should first notify the PDPC for guidance before notifying affected individuals.
Category narrative228 words

Protections for minors are guidance-based rather than statutory. <cite index="43-2">The PDPA does not define 'child' nor 'children'.</cite> <cite index="49-10">Unlike the GDPR, the PDPA does not stipulate a minimum age of consent, choosing to leave it to other general rules of law to determine the question of capacity;</cite> however, <cite index="41-1">the PDPC considers that a child between 13 and 17 may give valid consent when policies on collection, use, disclosure and withdrawal are readily understandable by them.</cite> <cite index="41-12">Where the child is below 13 years of age, the organisation must obtain consent from the child's parent or guardian.</cite> <cite index="41-6">Where an organisation has reason to believe that a child does not have sufficient understanding of the nature and consequences of giving consent, the organisation should obtain consent from the child's parent or guardian.</cite> <cite index="41-14,41-15">Organisations should adopt data minimisation policies to limit the collection and sharing of children's personal data, including ensuring that children's account information is not made public and searchable by default.</cite> <cite index="41-9">An organisation in an education setting may assess that it is more prudent to obtain consent from a parent of a 13-year-old rather than to directly seek the consent of a 13-year-old.</cite> On vulnerable adults, <cite index="21-12">where a data breach involves information related to adoption matters or the identification of vulnerable individuals, organisations should first notify the Commission for guidance on notifying affected individuals.</cite>

no periodic updates on record for this sub-brief

Sources and claims (5)
  1. ProbableInternational Association of Privacy Professionals — The PDPA does not define 'child' or stipulate a statutory minimum age of consent; the PDPC applies a practical rule of thumb that a minor aged 13 or above typically has sufficient understanding to consent on their own behalf.observed
  2. ProbablePersonal Data Protection Commission — Where a child is below 13 years of age, or where an organisation has reason to believe a child lacks sufficient understanding of the nature and consequences of consent, the organisation must obtain consent from the child's parent or guardian.observed
  3. ProbablePersonal Data Protection Commission — PDPC guidance directs organisations handling children's personal data to adopt data minimisation policies, including ensuring that children's account information is not made public and searchable by default.observed
  4. ProbablePersonal Data Protection Commission — In an education setting, an organisation may consider it more prudent to obtain parental consent for a 13-year-old rather than seeking the child's consent directly.observed
  5. ProbablePersonal Data Protection Commission — Where a data breach involves information related to adoption matters or the identification of vulnerable individuals, organisations should first notify the PDPC for guidance before notifying affected individuals.observed