Personal Data Protection Act 2012

In this Act, unless the context otherwise requires —

“advisory committee” means an advisory committee appointed under section 7;

“Appeal Committee” means a Data Protection Appeal Committee constituted under section 48P(4), read with the Seventh Schedule;

“Appeal Panel” means the Data Protection Appeal Panel established by section 48P(1);

“authorised officer”, in relation to the exercise of any power or performance of any function or duty under any provision of this Act, means a person to whom the exercise of that power or performance of that function or duty under that provision has been delegated under section 38 of the Info‑communications Media Development Authority Act 2016;

“Authority” means the Info‑communications Media Development Authority established by section 3 of the Info‑communications Media Development Authority Act 2016;

“benefit plan” means an insurance policy, a pension plan, an annuity, a provident fund plan or other similar plan;

“business” includes the activity of any organisation, whether or not carried on for purposes of gain, or conducted on a regular, repetitive or continuous basis, but does not include an individual acting in his or her personal or domestic capacity;

“business contact information” means an individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his or her personal purposes;

“Chief Executive”, in relation to the Authority, means the Chief Executive of the Authority appointed under section 40(2) of the Info‑communications Media Development Authority Act 2016, and includes any individual acting in that capacity;

“Commission” means the person designated as the Personal Data Protection Commission under section 5 to be responsible for the administration of this Act;

“Commissioner” means the Commissioner for Personal Data Protection appointed under section 8(1)(a), and includes any Deputy Commissioner for Personal Data Protection or Assistant Commissioner for Personal Data Protection appointed under section 8(1)(b);

“credit bureau” means an organisation which —

“credit report” means a communication, whether in written, oral or other form, provided to an organisation to assess the creditworthiness of an individual in relation to a transaction between the organisation and the individual;

“data intermediary” means an organisation which processes personal data on behalf of another organisation but does not include an employee of that other organisation;

“derived personal data” —

“document” includes information recorded in any form;

“domestic” means related to home or family;

“education institution” means an organisation that provides education, including instruction, training or teaching, whether by itself or in association or collaboration with, or by affiliation with, any other person;

“employee” includes a volunteer;

“employment” includes working under an unpaid volunteer work relationship;

“evaluative purpose” means —

“individual” means a natural person, whether living or deceased;

“inspector” means an individual appointed as an inspector under section 8(1)(b);

“investigation” means an investigation relating to —

“national interest” includes national defence, national security, public security, the maintenance of essential services and the conduct of international affairs;

“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —

“personal data” means data, whether true or not, about an individual who can be identified —

“prescribed healthcare body” means a healthcare body prescribed for the purposes of the Second Schedule by the Minister charged with the responsibility for health;

“prescribed law enforcement agency” means an authority charged with the duty of investigating offences or charging offenders under written law, prescribed for the purposes of sections 21(4) and 26D(6) and the Second Schedule by the Minister charged with the responsibility for that authority;

“private trust” means a trust for the benefit of one or more designated individuals who are the settlor’s friends or family members;

“proceedings” means any civil, criminal or administrative proceedings by or before a court, tribunal or regulatory authority that is related to the allegation of —

“processing”, in relation to personal data, means the carrying out of any operation or set of operations in relation to the personal data, and includes any of the following:

“public agency” includes —

“publicly available”, in relation to personal data about an individual, means personal data that is generally available to the public, and includes personal data which can be observed by reasonably expected means at a location or an event —

“relevant body” means the Commission, the Appeal Panel or any Appeal Committee;

“tribunal” includes a judicial or quasi‑judicial body or a disciplinary, an arbitral or a mediatory body;

“user activity data”, in relation to an organisation, means personal data about an individual that is created in the course or as a result of the individual’s use of any product or service provided by the organisation;

“user‑provided data”, in relation to an organisation, means personal data provided by an individual to the organisation.

The Minister may, by notification in the Gazette, specify any statutory body established under a public Act for a public function to be a public agency for the purposes of this Act.

Parts 3, 4, 5, 6, 6A and 6B do not impose any obligation on —

Parts 3, 4, 5, 6 (except sections 24 and 25), 6A (except sections 26C(3)(a) and 26E) and 6B do not impose any obligation on a data intermediary in respect of its processing of personal data on behalf of and for the purposes of another organisation pursuant to a contract which is evidenced or made in writing.

An organisation has the same obligation under this Act in respect of personal data processed on its behalf and for its purposes by a data intermediary as if the personal data were processed by the organisation itself.

This Act does not apply in respect of —

Except where business contact information is expressly mentioned, Parts 3, 4, 5, 6 and 6A do not apply to business contact information.

Unless otherwise expressly provided in this Act —

The Info‑communications Media Development Authority is designated as the Personal Data Protection Commission.

The Personal Data Protection Commission is responsible for the administration of this Act.

The Minister may appoint one or more advisory committees to provide advice to the Commission with regard to the performance of any of its functions under this Act.

The Commission may consult such advisory committees in relation to the performance of its functions and duties and the exercise of its powers under this Act but is not bound by such consultation.

The Commission may appoint, by name or office, from among public officers and the employees of the Authority —

Where any function, duty or power of the Commission under this Act is delegated to the Commissioner under section 38 of the Info‑communications Media Development Authority Act 2016 —

In exercising any of the powers of enforcement under this Act, an authorised officer must on demand produce to the person against whom he or she is acting the authority issued to him or her by the Commission.

An individual appointed under section 8(1) or an employee of the Authority, who is authorised in writing by the Chief Executive of the Authority for the purpose of this section, may conduct, with the authorisation of the Public Prosecutor, proceedings in respect of an offence under this Act.

A legal counsel of the Commission who is an advocate and solicitor may —

For the purposes of section 59, a cooperation agreement is an agreement for the purposes of —

A cooperation agreement may include provisions —

The Commission must not provide any information to a foreign data protection body pursuant to a cooperation agreement unless it requires of, and obtains from, that body an undertaking in writing by it that it will comply with terms specified in that requirement, including terms that correspond to the provisions of any written law concerning the disclosure of that information by the Commission.

The Commission may give an undertaking to a foreign data protection body that it will comply with terms specified in a requirement made of the Commission by the foreign data protection body to give such an undertaking where —

In this section —

“foreign data protection body” means a body in whom there are vested functions under the law of another country or territory with respect to the enforcement or the administration of provisions of law of that country or territory concerning data protection;

“regulatory authority” includes the Commission and any foreign data protection body.

In meeting its responsibilities under this Act, an organisation must consider what a reasonable person would consider appropriate in the circumstances.

An organisation is responsible for personal data in its possession or under its control.

An organisation must designate one or more individuals to be responsible for ensuring that the organisation complies with this Act.

An individual designated under subsection (3) may delegate to another individual the responsibility conferred by that designation.

An organisation must make available to the public the business contact information of at least one of the individuals designated under subsection (3) or delegated under subsection (4).

Without limiting subsection (5), an organisation is deemed to have satisfied that subsection if the organisation makes available the business contact information of any individual mentioned in subsection (3) in any prescribed manner.

The designation of an individual by an organisation under subsection (3) does not relieve the organisation of any of its obligations under this Act.

An individual has not given consent under this Act for the collection, use or disclosure of personal data about the individual by an organisation for a purpose unless —

An organisation must not —

Any consent given in any of the circumstances in subsection (2) is not validly given for the purposes of this Act.

In this Act, references to consent given, or deemed to have been given, by an individual for the collection, use or disclosure of personal data about the individual include consent given, or deemed to have been given, by any person validly acting on that individual’s behalf for the collection, use or disclosure of such personal data.

An individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation for a purpose if —

If an individual gives, or is deemed to have given, consent to the disclosure of personal data about the individual by one organisation to another organisation for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal data for that particular purpose by that other organisation.

Without limiting subsection (2) and subject to subsection (9), an individual (P) who provides personal data to an organisation (A) with a view to P entering into a contract with A is deemed to consent to the following where reasonably necessary for the conclusion of the contract between P and A:

Where an organisation collects personal data disclosed to it by B under subsection (3)(c), subsection (3)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (3)(a).

Subsections (3) and (4) apply to personal data provided before 1 February 2021 by an individual to an organisation with a view to the individual entering into a contract with the organisation —

Without limiting subsection (2) and subject to subsection (9), an individual (P) who enters into a contract with an organisation (A) and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following:

Where an organisation collects personal data disclosed to it by B under subsection (6)(c), subsection (6)(b) and (c) applies to the organisation as if the personal data were disclosed by A to the organisation under subsection (6)(a).

Subsections (6) and (7) apply to personal data provided before 1 February 2021 by an individual to an organisation in relation to a contract that the individual entered into before that date with the organisation, and which remains in force on that date, as if subsections (6) and (7) —

Subsections (3), (4), (5), (6), (7) and (8) do not affect any obligation under the contract between P and A that specifies or restricts —

This section applies to the collection, use or disclosure of personal data about an individual by an organisation on or after 1 February 2021.

Subject to subsection (3), an individual is deemed to consent to the collection, use or disclosure of personal data about the individual by an organisation if —

Subsection (2) does not apply to the collection, use or disclosure of personal data about the individual for any prescribed purpose.

For the purposes of subsection (2)(a), the organisation must, before collecting, using or disclosing any personal data about the individual —

The organisation must, in respect of the assessment mentioned in subsection (4)(a) —

On giving reasonable notice to the organisation, an individual may at any time withdraw any consent given, or deemed to have been given under this Act, in respect of the collection, use or disclosure by that organisation of personal data about the individual for any purpose.

On receipt of the notice mentioned in subsection (1), the organisation concerned must inform the individual of the likely consequences of withdrawing his or her consent.

An organisation must not prohibit an individual from withdrawing his or her consent to the collection, use or disclosure of personal data about the individual, but this section does not affect any legal consequences arising from such withdrawal.

Subject to section 25, if an individual withdraws consent to the collection, use or disclosure of personal data about the individual by an organisation for any purpose, the organisation must cease (and cause its data intermediaries and agents to cease) collecting, using or disclosing the personal data (as the case may be) unless such collection, use or disclosure (as the case may be) without the individual’s consent is required or authorised under this Act or other written law.

An organisation may —

Unless otherwise provided under this Act, an organisation may —

For the purposes of sections 14(1)(a) and 18(b), an organisation must inform the individual of —

An organisation, on or before collecting personal data about an individual from another organisation without the individual’s consent, must provide the other organisation with sufficient information regarding the purpose of the collection to allow that other organisation to determine whether the disclosure would be in accordance with this Act.

Subsection (1) does not apply if —

Despite subsection (3), an organisation must comply with subsection (5) on or before collecting, using or disclosing personal data about an individual for the purpose of or in relation to the organisation —

For the purposes of subsection (4), the organisation must inform the individual of the following:

Subject to subsections (2), (3) and (4), on request of an individual, an organisation must, as soon as reasonably possible, provide the individual with —

An organisation is not required to provide an individual with the individual’s personal data or other information under subsection (1) in respect of the matters specified in the Fifth Schedule.

Subject to subsection (3A), an organisation must not provide an individual with the individual’s personal data or other information under subsection (1) if the provision of that personal data or other information (as the case may be) could reasonably be expected to —

Subsection (3)(c) and (d) does not apply to any user activity data about, or any user‑provided data from, the individual who made the request despite such data containing personal data about another individual.

An organisation must not inform any individual under subsection (1)(b) that the organisation has disclosed personal data about the individual to a prescribed law enforcement agency if the disclosure was made under this Act or any other written law without the individual’s consent.

If an organisation is able to provide the individual with the individual’s personal data and other information requested under subsection (1) without the personal data or other information excluded under subsections (2), (3) and (4), the organisation must provide the individual with access to the personal data and other information without the personal data or other information excluded under subsections (2), (3) and (4).

Where —

Where —

An individual may request an organisation to correct an error or omission in the personal data about the individual that is in the possession or under the control of the organisation.

Unless the organisation is satisfied on reasonable grounds that a correction should not be made, the organisation must —

An organisation (not being a credit bureau) may, if the individual consents, send the corrected personal data only to specific organisations to which the personal data was disclosed by the organisation within a year before the date the correction was made.

When an organisation is notified under subsection (2)(b) or (3) of a correction of personal data, the organisation must correct the personal data in its possession or under its control unless the organisation is satisfied on reasonable grounds that the correction should not be made.

If no correction is made under subsection (2)(a) or (4), the organisation must annotate the personal data in its possession or under its control with the correction that was requested but not made.

Nothing in this section requires an organisation to correct or otherwise alter an opinion, including a professional or an expert opinion.

An organisation is not required to comply with this section in respect of the matters specified in the Sixth Schedule.

Where —

The organisation must ensure that the copy of the personal data it preserves for the purposes of subsection (1) is a complete and accurate copy of the personal data concerned.

An organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under this Act to ensure that organisations provide a standard of protection to personal data so transferred that is comparable to the protection under this Act.

The Commission may, on the application of any organisation, by written notice exempt the organisation from any requirement prescribed pursuant to subsection (1) in respect of any transfer of personal data by that organisation.

An exemption under subsection (2) —

The Commission may at any time add to, vary or revoke any condition imposed under this section.

“affected individual” means any individual to whom any personal data affected by a data breach relates;

“data breach”, in relation to personal data, means —

A data breach is a notifiable data breach if the data breach —

Without limiting subsection (1)(a), a data breach is deemed to result in significant harm to an individual —

Without limiting subsection (1)(b), a data breach is deemed to be of a significant scale —

Despite subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.

This section applies to a data breach that occurs on or after 1 February 2021.

Subject to subsection (3), where an organisation has reason to believe that a data breach affecting personal data in its possession or under its control has occurred, the organisation must conduct, in a reasonable and expeditious manner, an assessment of whether the data breach is a notifiable data breach.

Where a data intermediary (other than a data intermediary mentioned in section 26E) has reason to believe that a data breach has occurred in relation to personal data that the data intermediary is processing on behalf of and for the purposes of another organisation —

The organisation must carry out the assessment mentioned in subsection (2) or (3)(b) in accordance with any prescribed requirements.

Where an organisation assesses, in accordance with section 26C, that a data breach is a notifiable data breach, the organisation must notify the Commission as soon as is practicable, but in any case no later than 3 calendar days after the day the organisation makes that assessment.

Subject to subsections (5), (6) and (7), on or after notifying the Commission under subsection (1), the organisation must also notify each affected individual affected by a notifiable data breach mentioned in section 26B(1)(a) in any manner that is reasonable in the circumstances.

The notification under subsection (1) or (2) must contain, to the best of the knowledge and belief of the organisation at the time it notifies the Commission or affected individual (as the case may be), all the information that is prescribed for this purpose.

The notification under subsection (1) must be made in the form and submitted in the manner required by the Commission.

Subsection (2) does not apply to an organisation in relation to an affected individual if the organisation —

An organisation must not notify any affected individual in accordance with subsection (2) if —

The Commission may, on the written application of an organisation, waive the requirement to notify an affected individual under subsection (2) subject to any conditions that the Commission thinks fit.

An organisation is not, by reason only of notifying the Commission under subsection (1) or an affected individual under subsection (2), to be regarded as being in breach of —

Subsections (1) and (2) apply concurrently with any obligation of the organisation under any other written law to notify any other person (including any public agency) of the occurrence of a data breach, or to provide any information relating to a data breach.

In this Part, unless the context otherwise requires —

“calling line identity” means the telephone number or information identifying the sender;

“checker” means a person mentioned in section 43A(1);

“financial services” has the meaning given by section 2 of the Consumer Protection (Fair Trading) Act 2003;

“goods” means any personal property, whether tangible or intangible, and is deemed to include —