Data Protection Monitor
Global Privacy & Data Protection Intelligence

Singapore (SG) · Module Detail

Singapore: Lawful Processing & Special Data

← Full Singapore overview Build report with Singapore Request deeper dive

#

Consent-based model with wide statutory exemptions rather than an enumerated GDPR Art 6-style lawful-basis list, and no distinct special-category regime.

Primary frameworkPersonal Data Protection Act 2012, as amended
Supervisory authorityPersonal Data Protection Commission (PDPC)
Traffic-light rationale — AmberConsent-based model with wide statutory exemptions rather than an enumerated GDPR Art 6-style lawful-basis list, and no distinct special-category regime.

Sub-modules (4)

Lawful BasesAmber

Consent is the default basis, displaced by broad statutory exemption schedules functioning analogously to alternative lawful bases.

Claims (1):

  • Under Section 13 of the PDPA, collection, use or disclosure of personal data is prohibited unless the individual gives or is deemed to have given consent, subject to broad exemptions set out in the Second, Third and Fourth Schedules.

Special CategoriesAmber

No GDPR-style enumerated special category list; sensitivity is assessed contextually, with a dedicated national-ID-number regime functioning as a quasi-sensitive-identifier rule.

Claims (2):

  • Unlike the GDPR, the PDPA does not create a distinct statutory category of 'special' or sensitive personal data, instead relying on consent centrality and case-by-case sensitivity assessment by the PDPC.
  • Organisations may only collect, use or disclose NRIC numbers or copies of the NRIC (and equivalent national identification numbers) where required by law or necessary to verify identity to a high degree of accuracy.

Pseudonymisation And AnonymisationAmber

Anonymisation is protected via criminal offences for re-identification rather than a dedicated anonymisation safe-harbour standard.

Claims (1):

  • Part 9B of the PDPA creates offences for knowing or reckless unauthorised disclosure or wrongful use of personal data, and for re-identification of anonymised data.
Category narrative203 words

The PDPA is consent-centric but carves out very broad exemptions. <cite index="49-14,49-15,49-16">Consent is not required under the PDPA if the data processing falls within the purview of the Section 17 exemptions, which cover collection, use and disclosure without consent in circumstances set out in the Second, Third and Fourth Schedules.</cite> <cite index="49-6">The PDPA prohibits an organization from requiring an individual to consent to the collection, use or disclosure of personal data about the individual beyond what is reasonable to provide the product or service to that individual.</cite> Unlike the GDPR, <cite index="43-18">the PDPA does not distinguish specific categories of personal data, it does deem the consent of the individual as central and necessary before commencing data processing activities.</cite> A quasi-sensitive-identifier regime exists for national identification numbers: <cite index="80-2">private sector organisations are only allowed to collect, use or disclose NRIC numbers or copies of the NRIC if the collection, use or disclosure is required by the law, or it is necessary to establish or verify an individual's identity to a high degree of accuracy.</cite> Anonymisation is addressed through offence provisions: <cite index="99-19,99-20">Part 9B of the PDPA sets out offences that hold individuals accountable for egregious mishandling of personal data, including re-identification of anonymised data.</cite>

no periodic updates on record for this sub-brief

Sources and claims (5)
  1. ProbableInternational Association of Privacy Professionals — Under Section 13 of the PDPA, collection, use or disclosure of personal data is prohibited unless the individual gives or is deemed to have given consent, subject to broad exemptions set out in the Second, Third and Fourth Schedules.observed
  2. ProbableInternational Association of Privacy Professionals — The PDPA prohibits an organisation from requiring an individual, as a condition of providing a product or service, to consent to collection, use or disclosure of personal data beyond what is reasonable, and consent may be withdrawn at any time with immediate cessation of the relevant processing.observed
  3. ProbableOneTrust DataGuidance — Unlike the GDPR, the PDPA does not create a distinct statutory category of 'special' or sensitive personal data, instead relying on consent centrality and case-by-case sensitivity assessment by the PDPC.observed
  4. ProbablePersonal Data Protection Commission — Organisations may only collect, use or disclose NRIC numbers or copies of the NRIC (and equivalent national identification numbers) where required by law or necessary to verify identity to a high degree of accuracy.observed
  5. ProbablePersonal Data Protection Commission — Part 9B of the PDPA creates offences for knowing or reckless unauthorised disclosure or wrongful use of personal data, and for re-identification of anonymised data.observed