{"id":788,"date":"2022-05-03T10:26:00","date_gmt":"2022-05-03T10:26:00","guid":{"rendered":"https:\/\/www.cookiebot.com\/en\/?p=788"},"modified":"2026-03-12T08:19:51","modified_gmt":"2026-03-12T08:19:51","slug":"singapore-pdpa","status":"publish","type":"post","link":"https:\/\/www.cookiebot.com\/us\/singapore-pdpa\/","title":{"rendered":"PDPA - Personal Data Protection Act Singapore"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-quick-summary\">Quick summary<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-pdpa-singapore-s-data-protection-law-in-brief\">PDPA \u2013 Singapore\u2019s data protection law, in brief<\/h3>\n\n\n\n<p>Singapore\u2019s Personal Data Protection Act (PDPA) is one of the veteran data privacy laws of the world. Passed in 2012 and fully effective since 2014, it predates the <a href=\"\/en\/gdpr\/\">EU\u2019s General Data Protection Regulation (GDPR)<\/a>&nbsp;and shares with the earlier <a href=\"\/en\/eu-privacy-laws\/\">EU ePrivacy Directive<\/a>&nbsp;some of the same requirements behind its personal data protection and governance.<\/p>\n\n\n\n<p>In short, Singapore\u2019s <strong>PDPA<\/strong>&nbsp;regulates the collection, use and disclosure of personal data in Singapore by <strong>giving enforceable rights to users<\/strong>, placing the <strong>responsibility of lawful data processing<\/strong>&nbsp;on the shoulders of websites, companies and organizations anywhere in the world that process personal data from inside Singapore, <strong>regulating the transfer of personal data outside of Singapore<\/strong>, and <strong>establishing the Personal Data Protection Commission (PDPC)<\/strong>&nbsp;as main enforcement authority.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4016\/kirill-petropavlov-vmgwpt9gpv0-unsplash.jpg?width=362&amp;\" alt=\"Aerial view of a a part of Singapore - Cookiebot\" width=\"770\" height=\"513\"\/><figcaption class=\"wp-element-caption\">Under Singapore\u2019s PDPA, consent from users must be obtained prior to personal data processing.<\/figcaption><\/figure>\n\n\n\n<p><strong>Singapore\u2019s PDPA quick breakdown \u2013<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Singapore's PDPA<\/strong>&nbsp;took full effect on July 2, 2014.<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;governs all collection, use and disclosure (e.g. sharing with third parties) of personal data from inside Singapore. It applies to any organization located anywhere in the world (websites, companies, associations etc.) that handle personal data from users located inside the territory of Singapore.<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;empowers users in Singapore with the right to give and revoke consent to the processing of their personal data, the right to access personal data already collected, and the right to correct inaccurate personal data.<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;defines consent as an informed action on part of the user, either affirmatively or deemed (implied).<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;defines personal data broadly as data about an individual who can be identified from that data or from other information that is accessible to an organization. However, the PDPC has decided that certain types of personal data are more sensitive in nature and requires a higher standard of protection.<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;establishes the Personal Data Protection Commission (PDPC) as its main authority, with responsibilities of enforcement, supervision, data privacy consultancy and government advisory.<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;prohibits transfers of personal data outside Singapore, unless the place of transfer is able to ensure the same level of data protection as under the Singapore PDPA.<\/li>\n\n\n\n<li><strong>Singapore's PDPA<\/strong>&nbsp;was amended in 2020 to include mandatory data breach notifications, an expanded deemed consent framework, exceptions to consent for legitimate interests, increased financial penalties for non-compliance and a new right to data portability for users inside Singapore.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4018\/mike-enerio-4hvcsdog0qi-unsplash.jpg?width=351&amp;\" alt=\"PDPA in Singapore protects individuals' personal data inside the territory of Singapore.\" width=\"770\" height=\"513\"\/><figcaption class=\"wp-element-caption\">Under Singapore\u2019s PDPA, consent is valid only if your website informs users of collection and purpose beforehand.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-singapore-s-pdpa-and-consent-obligation\">Singapore\u2019s PDPA and Consent Obligation<\/h3>\n\n\n\n<p>The <strong>consent obligation<\/strong>&nbsp;is a key part of Singapore\u2019s PDPA \u2013 a crucial compliance requirement that websites anywhere in the world processing personal data from users in Singapore must be aware of.<\/p>\n\n\n\n<p>In short, the consent obligation (spelled out in PDPA sections 13-17) means that <strong>your website is only allowed to handle personal data from users inside Singapore if users give, or is deemed to have given, their prior consent<\/strong>.<\/p>\n\n\n\n<p>Under Singapore\u2019s PDPA, consent can either be <strong>affirmative<\/strong>&nbsp;or <strong>deemed<\/strong>, meaning that <strong>if users have already been informed<\/strong>&nbsp;by you about your website\u2019s intended collection and purposes for collection, <strong>but have not opted out<\/strong>&nbsp;of the processing, you are safe to <strong>deem their inaction as consent<\/strong>.<\/p>\n\n\n\n<p>In general, for user consents to be valid under the PDPA \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>you must first <strong>inform users about your website\u2019s intended processing<\/strong>&nbsp;(collection, use or disclosure of their personal data),<\/li>\n\n\n\n<li>you must <strong>inform users about the purposes of processing<\/strong>, including any other purpose that the users haven\u2019t been informed about in the initial collection notification,<\/li>\n\n\n\n<li>you must <strong>notify users at or before the time of collection<\/strong>,<\/li>\n\n\n\n<li>users must be able to withdraw their consent at any given time,<\/li>\n\n\n\n<li>and you are not allowed to make consent conditional for providing a product or service.<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/www.pdpc.gov.sg\/-\/media\/Files\/PDPC\/PDF-Files\/Advisory-Guidelines\/AG-on-Key-Concepts\/Advisory-Guidelines-on-Key-Concepts-in-the-PDPA-(2-June-2020).pdf?la=en\" target=\"_blank\" rel=\"noreferrer noopener\">Read the PDPC Advisory Guidelines on PDPA consent and other key concepts (PDF)<\/a><\/p>\n\n\n\n<p>Let\u2019s say that your website uses cookies and trackers in order to receive analytics insights and statistics about its performance, or to show online advertisement. Most websites in the world do so, and usually through popular platforms like\u00a0<a href=\"\/en\/google-analytics-gdpr\/\">Google Analytics\u00a0<\/a>and\u00a0<a href=\"\/en\/hubspot-and-gdpr\/\">HubSpot<\/a>.<\/p>\n\n\n\n<p>Using cookies and trackers, <strong>especially third-party cookies<\/strong>&nbsp;from popular third-party services, means that your website collects and shares personal data, such as <strong>IP addresses<\/strong>, <strong>unique IDs<\/strong>, <strong>search<\/strong>&nbsp;and <strong>browser history<\/strong>&nbsp;and much more.<\/p>\n\n\n\n<p>If a visitor to your website is from inside Singapore, you are required to first obtain their consent before activating any of these cookies and trackers (any but the ones strictly necessary for the function of your domain).<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4019\/sven-scheuermeier-axsjbbyg4ic-unsplash.jpg?width=369&amp;\" alt=\"Gardens by the Bay in Singapore at night - Cookiebot\" width=\"770\" height=\"514\"\/><figcaption class=\"wp-element-caption\">Users in Singapore have the right to withdraw their consent easily and at any given time.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-scan-your-website-for-free-with-cookiebot-cmp\">Scan your website for free with Cookiebot CMP<\/h3>\n\n\n\n<p>Test to see which cookies and trackers are in use on your website, what kind of personal data they process and where in the world you send it to by using the<a href=\"\/en\/cookie-checker\/\">&nbsp;free Cookiebot GDPR compliance test<\/a>.<\/p>\n\n\n\n<p>Simply enter the URL of your website and receive a free scan of up to five subpages, detecting all cookies in operation on these pages.<\/p>\n\n\n\n<p>Most website owners and operators are surprised to find out that their domain hosts many more cookies, trackers and trojan horses than they thought, because \u2013<\/p>\n\n\n\n<p><strong>72% of all trackers<\/strong>&nbsp;on websites are secretly loaded by third-party cookies.<\/p>\n\n\n\n<p><strong>18% of cookies<\/strong>&nbsp;on websites are so-called trojan horses that hide as deep as within eight other trackers, making them undetectable without a powerful scanning technology.<\/p>\n\n\n\n<p><strong>50% of trojan trackers<\/strong>&nbsp;will change between repeated user visits, meaning they can have changed provider, purpose and be collecting totally different kinds of personal data than what the user initially consented to.<\/p>\n\n\n\n<p>Source: <a href=\"https:\/\/arxiv.org\/pdf\/2001.10248.pdf\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Beyond the Front Page<\/em><\/a>, a 2020 research paper on website cookies.<\/p>\n\n\n\n<p><a href=\"\/en\/partners\/hubspot\/\" rel=\"nofollow\">Using HubSpot? Get started with the Cookiebot CMP app for PDPA compliance<\/a><\/p>\n\n\n\n<p><a href=\"\/en\/google-consent-mode\/\">Get started with Google Consent Mode and Cookiebot CMP<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-singapore-s-pdpa-amended-in-2020\">Singapore\u2019s PDPA amended in 2020<\/h3>\n\n\n\n<p>On November 2, the Singapore Parliament <a href=\"https:\/\/iapp.org\/news\/a\/singapores-parliament-passes-pdpa-amendments\/\" target=\"_blank\" rel=\"noreferrer noopener\">passed an amendment bill<\/a>&nbsp;to the Personal Data Protection Act (PDPA). While the amendments await royal assent to become fully effective, the changes to the PDPA come with <strong>no grace period<\/strong>&nbsp;and websites will need to comply straight away once the amended PDPA takes effect.<\/p>\n\n\n\n<p>The new PDPA amendments include \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Deemed consent by notification<\/strong>&nbsp;\u2013 expanding the framework around deemed consent to include a requirement to notify users of new purposes for collection and enable users to opt out.<\/li>\n\n\n\n<li><strong>Mandatory data breach notification<\/strong>&nbsp;\u2013 requiring websites, companies and organizations to notify users and the PDPC of data breaches within three days.<\/li>\n\n\n\n<li><strong>Exception to consent for legitimate interests<\/strong>&nbsp;\u2013 organizations can rely on the exception provided by legitimate interests to collect, use or disclose personal data, but must follow the PDPC\u2019s advisory guidelines to do so.<\/li>\n\n\n\n<li><strong>Increased financial penalties<\/strong>&nbsp;\u2013 increasing the fine of non-compliance with PDPA to 10% of the annual turnover of the organization with an annual turnover exceeding $10 million, or $1 million, whichever is highest.<\/li>\n\n\n\n<li><strong>New data portability right<\/strong>&nbsp;\u2013 users in Singapore will be able to have collected data made portable and transferable to other organizations upon request.<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/sso.agc.gov.sg\/Bills-Supp\/37-2020\/Published\/20201005\/?DocDate=20201005\" target=\"_blank\" rel=\"noreferrer noopener\">Read the Personal Data Protection (Amendment) Bill 2020<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4020\/bna-ignacio-c8gvt2lmx94-unsplash.jpg?width=363&amp;\" alt=\"Person taking a photo of a street in Singapore - Cookiebot\" width=\"770\" height=\"433\"\/><figcaption class=\"wp-element-caption\">Under Singapore\u2019s PDPA, processing personal data without prior consent can result in fines up to $1 million.<\/figcaption><\/figure>\n\n\n\n<p>On November 20, following the passing of the PDPA amendments in Parliament, the Personal Data Protection Commission (PDPC) <a href=\"https:\/\/www.pdpc.gov.sg\/-\/media\/Files\/PDPC\/PDF-Files\/Advisory-Guidelines\/Draft-AG-on-Key-Provisions\/Draft-Advisory-Guidelines-on-Key-Provisions-of-the-PDP-(Amendment)-Bill-(20-Nov-2020).pdf?la=en\" target=\"_blank\" rel=\"noreferrer noopener\">issued a set of draft advisory guidelines<\/a>&nbsp;on key provisions of amendments that altogether clarify the changes and specify how to be in PDPA compliance going forward.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.pdpc.gov.sg\/-\/media\/Files\/PDPC\/PDF-Files\/Advisory-Guidelines\/Draft-AG-on-Key-Provisions\/Draft-Advisory-Guidelines-on-Key-Provisions-of-the-PDP-(Amendment)-Bill-(20-Nov-2020).pdf?la=en\" target=\"_blank\" rel=\"noreferrer noopener\">Read the PDPC\u2019s Draft Advisory Guidelines here (PDF)<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-pdpa-compliance-with-cookiebot-cmp\">PDPA compliance with Cookiebot CMP<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-cookiebot-cmp-automatically-controls-all-user-consent-on-your-website\">Cookiebot CMP automatically controls all user consent on your website<\/h3>\n\n\n\n<p><a href=\"\/\">Cookiebot CMP<\/a>&nbsp;is the world\u2019s leading consent management platform that ensures full compliance for your website with all major data privacy laws, such as <a href=\"\/en\/gdpr-cookies\/\">EU\u2019s GDPR<\/a>, <a href=\"\/en\/ccpa\/\">California\u2019s CCPA<\/a>, <a href=\"\/en\/lgpd\/\">Brazil\u2019s LGPD<\/a>, <a href=\"\/en\/popia\/\">South Africa\u2019s POPIA<\/a>&nbsp;and Singapore\u2019s PDPA.<\/p>\n\n\n\n<p>Built around a powerful scanner that detects all cookies and trackers in operation on your domain, our solution automatically manages all user consents on your website through highly customizable interfaces that meet all PDPA requirements on information, notification and consent.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4188\/new-banner-example-en.png\" alt=\"Cookie policy pop up banner - Cookiebot\" width=\"770\" height=\"513\"\/><figcaption class=\"wp-element-caption\">Cookiebot CMP consent banner meeting PDPA requirements and automatically ensuring your website\u2019s compliance.<\/figcaption><\/figure>\n\n\n\n<p>Using our CMP on your website gives you \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>auto-blocking of all cookies and trackers for true prior consent for users in Singapore<\/li>\n\n\n\n<li>granular consent interface for easy user consent to cookies<\/li>\n\n\n\n<li>cookie declaration for PDPA notification requirements, including provider, purpose, duration and type of each cookie<\/li>\n\n\n\n<li>automatic renewal of user consents<\/li>\n<\/ul>\n\n\n\n<p>If your website has users from Singapore,&nbsp;Cookiebot CMP&nbsp;will automatically geotarget their location and present the correct consent framework in compliance with the PDPA.<\/p>\n\n\n\n<p>With just a few lines of JavaScript on your website and installed directly from the cloud, <a href=\"\/\">Cookiebot CMP<\/a>&nbsp;gives you plug-and-play compliance with all major data privacy laws, including Singapore\u2019s PDPA.<\/p>\n\n\n\n<p><a href=\"https:\/\/admin.cookiebot.com\/signup\" target=\"_blank\" rel=\"noreferrer noopener\">Use Cookiebot CMP to be in compliance with the PDPA in Singapore<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-singapore-s-pdpa-in-detail\">Singapore\u2019s PDPA, in detail<\/h2>\n\n\n\n<p>Let\u2019s take a closer look at the different aspects of <strong>Singapore\u2019s Personal Data Protection Act (PDPA)<\/strong>&nbsp;\u2013 how personal data is defined, how consent is defined (with 2020 amendments) and how the PDPA regulations clarify compliance.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-singapore-s-pdpa-and-data-privacy-regime\">Singapore\u2019s PDPA and data privacy regime<\/h3>\n\n\n\n<p>Singapore was one of the first countries to implement a data privacy law that not only protects the collection and processing of personal data inside of its territory, but also puts enforceable responsibility on \u201corganizations\u201d (defined in the PDPA to include individuals, websites, companies, associations and more, located anywhere in the world).<\/p>\n\n\n\n<p>The PDPA, drafted in 2012 and in full effect since July 2014, also serves as a so-called \u201cspam law\u201d, establishing the <strong>Do Not Call (DNC) Registry<\/strong>&nbsp;that Singaporeans can use to opt-out of unsolicited marketing.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.pdpc.gov.sg\/Overview-of-PDPA\/The-Legislation\/Personal-Data-Protection-Act\/\" target=\"_blank\" rel=\"noreferrer noopener\">Learn more about the scope and objectives of the PDPA<\/a><\/p>\n\n\n\n<p>Even though the PDPA shares key provisions with the <a href=\"\/en\/eu-privacy-laws\/\">EU\u2019s ePrivacy Directive&nbsp;<\/a>and the later <a href=\"\/en\/gdpr\/\">GDPR<\/a>, Singapore is not recognized by the EU as having <a href=\"https:\/\/ec.europa.eu\/info\/law\/law-topic\/data-protection\/international-dimension-data-protection\/adequacy-decisions_en\/\" target=\"_blank\" rel=\"noreferrer noopener\">an adequate level of data protection&nbsp;<\/a>and ranks as a third country in regard to the flow of data between the two territories.<\/p>\n\n\n\n<p>Want to know more about Singapore\u2019s PDPA vs EU\u2019s GDPR?<\/p>\n\n\n\n<p>Take a look at Singapore\u2019s Personal Data Protection Commission (PDPC) <a href=\"https:\/\/www.pdpc.gov.sg\/-\/media\/Files\/PDPC\/PDF-Files\/EU-GDPR\/Broad-Comparison-of-the-PDPAs-Consent-Exceptions-with-EU-GDPRs-Legal-Bases-for-Processing-Personal-Data-1-Apr-2021.pdf?la=en\" target=\"_blank\" rel=\"noreferrer noopener\">handy infographic comparison of the PDPA and EU\u2019s GDPR<\/a>&nbsp;that details the differences between the two data privacy laws\u2019 consent requirements and exceptions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-personal-data-under-singapore-s-pdpa\">Personal data under Singapore\u2019s PDPA<\/h3>\n\n\n\n<p><strong>Personal data<\/strong>&nbsp;is defined in Singapore\u2019s Personal Data Protection Act very broadly as&nbsp;<em>\u201cdata, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organization has or is likely to have access,\u201d<\/em>&nbsp;including but not limited to \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Names, addresses, email addresses, telephone numbers,<\/li>\n\n\n\n<li>IP addresses, cookie identifiers, unique IDs, search history, browser history, device data, location data,<\/li>\n\n\n\n<li>Information about age, gender, race, health, sexual orientation, appearance, political and religious convictions.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4021\/sonnie-hiles-x2kkuahh64u-unsplash.jpg?width=366&amp;\" alt=\"Man taking a photo of the Gardens by the Bay in Singapore on his phone - Cookiebot\" width=\"770\" height=\"513\"\/><figcaption class=\"wp-element-caption\">Personal data is broadly defined under the PDPA, website cookies and IP addresses included.<\/figcaption><\/figure>\n\n\n\n<p><strong>Exempt from the PDPA<\/strong>&nbsp;is personal data entered into a business contract (defined instead as business contract information), personal data that is more than 100 years old and personal data about an individual, if the person has been dead for more than 10 years.<\/p>\n\n\n\n<p>Unlike EU\u2019s GDPR, Singapore\u2019s PDPA does not create a special category of sensitive personal data.<\/p>\n\n\n\n<p>However, the Personal Data Protection Commission (PDPC) <a href=\"https:\/\/www.pdpc.gov.sg\/-\/media\/Files\/PDPC\/PDF-Files\/Commissions-Decisions\/grounds-of-decision---aviva-ltd---111017.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">decided in October 2017<\/a>&nbsp;that certain kinds of personal data are of <strong>a sensitive nature<\/strong>&nbsp;and require <strong>a higher level of protection<\/strong>&nbsp;than other kinds of personal data.<\/p>\n\n\n\n<p>Examples of personal data of a sensitive nature includes \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Any kind of personal data about minors (individuals under the age of 21),<\/li>\n\n\n\n<li>Identification data (e.g. from passports and National Registration Identity Cards), <\/li>\n\n\n\n<li>Financial data (e.g. credit cards, bank accounts, payments and transactions),<\/li>\n\n\n\n<li>Insurance data (e.g. policy, sums, premiums),<\/li>\n\n\n\n<li>Certain sensitive medical data,<\/li>\n\n\n\n<li>Certain criminal data on prior drug use.<\/li>\n<\/ul>\n\n\n\n<p>If your website, company or organization processes personal data of a more sensitive nature from users inside Singapore, the PDPC requires you to <strong>implement security safeguards appropriate to the sensitivity of the information<\/strong>.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.pdpc.gov.sg\/-\/media\/Files\/PDPC\/PDF-Files\/Commissions-Decisions\/grounds-of-decision---aviva-ltd---111017.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Read the PDPC\u2019s October 2017 decision on sensitive personal data (PDF)<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-singapore-s-pdpa-consent-obligations-and-its-2020-amendments\">Singapore\u2019s PDPA consent obligations and its 2020 amendments<\/h3>\n\n\n\n<p>In November 2020, Singapore amended the PDPA to include, among other things, a more detailed set of specifications on how <strong>deemed consent<\/strong>&nbsp;works.<\/p>\n\n\n\n<p><strong>Deemed consent<\/strong>&nbsp;is the valid type of consent that means that the <strong>inaction of users constitutes a form of implied consent<\/strong>. However, users must still be able to revoke their consent at any given time, even though the consent is deemed.<\/p>\n\n\n\n<p>In the PDPA <strong>before the 2020 amendment<\/strong>&nbsp;(section 15), deemed consent works like this \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A website must, before any collection, use or disclosure of personal data, determine whether their collection, use or disclosure is likely to have an adverse effect on the individual.<\/li>\n\n\n\n<li>A website must then inform the individual about its intention to collect, use or disclose their personal data, the purpose for which the personal data will be collected, used or disclosed, as well as enable the individual to not give their consent and in so doing opt-out of having their personal data collected, used or disclosed.<\/li>\n<\/ul>\n\n\n\n<p>The <strong>new and amended PDPA<\/strong>&nbsp;(section 15A) expands the consent obligations to include <strong>deemed consent by notification<\/strong>, meaning that \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Websites, companies and organizations can collect, use or disclose personal data if the individual does not make clear that they don\u2019t consent. However, it is now required that some form of notification is shown to the individual about the collection of their personal data and given an opportunity to <strong>not<\/strong>&nbsp;give their consent.<\/li>\n\n\n\n<li>If users don\u2019t express their dissent towards their personal data being collected, used or disclosed by a website, the website is allowed to start collection, use and disclosure (e.g. transferring data to Google or Facebook) based on <strong>deemed consent<\/strong>, i.e. that the website can deem that the user \u2013 by not explicitly dissenting or opting out of the collection \u2013 is okay with the collection.<\/li>\n<\/ul>\n\n\n\n<p>The PDPA\u2019s <strong>deemed consent by notification<\/strong>&nbsp;is close to the previous EU personal data protection regime under the <a href=\"\/en\/eu-privacy-laws\/\">ePrivacy Directive<\/a>, which also allowed for the implied consent of EU users. This, however, has been effectively ruled out by the <a href=\"https:\/\/edpb.europa.eu\/\" target=\"_blank\" rel=\"noreferrer noopener\">European Data Protection Board (EDPB)<\/a>&nbsp;based on the newer <a href=\"\/en\/gdpr-cookies\/\">GDPR\u2019s requirement for valid consent<\/a>&nbsp;to consist of an affirmative, explicit action on part of the user.<\/p>\n\n\n\n<p><a href=\"\/en\/gdpr-cookies\/\">Learn more about GDPR compliance with Cookiebot CMP<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter is-resized is-style-cb-rounded\"><img loading=\"lazy\" decoding=\"async\" src=\"\/media\/4022\/lily-banse-mjxf6po0tws-unsplash.jpg?width=366&amp;\" alt=\"Singapore skyline at night - Cookiebot\" width=\"770\" height=\"513\"\/><figcaption class=\"wp-element-caption\">Under PDPA, consent cannot be conditional for providing a product or service, such as access to a website.<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-singapore-s-pdpa-regulations\">Singapore\u2019s PDPA regulations<\/h3>\n\n\n\n<p>The Personal Data Protection Regulations of 2014 clarify the practical aspect of how websites and organizations are supposed to set up their PDPA compliance.<\/p>\n\n\n\n<p>In short, the PDPA regulations \u2013<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>specify that <strong>requests<\/strong>&nbsp;(to gain access or to correct or to dissent from further personal data collection) <strong>must be made by users in writing<\/strong><\/li>\n\n\n\n<li>clarify that websites, companies and organizations receiving requests from users must <strong>respond within 30 days<\/strong><\/li>\n\n\n\n<li>make it clear that organizations may charge <strong>a fee in exchange<\/strong>&nbsp;for processing requests from users<\/li>\n\n\n\n<li>explain the rules around <strong>international transfers<\/strong>&nbsp;of personal data outside of Singapore<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/sso.agc.gov.sg\/SL\/PDPA2012-S362-2014\/?ValidDate=20200601&amp;ProvIds=P1I-\" target=\"_blank\" rel=\"noreferrer noopener\">Read the Personal Data Protection Regulations 2014<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-summary-singapore-s-pdpa\">Summary: Singapore\u2019s PDPA<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-pdpa-compliance-with-cookiebot-cmp-0\">PDPA compliance with Cookiebot CMP<\/h3>\n\n\n\n<p>Singapore\u2019s Personal Data Protection Act (PDPA) is one of the world\u2019s strong data privacy laws that requires your website, if it has visitors from inside Singapore, to comply with its obligations for obtaining user consent, giving timely user notifications and enabling users to request access to and correction of already collected personal data.<\/p>\n\n\n\n<p>Cookiebot CMP is the world\u2019s leading solution for cookie control and consent management, offering plug-and-play compliance with all major data privacy laws such as EU\u2019s GDPR, California\u2019s CCPA, Brazil\u2019s LGPD, South Africa\u2019s POPIA \u2013 and Singapore\u2019s PDPA.<\/p>\n\n\n\n<p>Sign-up for free to Cookiebot CMP today for all-round, fully automatic data privacy compliance.<\/p>\n\n\n\n<p>Try a free limited scan of your website to see what cookies are in operation, what kinds of personal data your website collects and where it sends data to.<\/p>\n\n\n\n\n\n\n","protected":false},"excerpt":{"rendered":"<p>Quick summary PDPA \u2013 Singapore\u2019s data protection law, in brief Singapore\u2019s Personal Data Protection Act (PDPA) is one of the veteran data privacy laws of the world. Passed in 2012 and fully effective since 2014, it predates the EU\u2019s General Data Protection Regulation (GDPR)&nbsp;and shares with the earlier EU ePrivacy Directive&nbsp;some of the same requirements [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":795,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":true,"editor_notices":[],"footnotes":""},"categories":[1],"tags":[],"class_list":["post-788","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":[],"thumbnail_status":false,"thumbnail_url":"https:\/\/www.cookiebot.com\/us\/wp-content\/uploads\/sites\/8\/2022\/05\/1024px-flag_of_singapore-frame_1200x630_ffffff.png","_links":{"self":[{"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/posts\/788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/comments?post=788"}],"version-history":[{"count":0,"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/posts\/788\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/media\/795"}],"wp:attachment":[{"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/media?parent=788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/categories?post=788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cookiebot.com\/us\/wp-json\/wp\/v2\/tags?post=788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}