{"id":33,"date":"2026-09-02T06:31:21","date_gmt":"2026-09-02T06:31:21","guid":{"rendered":"https:\/\/legal.sg\/?post_type=docs&#038;p=33"},"modified":"2026-09-02T06:35:39","modified_gmt":"2026-09-02T06:35:39","slug":"pdpa","status":"publish","type":"docs","link":"https:\/\/legal.sg\/?docs=notes\/data-protection-and-cyber-regulation\/pdpa","title":{"rendered":"PDPA"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">PDPA Section 3&nbsp;<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Governs collection, use and disclosure of personal data by organisations<\/li>\n\n\n\n<li>PDPA could be thought of as balancing 1) rights of individuals to protect their personal data, and 2) needs of organisations<\/li>\n\n\n\n<li>There are no proprietary rights over personal data conferred, with usual laws applying.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">PDPA Section 2(1): <em>Interpretation<\/em><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Personal data<\/strong> is defined as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data about an identifiable individual<\/li>\n\n\n\n<li>Includes factual information and opinions<\/li>\n\n\n\n<li>Does not depend on whether the data is \u201ctrue\u201d<\/li>\n\n\n\n<li>Does not include various exclusions, such as business contact information.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>\u201cpersonal data\u201d means data, whether true or not, about an individual who can be identified \u2014<\/em><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><em>(a)<\/em><\/td><td><em>from that data; or<\/em><\/td><\/tr><tr><td><em>(b)<\/em><\/td><td><em>from that data and other information to which the organisation has or is likely to have access;<\/em><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Individual:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Natural person, living or deceased<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Organisation:&nbsp;<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Includes (non-exhaustively) any individual, company, association or body of persons regardless of where formed, recognised, resident or having an office\/place of business.<\/li>\n\n\n\n<li>Excludes individuals acting in a personal or domestic capacity or as an employee<\/li>\n\n\n\n<li>Excludes public agencies (covered under a separate framework\/law)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Data intermediaries:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Known as \u2018data processors\u2019 in other jurisdictions<\/li>\n\n\n\n<li>Organisations that processes personal data on behalf of another organisation<\/li>\n\n\n\n<li>Fewer obligations under the PDPA: only s 24, 25, 26C(3)(a) and 26E and Part 6B apply.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Data controllers (DCs)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not a defined term in the PDPA<\/li>\n\n\n\n<li>Refers to the organisation on whose behalf a DI is processing personal data<\/li>\n\n\n\n<li>Controls the purposes and sometimes the manner of processing<\/li>\n\n\n\n<li>Responsible for personal data processed on its behalf by the DI<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Collection, use and disclosure<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not defined in the PDPA<\/li>\n\n\n\n<li>Overlaps with the defined term \u201cprocessing:<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">PDPA Section 4(6): PDPA does not affect any authority, right, privilege or immunity conferred or obligation or limitation imposed, by or under the law (in event of inconsistency, provisions of other written law prevails)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Note:<\/strong> performance of a contractual obligation is not an excuse to contract out of the PDPA.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"1024\" src=\"http:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-1024x1024.png\" alt=\"\" class=\"wp-image-28\" style=\"aspect-ratio:1;width:508px;height:auto\" srcset=\"https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-1024x1024.png 1024w, https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-300x300.png 300w, https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-150x150.png 150w, https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-768x768.png 768w, https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-16x16.png 16w, https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2-50x50.png 50w, https:\/\/legal.sg\/wp-content\/uploads\/2026\/08\/image-2.png 1080w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Obligations of Organisations&nbsp;<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>[COLLECTION]<\/strong><strong>&nbsp;<\/strong><\/h2>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Purpose<\/strong> Limitation&nbsp;<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reasonable, appropriate, lawful, legitimate, relevant<\/li>\n\n\n\n<li><strong>Data minimisation is part of Purpose Limitation&nbsp;<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Consent<\/strong> Obligation (Legal Bases for Processing)<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>One of several legal bases under which organisations may collect, use and disclose personal data\n<ul class=\"wp-block-list\">\n<li>Consent and general deemed consent<\/li>\n\n\n\n<li>Deemed consent by contractual necessity<\/li>\n\n\n\n<li>Legal obligations\/authority under written law<\/li>\n\n\n\n<li>Vital interests of individuals<\/li>\n\n\n\n<li>Public matters<\/li>\n\n\n\n<li>Legitimate interests of organisations<\/li>\n\n\n\n<li>Business assess transactions<\/li>\n\n\n\n<li>Business improvement purposes and research<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Notification<\/strong> Obligation<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>[USE\/STORAGE\/CARE]<\/strong><strong>&nbsp;&nbsp;<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data Minimisation (Purpose Limitation)<\/li>\n\n\n\n<li><strong>Accuracy<\/strong><\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security<\/strong> requirements\n<ul class=\"wp-block-list\">\n<li>Protection<\/li>\n\n\n\n<li>Data Breach Notification<\/li>\n\n\n\n<li>Offence against misuse of personal data<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Transfer limitation&nbsp;<\/strong><\/li>\n\n\n\n<li><strong>Retention limitation<\/strong><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>[Disclosure]<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>How should disclosed personal data be protected?\n<ul class=\"wp-block-list\">\n<li>Requirements for outsourcing (use of data intermediaries)<\/li>\n\n\n\n<li>Transfer Limitation<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>[Disposal\/Deletion]<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Retention Limitation<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>PDPA Section 3&nbsp; PDPA Section 2(1): Interpretation Personal data is defined as: \u201cpersonal data\u201d means data, whether true or not, about an individual who can be identified \u2014 (a) from that data; or (b) from that data and other information to which the organisation has or is likely to have access; Individual: Organisation:&nbsp; Data intermediaries: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":31,"menu_order":1,"comment_status":"open","ping_status":"closed","template":"","doc_tag":[],"class_list":["post-33","docs","type-docs","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/docs\/33","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legal.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=33"}],"version-history":[{"count":1,"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/docs\/33\/revisions"}],"predecessor-version":[{"id":34,"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/docs\/33\/revisions\/34"}],"up":[{"embeddable":true,"href":"https:\/\/legal.sg\/index.php?rest_route=\/wp\/v2\/docs\/31"}],"wp:attachment":[{"href":"https:\/\/legal.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33"}],"wp:term":[{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/legal.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fdoc_tag&post=33"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}