What is Singapore's PDPA?

The Personal Data Protection Act 2012 (PDPA) is Singapore's data protection law governing the collection, use and disclosure of personal data by organizations.

Who needs to comply with the PDPA?

Organizations undertaking activities involving the collection, use or disclosure of personal data in Singapore generally need to comply with the PDPA's data protection obligations, subject to applicable exceptions.

Does the PDPA require consent?

The PDPA contains a Consent Obligation requiring organizations to obtain an individual's consent before collecting, using or disclosing personal data for a purpose, unless an applicable exception or alternative basis under the Act applies.

What makes consent valid under Singapore's PDPA?

An individual must be notified of the purposes for which their personal data will be collected, used or disclosed and provide consent for those purposes. The PDPC also recognizes different forms of consent, including consent that is recorded in writing or otherwise accessible.

Can individuals withdraw consent?

Yes. Organizations must allow individuals to withdraw consent with reasonable notice and should inform them of the likely consequences of withdrawal.

Does the PDPA apply to cookies?

The PDPA is not simply a cookie-consent law. Its requirements apply to personal data and the collection, use and disclosure of that data. Where cookies, trackers or similar technologies involve personal data, organizations should assess the applicable PDPA requirements and consent obligations.

Does the PDPA provide access and correction rights?

Yes. Singapore's PDPA includes obligations relating to access and correction of personal data, subject to applicable conditions and exceptions.

Does the PDPA regulate overseas data transfers?

Yes. Organizations transferring personal data outside Singapore must comply with the PDPA's Transfer Limitation Obligation and ensure that the transferred personal data receives a standard of protection comparable to that required under the PDPA.

What is the Accountability Obligation?

Organizations are expected to demonstrate responsibility for personal data in their possession or control, including implementing appropriate policies, practices and processes for data protection.

Singapore

PDPA Compliance with ConsentX

Simplify PDPA Consent & Privacy Management

ConsentX helps organizations operationalize Singapore's Personal Data Protection Act (PDPA) with meaningful consent management, purpose-based privacy controls, tracker discovery, consent enforcement, data-request workflows and tamper-evident consent records.

Singapore's PDPA establishes a framework for the collection, use, disclosure and protection of personal data by organizations. ConsentX helps businesses make privacy choices transparent, enforce consent across their websites and maintain evidence of user decisions.

Region

Singapore

Status

In force

Group

Asia-Pacific

Who it applies to

Singapore's PDPA generally applies to organizations that collect, use or disclose personal data in Singapore, subject to the Act's scope and applicable exceptions.

Organizations are required to comply with the PDPA's data protection obligations when undertaking activities involving personal data.

Key obligations

Obtain and manage consent
Notify individuals of the purposes for collecting, using and disclosing personal data
Limit collection, use and disclosure to appropriate purposes
Allow individuals to withdraw consent
Provide access and correction rights
Keep personal data accurate and complete where required
Protect personal data with appropriate security safeguards
Limit retention of personal data
Comply with requirements for overseas transfers
Demonstrate accountability for personal data protection

Singapore's PDPA establishes nine main data-protection obligations covering these areas.

How ConsentX helps

Access & Correction Requests

Help privacy teams organize and manage personal data requests through structured workflows.

Geo-Aware Compliance

Apply Singapore-specific privacy rules while managing requirements across multiple jurisdictions.

Tracker & Technology Discovery

Use xScan-AI to discover cookies, trackers, scripts and third-party technologies operating across your website.

Prior-Script Blocking

Prevent configured non-essential cookies, trackers and scripts from firing before the appropriate consent decision is obtained.

Meaningful Consent Management

Create clear consent experiences that explain why personal data is being collected, used or disclosed.

Consent Withdrawal

Make it easier for individuals to change or withdraw their consent.

Consent Records & Audit Evidence

Maintain tamper-evident records of consent decisions, including:

Purpose-Based Consent

Configure consent around specific purposes instead of relying on broad or unclear consent requests.

Disclaimer: This page is a plain-English summary for general informational purposes and is not legal advice. The application of Singapore's PDPA depends on the organization's activities, data-processing practices and applicable exemptions. Confirm your specific obligations with qualified privacy counsel.

PDPA Compliance, Made Practical

DiscoverNotifyCapture ConsentEnforceRecordRespond

ConsentX helps privacy, legal, marketing and technology teams manage consent and privacy controls across digital experiences while maintaining evidence of individual choices.

Start Free Book a Demo

Frequently asked questions

ConsentX provides technology that can support important PDPA privacy operations, including consent management, purpose-based choices, consent withdrawal, tracker discovery, prior-script blocking, consent evidence and access-request workflows. However, ConsentX does not by itself guarantee compliance. Organizations must assess their complete data-processing activities, policies, contracts, security controls and other obligations under the PDPA.