PDPA Compliance with ConsentX

The Personal Data Protection Act 2012 (PDPA) is Singapore's data protection law governing the collection, use and disclosure of personal data by organizations.

Organizations undertaking activities involving the collection, use or disclosure of personal data in Singapore generally need to comply with the PDPA's data protection obligations, subject to applicable exceptions.

The PDPA contains a Consent Obligation requiring organizations to obtain an individual's consent before collecting, using or disclosing personal data for a purpose, unless an applicable exception or alternative basis under the Act applies.

An individual must be notified of the purposes for which their personal data will be collected, used or disclosed and provide consent for those purposes. The PDPC also recognizes different forms of consent, including consent that is recorded in writing or otherwise accessible.

Yes. Organizations must allow individuals to withdraw consent with reasonable notice and should inform them of the likely consequences of withdrawal.

The PDPA is not simply a cookie-consent law. Its requirements apply to personal data and the collection, use and disclosure of that data. Where cookies, trackers or similar technologies involve personal data, organizations should assess the applicable PDPA requirements and consent obligations.

Yes. Singapore's PDPA includes obligations relating to access and correction of personal data, subject to applicable conditions and exceptions.

Yes. Organizations transferring personal data outside Singapore must comply with the PDPA's Transfer Limitation Obligation and ensure that the transferred personal data receives a standard of protection comparable to that required under the PDPA.

Organizations are expected to demonstrate responsibility for personal data in their possession or control, including implementing appropriate policies, practices and processes for data protection.

ConsentX provides technology that can support important PDPA privacy operations, including consent management, purpose-based choices, consent withdrawal, tracker discovery, prior-script blocking, consent evidence and access-request workflows. However, ConsentX does not by itself guarantee compliance. Organizations must assess their complete data-processing activities, policies, contracts, security controls and other obligations under the PDPA.