Data Protection Monitor
Global Privacy & Data Protection Intelligence

Singapore (SG) · Module Detail

Singapore: Data Subject Rights

← Full Singapore overview Build report with Singapore Request deeper dive

#

Access, correction and portability rights exist but there is no erasure right and no formal restriction-of-processing right analogous to GDPR Art 18.

Primary frameworkPersonal Data Protection Act 2012, as amended
Supervisory authorityPersonal Data Protection Commission (PDPC)
Traffic-light rationale — AmberAccess, correction and portability rights exist but there is no erasure right and no formal restriction-of-processing right analogous to GDPR Art 18.

Sub-modules (5)

Access RightAmber

Statutory access right limited to a one-year lookback window, subject to exceptions.

Claims (1):

  • Under Section 21 of the PDPA, individuals may request access to their personal data held by an organisation and information about its use or disclosure in the year preceding the request.

Rectification And ErasureRed

Correction right exists; no erasure/right-to-be-forgotten equivalent.

Claims (1):

  • The PDPA provides individuals a right to request correction of errors or omissions in their personal data under Section 22, but does not provide a right to request erasure or deletion of personal data.

Restriction And ObjectionAmber

No explicit restriction-of-processing right; functional equivalent is consent withdrawal.

Claims (1):

  • Individuals may withdraw consent for collection, use or disclosure of their personal data at any time, with reasonable notice, obliging the organisation to cease the relevant processing.

Data PortabilityAmber

Portability Obligation limited to electronic records and to recipients with a Singapore presence.

Claims (1):

  • The Data Portability Obligation requires organisations, upon request, to transmit an individual's data held in electronic form to another organisation with a presence in Singapore in a commonly used machine-readable format.

Deadlines And Response WindowsGreen

30-day response window for access/correction; 3-calendar-day breach notification window to PDPC post-determination.

Claims (2):

  • Organisations that cannot provide requested personal data or make a correction within 30 days of a request must inform the individual in writing within 30 days of the time by which they will respond.
  • Where a data breach is determined to be notifiable, notification to the PDPC must be made no later than three calendar days after the organisation determines the breach is notifiable.
Category narrative192 words

Data subject rights are narrower than under GDPR. <cite index="49-24">Section 21 of the PDPA allows an individual to request access to personal data held by an organization and to information concerning its use or disclosure in the preceding one year.</cite> <cite index="43-13">The PDPA does not provide data subjects with the right to request the erasure or deletion of their personal data.</cite> A Data Portability Obligation exists: <cite index="36-3">upon request, organisations must transmit the individual's data in their possession or under their control to another organisation in a commonly used machine-readable format,</cite> though <cite index="37-4,37-5">the porting organisation must determine whether a receiving organisation has a presence in Singapore, limiting the obligation to receiving organisations with a Singapore presence.</cite> Response deadlines are prescribed: <cite index="52-18">if the organisation is unable to provide the personal data or make the correction requested within 30 days after receiving the request, the organisation must inform the individual, in writing, within 30 days, of the time by which it will respond.</cite> <cite index="22-21,22-23">Notification to PDPC must be made no later than three calendar days after determining the breach is notifiable, with the deadline starting from the time of that determination.</cite>

no periodic updates on record for this sub-brief

Sources and claims (6)
  1. ProbableInternational Association of Privacy Professionals — Under Section 21 of the PDPA, individuals may request access to their personal data held by an organisation and information about its use or disclosure in the year preceding the request.observed
  2. ProbableInternational Association of Privacy Professionals — The PDPA provides individuals a right to request correction of errors or omissions in their personal data under Section 22, but does not provide a right to request erasure or deletion of personal data.observed
  3. ProbableInternational Association of Privacy Professionals — Individuals may withdraw consent for collection, use or disclosure of their personal data at any time, with reasonable notice, obliging the organisation to cease the relevant processing.observed
  4. ProbablePersonal Data Protection Commission — The Data Portability Obligation requires organisations, upon request, to transmit an individual's data held in electronic form to another organisation with a presence in Singapore in a commonly used machine-readable format.observed
  5. ProbablePersonal Data Protection Commission — Organisations that cannot provide requested personal data or make a correction within 30 days of a request must inform the individual in writing within 30 days of the time by which they will respond.observed
  6. ProbablePersonal Data Protection Commission — Where a data breach is determined to be notifiable, notification to the PDPC must be made no later than three calendar days after the organisation determines the breach is notifiable.observed