--- title: "Singapore — Lawful Processing & Special Data | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/singapore/lawful-processing-and-special-data/ source_html: /jurisdictions/singapore/lawful-processing-and-special-data/index.html description: "Singapore — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 5 claims Amber ▾ # Consent-based model with wide statutory exemptions rather than an enumerated GD" generated_at: 2026-10-25T04:46:50Z content_sha256: 0d577cdcdeba097dd60214f70c2f1def9a26518ea4ce22e98a466b08af654772 generator: "fe-fleet/md-twin@1.0" --- # Singapore — Lawful Processing & Special Data | Data Protection Monitor ### D2Lawful Processing & Special Data4 sub-modules5 claimsAmber▾# Consent-based model with wide statutory exemptions rather than an enumerated GDPR Art 6-style lawful-basis list, and no distinct special-category regime. Primary framework Personal Data Protection Act 2012, as amended Supervisory authority [Personal Data Protection Commission (PDPC)](https://www.pdpc.gov.sg/) Traffic-light rationale — Amber Consent-based model with wide statutory exemptions rather than an enumerated GDPR Art 6-style lawful-basis list, and no distinct special-category regime. #### Sub-modules (4) #### Lawful BasesAmber Consent is the default basis, displaced by broad statutory exemption schedules functioning analogously to alternative lawful bases. Claims (1): - Under Section 13 of the PDPA, collection, use or disclosure of personal data is prohibited unless the individual gives or is deemed to have given consent, subject to broad exemptions set out in the Second, Third and Fourth Schedules. #### Consent ThresholdsGreen Consent must not be bundled beyond what is reasonable and is freely revocable with immediate effect. Claims (1): - The PDPA prohibits an organisation from requiring an individual, as a condition of providing a product or service, to consent to collection, use or disclosure of personal data beyond what is reasonable, and consent may be withdrawn at any time with immediate cessation of the relevant processing. #### Special CategoriesAmber No GDPR-style enumerated special category list; sensitivity is assessed contextually, with a dedicated national-ID-number regime functioning as a quasi-sensitive-identifier rule. Claims (2): - Unlike the GDPR, the PDPA does not create a distinct statutory category of 'special' or sensitive personal data, instead relying on consent centrality and case-by-case sensitivity assessment by the PDPC. - Organisations may only collect, use or disclose NRIC numbers or copies of the NRIC (and equivalent national identification numbers) where required by law or necessary to verify identity to a high degree of accuracy. #### Pseudonymisation And AnonymisationAmber Anonymisation is protected via criminal offences for re-identification rather than a dedicated anonymisation safe-harbour standard. Claims (1): - Part 9B of the PDPA creates offences for knowing or reckless unauthorised disclosure or wrongful use of personal data, and for re-identification of anonymised data. Category narrative 203 words The PDPA is consent-centric but carves out very broad exemptions. Consent is not required under the PDPA if the data processing falls within the purview of the Section 17 exemptions, which cover collection, use and disclosure without consent in circumstances set out in the Second, Third and Fourth Schedules. The PDPA prohibits an organization from requiring an individual to consent to the collection, use or disclosure of personal data about the individual beyond what is reasonable to provide the product or service to that individual. Unlike the GDPR, the PDPA does not distinguish specific categories of personal data, it does deem the consent of the individual as central and necessary before commencing data processing activities. A quasi-sensitive-identifier regime exists for national identification numbers: private sector organisations are only allowed to collect, use or disclose NRIC numbers or copies of the NRIC if the collection, use or disclosure is required by the law, or it is necessary to establish or verify an individual's identity to a high degree of accuracy. Anonymisation is addressed through offence provisions: Part 9B of the PDPA sets out offences that hold individuals accountable for egregious mishandling of personal data, including re-identification of anonymised data. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/gdpr-matchup-singapores-personal-data-protection-act) — Under Section 13 of the PDPA, collection, use or disclosure of personal data is prohibited unless the individual gives or is deemed to have given consent, subject to broad exemptions set out in the Second, Third and Fourth Schedules.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/gdpr-matchup-singapores-personal-data-protection-act) — The PDPA prohibits an organisation from requiring an individual, as a condition of providing a product or service, to consent to collection, use or disclosure of personal data beyond what is reasonable, and consent may be withdrawn at any time with immediate cessation of the relevant processing.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_singapore_2022_july_update.pdf) — Unlike the GDPR, the PDPA does not create a distinct statutory category of 'special' or sensitive personal data, instead relying on consent centrality and case-by-case sensitivity assessment by the PDPC.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-for-nric-numbers---310818.pdf) — Organisations may only collect, use or disclose NRIC numbers or copies of the NRIC (and equivalent national identification numbers) where required by law or necessary to verify identity to a high degree of accuracy.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf) — Part 9B of the PDPA creates offences for knowing or reckless unauthorised disclosure or wrongful use of personal data, and for re-identification of anonymised data.observed 2026-07-29