--- title: "Singapore — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/singapore/data-subject-rights/ source_html: /jurisdictions/singapore/data-subject-rights/index.html description: "Singapore — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 6 claims Amber ▾ # Access, correction and portability rights exist but there is no erasure right and no formal restriction-of-proc" generated_at: 2026-10-25T04:46:50Z content_sha256: 37f2ea056696945362a3bbd52be7233e98ef277f5c5fe4596beaeabed8b59be8 generator: "fe-fleet/md-twin@1.0" --- # Singapore — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules6 claimsAmber▾# Access, correction and portability rights exist but there is no erasure right and no formal restriction-of-processing right analogous to GDPR Art 18. Primary framework Personal Data Protection Act 2012, as amended Supervisory authority [Personal Data Protection Commission (PDPC)](https://www.pdpc.gov.sg/) Traffic-light rationale — Amber Access, correction and portability rights exist but there is no erasure right and no formal restriction-of-processing right analogous to GDPR Art 18. #### Sub-modules (5) #### Access RightAmber Statutory access right limited to a one-year lookback window, subject to exceptions. Claims (1): - Under Section 21 of the PDPA, individuals may request access to their personal data held by an organisation and information about its use or disclosure in the year preceding the request. #### Rectification And ErasureRed Correction right exists; no erasure/right-to-be-forgotten equivalent. Claims (1): - The PDPA provides individuals a right to request correction of errors or omissions in their personal data under Section 22, but does not provide a right to request erasure or deletion of personal data. #### Restriction And ObjectionAmber No explicit restriction-of-processing right; functional equivalent is consent withdrawal. Claims (1): - Individuals may withdraw consent for collection, use or disclosure of their personal data at any time, with reasonable notice, obliging the organisation to cease the relevant processing. #### Data PortabilityAmber Portability Obligation limited to electronic records and to recipients with a Singapore presence. Claims (1): - The Data Portability Obligation requires organisations, upon request, to transmit an individual's data held in electronic form to another organisation with a presence in Singapore in a commonly used machine-readable format. #### Deadlines And Response WindowsGreen 30-day response window for access/correction; 3-calendar-day breach notification window to PDPC post-determination. Claims (2): - Organisations that cannot provide requested personal data or make a correction within 30 days of a request must inform the individual in writing within 30 days of the time by which they will respond. - Where a data breach is determined to be notifiable, notification to the PDPC must be made no later than three calendar days after the organisation determines the breach is notifiable. Category narrative 192 words Data subject rights are narrower than under GDPR. Section 21 of the PDPA allows an individual to request access to personal data held by an organization and to information concerning its use or disclosure in the preceding one year. The PDPA does not provide data subjects with the right to request the erasure or deletion of their personal data. A Data Portability Obligation exists: upon request, organisations must transmit the individual's data in their possession or under their control to another organisation in a commonly used machine-readable format, though the porting organisation must determine whether a receiving organisation has a presence in Singapore, limiting the obligation to receiving organisations with a Singapore presence. Response deadlines are prescribed: if the organisation is unable to provide the personal data or make the correction requested within 30 days after receiving the request, the organisation must inform the individual, in writing, within 30 days, of the time by which it will respond. Notification to PDPC must be made no later than three calendar days after determining the breach is notifiable, with the deadline starting from the time of that determination. no periodic updates on record for this sub-brief Evidence 6 Sources and claims (6) - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/gdpr-matchup-singapores-personal-data-protection-act) — Under Section 21 of the PDPA, individuals may request access to their personal data held by an organisation and information about its use or disclosure in the year preceding the request.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/gdpr-matchup-singapores-personal-data-protection-act) — The PDPA provides individuals a right to request correction of errors or omissions in their personal data under Section 22, but does not provide a right to request erasure or deletion of personal data.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/the-personal-data-protection-framework-in-singapore) — Individuals may withdraw consent for collection, use or disclosure of their personal data at any time, with reasonable notice, obliging the organisation to cease the relevant processing.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Legislation-and-Guidelines/Response-to-Feedback-for-3rd-Public-Consultation-on-Data-Portability-Innovation-200120.pdf) — The Data Portability Obligation requires organisations, upon request, to transmit an individual's data held in electronic form to another organisation with a presence in Singapore in a commonly used machine-readable format.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/Advisory-Guidelines-on-Enforcement-of-DP-Provisions_1oct2022.pdf) — Organisations that cannot provide requested personal data or make a correction within 30 days of a request must inform the individual in writing within 30 days of the time by which they will respond.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/report-data-breach) — Where a data breach is determined to be notifiable, notification to the PDPC must be made no later than three calendar days after the organisation determines the breach is notifiable.observed 2026-07-29