Key Facts
Overview
Singapore's PDPA takes a pragmatic, less prescriptive approach compared to EU-style laws. There is no specific cookie consent mandate. However, cookies collecting personal data are subject to the PDPA's consent and notification obligations. The 2021 amendments raised penalties to 10% of turnover and introduced a deemed consent framework.
What This Means for Your Website
- No specific cookie banner mandate exists, but cookies collecting personal data require consent
- The deemed consent framework allows organizations to infer consent in certain situations
- DPO appointment is mandatory from June 2025
- Breach notification to PDPC is required within 3 calendar days
- Data portability obligations phase in from April-June 2025
- Penalties reach 10% of annual turnover in Singapore
Key Requirements
The PDPC enforces the PDPA with penalties up to 10% of Singapore turnover (minimum SGD 1 million). Criminal penalties include SGD 5,000 and/or 2 years imprisonment for egregious mishandling. Consumer requests must be fulfilled within 30 days. The 2024 amendment adds obligations for data processors and enhanced breach notification from June 2025.
How ConsentStack Handles This
ConsentStack applies Singapore's pragmatic consent model for Singaporean visitors, supporting both explicit and deemed consent approaches as appropriate.
Penalties
Up to 10% of annual turnover in Singapore (minimum SGD 1 million). Criminal: up to SGD 5,000 and/or 2 years.
Key Requirements
- Consent for collection, use, or disclosure of personal data (with deemed consent exceptions)
- Notification of purposes for data collection
- Mandatory breach notification to PDPC within 3 calendar days
- DPO appointment mandatory
- Data portability obligations from April-June 2025
- Cross-border transfers with adequate safeguards
Notable Provisions
- No specific cookie consent mandate, less prescriptive than GDPR
- Deemed consent framework allows inferred consent in certain situations
- 10% turnover penalties from 2021 amendments
- Data portability and DPO obligations effective 2025
Data Subject Rights
Complain to the organisation through the process it must have for complaints about how it applies the Act, and on request get information about that process and its data protection policies and practices; the Act sets no response period.
Withdraw any consent you gave, or are deemed to have given, to the collection, use or disclosure of your personal data at any time on reasonable notice; the organisation must explain the likely consequences and then stop unless the law permits it without consent, and the Act sets no response period.
Obtain the personal data an organisation holds or controls about you and how it was or may have been used or disclosed in the year before your request, subject to the Act's exceptions and a reasonable fee; if it cannot respond within the set period it must tell you in writing when it will.
Ask an organisation to correct an error or omission in your personal data; unless it has reasonable grounds not to, it must correct it for free and send the correction to organisations it disclosed it to in the past year, or else annotate it, and tell you in writing when it will act if it cannot in the set period.
Add your Singapore telephone number to the Do Not Call Register, or by notice withdraw your consent to a sender's marketing calls and messages to that number at any time, after which the sender must stop within the prescribed period.
If an organisation refuses, or fails within a reasonable time, to give you access to or correct your personal data, or charges you a fee for either, apply to the Personal Data Protection Commission to review it; the Commission may confirm the refusal or fee, or direct access, correction or a refund.
Complain to the Personal Data Protection Commission about how an organisation handled your personal data; it may investigate, refer the complaint to mediation, or direct you and the organisation to try to resolve it.
Other Asia Pacific Regulations
Frequently Asked Questions
Stay compliant with Singapore PDPA
ConsentStack helps you implement Opt-out consent for Singapore automatically.