Personal Data Protection Act 2012 · 2020 Revised Edition · Part 5 · Access to and Correction of Personal Data
21. Access to personal data
Feedback & supportIn plain English
On request, an organisation must, as soon as reasonably possible, give an individual their personal data that it holds or controls. It must say how that data was or may have been used or disclosed within a year before the request. For example, it must withhold data whose release could reasonably be expected to threaten another person's safety or health.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Last amended by an amending law of 2020.
Subject to subsections (2), (3) and (4), on request of an individual, an organisation must, as soon as reasonably possible, provide the individual with —
personal data about the individual that is in the possession or under the control of the organisation; and
information about the ways in which the personal data mentioned in paragraph (a) has been or may have been used or disclosed by the organisation within a year before the date of the request.
An organisation is not required to provide an individual with the individual’s personal data or other information under subsection (1) in respect of the matters specified in the Fifth Schedule.
organisation
“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —(a)formed or recognised under the law of Singapore; or(b)resident, or having an office or a place of business, in Singapore;
Subject to subsection (3A), an organisation must not provide an individual with the individual’s personal data or other information under subsection (1) if the provision of that personal data or other information (as the case may be) could reasonably be expected to —
personal data
“personal data” means data, whether true or not, about an individual who can be identified —(a)from that data; or(b)from that data and other information to which the organisation has or is likely to have access;
threaten the safety or physical or mental health of an individual other than the individual who made the request;
cause immediate or grave harm to the safety or to the physical or mental health of the individual who made the request;
reveal personal data about another individual;
reveal the identity of an individual who has provided personal data about another individual and the individual providing the personal data does not consent to the disclosure of his or her identity; or
be contrary to the national interest.
Subsection (3)(c) and (d) does not apply to any user activity data about, or any user‑provided data from, the individual who made the request despite such data containing personal data about another individual.
user activity data
“user activity data”, in relation to an organisation, means personal data about an individual that is created in the course or as a result of the individual’s use of any product or service provided by the organisation;
An organisation must not inform any individual under subsection (1)(b) that the organisation has disclosed personal data about the individual to a prescribed law enforcement agency if the disclosure was made under this Act or any other written law without the individual’s consent.
prescribed law enforcement agency
“prescribed law enforcement agency” means an authority charged with the duty of investigating offences or charging offenders under written law, prescribed for the purposes of sections 21(4) and 26D(6) and the Second Schedule by the Minister charged with the responsibility for that authority;
If an organisation is able to provide the individual with the individual’s personal data and other information requested under subsection (1) without the personal data or other information excluded under subsections (2), (3) and (4), the organisation must provide the individual with access to the personal data and other information without the personal data or other information excluded under subsections (2), (3) and (4).
Where —
an individual makes a request under subsection (1) to an organisation on or after 1 February 2021; and
the organisation, by reason of subsection (2) or (3), does not provide an individual with the individual’s personal data or other information requested under subsection (1),the organisation must, within the prescribed time and in accordance with the prescribed requirements, notify the individual of the rejection.
Where —
an individual makes a request under subsection (1) to an organisation on or after 1 February 2021; and
the organisation provides the individual, in accordance with subsection (5), with the individual’s personal data or other information requested under subsection (1),the organisation must notify the individual of the exclusion, under subsection (2) or (3), of any of the personal data or other information so requested.