--- title: "Singapore — Children & Vulnerable Groups | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/singapore/children-and-vulnerable-groups/ source_html: /jurisdictions/singapore/children-and-vulnerable-groups/index.html description: "Singapore — Children & Vulnerable Groups: children_and_vulnerable_groups Children & Vulnerable Groups 5 sub-modules 5 claims Amber ▾ # Children's protections rest on PDPC advisory guidelines rather than statutory age-" generated_at: 2026-10-25T04:46:50Z content_sha256: 86f3720868197e42b7f1798703711e5a9980243a660ad3dd8e017e5deac84bd8 generator: "fe-fleet/md-twin@1.0" --- # Singapore — Children & Vulnerable Groups | Data Protection Monitor ### D9Children & Vulnerable Groups5 sub-modules5 claimsAmber▾# Children's protections rest on PDPC advisory guidelines rather than statutory age-of-consent provisions, and dependent-adult protections are addressed only incidentally in breach-notification guidance. Primary framework PDPC Advisory Guidelines on the PDPA for Children's Personal Data in the Digital Environment (non-statutory) Supervisory authority [Personal Data Protection Commission (PDPC)](https://www.pdpc.gov.sg/) Traffic-light rationale — Amber Children's protections rest on PDPC advisory guidelines rather than statutory age-of-consent provisions, and dependent-adult protections are addressed only incidentally in breach-notification guidance. #### Sub-modules (5) #### Age VerificationAmber No statutory age of consent; PDPC applies a 13-years-old practical threshold via guidance. Claims (1): - The PDPA does not define 'child' or stipulate a statutory minimum age of consent; the PDPC applies a practical rule of thumb that a minor aged 13 or above typically has sufficient understanding to consent on their own behalf. #### Parental ConsentAmber Parental/guardian consent required below 13, or above 13 where understanding is doubted. Claims (1): - Where a child is below 13 years of age, or where an organisation has reason to believe a child lacks sufficient understanding of the nature and consequences of consent, the organisation must obtain consent from the child's parent or guardian. #### Minor Profiling BansAmber Data-minimisation guidance limits children's profile visibility by default rather than imposing an outright profiling ban. Claims (1): - PDPC guidance directs organisations handling children's personal data to adopt data minimisation policies, including ensuring that children's account information is not made public and searchable by default. #### Education SettingsAmber Education-context organisations may prefer parental consent even for 13-17 year-olds as a matter of prudence. Claims (1): - In an education setting, an organisation may consider it more prudent to obtain parental consent for a 13-year-old rather than seeking the child's consent directly. #### Dependent AdultsRed Vulnerable-adult protection is addressed only within breach-notification guidance (adoption/vulnerable-individual cases), not as a standalone statutory regime. Claims (1): - Where a data breach involves information related to adoption matters or the identification of vulnerable individuals, organisations should first notify the PDPC for guidance before notifying affected individuals. Category narrative 228 words Protections for minors are guidance-based rather than statutory. The PDPA does not define 'child' nor 'children'. Unlike the GDPR, the PDPA does not stipulate a minimum age of consent, choosing to leave it to other general rules of law to determine the question of capacity; however, the PDPC considers that a child between 13 and 17 may give valid consent when policies on collection, use, disclosure and withdrawal are readily understandable by them. Where the child is below 13 years of age, the organisation must obtain consent from the child's parent or guardian. Where an organisation has reason to believe that a child does not have sufficient understanding of the nature and consequences of giving consent, the organisation should obtain consent from the child's parent or guardian. Organisations should adopt data minimisation policies to limit the collection and sharing of children's personal data, including ensuring that children's account information is not made public and searchable by default. An organisation in an education setting may assess that it is more prudent to obtain consent from a parent of a 13-year-old rather than to directly seek the consent of a 13-year-old. On vulnerable adults, where a data breach involves information related to adoption matters or the identification of vulnerable individuals, organisations should first notify the Commission for guidance on notifying affected individuals. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/gdpr-matchup-singapores-personal-data-protection-act) — The PDPA does not define 'child' or stipulate a statutory minimum age of consent; the PDPC applies a practical rule of thumb that a minor aged 13 or above typically has sufficient understanding to consent on their own behalf.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-pdpa-for-children's-personal-data-in-the-digital-environment_mar24.pdf) — Where a child is below 13 years of age, or where an organisation has reason to believe a child lacks sufficient understanding of the nature and consequences of consent, the organisation must obtain consent from the child's parent or guardian.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-pdpa-for-children's-personal-data-in-the-digital-environment_mar24.pdf) — PDPC guidance directs organisations handling children's personal data to adopt data minimisation policies, including ensuring that children's account information is not made public and searchable by default.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-pdpa-for-children's-personal-data-in-the-digital-environment_mar24.pdf) — In an education setting, an organisation may consider it more prudent to obtain parental consent for a 13-year-old rather than seeking the child's consent directly.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/other-guides/guide-on-managing-and-notifying-data-breaches-under-the-pdpa-15-mar-2021.pdf) — Where a data breach involves information related to adoption matters or the identification of vulnerable individuals, organisations should first notify the PDPC for guidance before notifying affected individuals.observed 2026-07-29