Everything We Need to Know about Singapore | Personal Data Rights, PDPA, Access Requests and Do Not Call Registry

Your name, phone number, home address, photograph, identity number and account details can reveal a great deal about you. Organisations collect personal data to provide services, process transactions, manage memberships and communicate with customers. Singapore’s Personal Data Protection Act (PDPA) sets rules for how many private-sector organisations collect, use and disclose personal data.

This guide explains what the PDPA does, when an organisation may collect personal data, how to ask for access or correction, what the Do Not Call Registry can stop, and what to do when you suspect misuse or a data breach. It is intended for everyday consumers, not privacy lawyers or corporate data-protection officers.

If you searched for PDPA Singapore, personal data rights, request my personal information, correct inaccurate data, stop marketing calls, Do Not Call Registry or report a data breach, start with the practical steps below. The PDPA contains exceptions and applies differently to organisations, public agencies and individuals acting in a personal or domestic capacity.

Quick answer: what can an individual do?

Ask why data is needed. An organisation should explain the purpose and obtain consent where required, unless an exception applies.
Read the privacy notice. Check what information is collected, how it is used and whether it may be shared.
Request access. You may ask an organisation for your personal data in its possession or control and information about how it has been used or disclosed in the preceding year, subject to exceptions.
Request correction. Ask an organisation to correct an error or omission in personal data it holds, subject to the law and exceptions.
Reduce telemarketing. Register your Singapore number with one or more of the Do Not Call registers for voice calls, text messages or fax messages.
Raise a concern. Contact the organisation’s Data Protection Officer first where appropriate, then consider a complaint to the Personal Data Protection Commission (PDPC).

What is personal data?

Personal data is information about an individual who can be identified from that data alone or together with other information to which an organisation has or is likely to have access. It can include obvious identifiers such as a name or NRIC number, but it can also include less obvious details when combined with other records.

A mobile number linked to a delivery account, a photograph linked to a membership profile, a vehicle number linked to a named owner or a customer-service recording linked to an account may be personal data. Whether a particular item qualifies depends on the context and whether the person is identifiable.

Who does the PDPA cover?

The PDPA’s data-protection obligations generally apply to private-sector organisations that collect, use or disclose personal data in Singapore, subject to the Act’s definitions and exceptions. The Act does not apply in the same way to public agencies. It also excludes individuals acting in a personal or domestic capacity, employees acting in the course of employment and other specified situations.

This means that a consumer’s complaint about a private retailer may raise PDPA issues, while a request involving a public agency may be governed by a different legal and administrative framework. Do not assume every organisation is covered by the same PDPA obligations.

What is consent, and can an organisation use data without asking?

Consent is an important part of the PDPA, but it is not the only lawful basis for every collection, use or disclosure. The Act contains exceptions and deemed-consent situations, such as certain uses that are reasonably necessary to provide a requested product or service, or other specified business and legal purposes.

For example, a delivery company may need your address to deliver an order. A clinic may need relevant information to provide care. A retailer may need transaction details to process a refund. This does not mean that any organisation can use the same information for an unrelated marketing purpose without considering the PDPA’s rules.

When the purpose is unclear, ask the organisation what data it needs and why. Be cautious when a form asks for identity details that do not appear necessary for the service. A request for more data than reasonably needed is a reason to ask questions, not proof by itself that an offence has occurred.

What is the purpose limitation obligation?

Organisations should collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances and that have been notified to the individual, unless an exception applies. This is why privacy notices matter: they help explain the intended use of the data.

A company that collected a phone number to contact you about an order should not assume that the information can be used for every unrelated activity. Check the notice and the consent or exception relied upon. Marketing communications are also subject to the PDPA’s Do Not Call provisions where applicable.

How do I ask an organisation for my personal data?

The Access Obligation generally requires an organisation to provide an individual with personal data about that individual in its possession or control, and information about how the organisation has used or disclosed that data during the preceding year, subject to exceptions.

Make the request in writing to the organisation’s Data Protection Officer or through its accepted privacy-request channel. Identify yourself sufficiently for the organisation to locate your records, specify the data requested and provide enough detail to make the search reasonable. For example, identify the account, transaction period, service location or interaction involved.

An organisation may charge a reasonable fee to respond to an access request in the circumstances permitted by the regulations. Some types of information are excluded, including certain evaluative material, references and other categories specified by law. The right is not an unlimited right to inspect every internal document or another person’s information.

How do I correct inaccurate personal data?

The Correction Obligation generally requires an organisation to correct an error or omission in personal data about an individual that is in its possession or control, subject to exceptions. The organisation may need to verify the correct information and understand the context before changing a record.

Write to the organisation and identify the exact field or statement that is incorrect. Explain the correction and provide evidence where appropriate. For example, a customer may need to update an old address, correct a misspelt name or amend an outdated contact number. Keep the request and the organisation’s response.

Not every disagreement is an error that must be removed. An organisation may need to preserve an accurate historical record, such as the address used for a completed transaction, while adding a correction or annotation for current use. Ask how the organisation will handle the correction and whether it will notify other organisations to which the data was disclosed where required.

What is a Data Protection Officer?

Organisations subject to the PDPA must designate at least one individual to oversee data-protection responsibilities and make the business contact information available to the public. The Data Protection Officer (DPO) may be an employee or another person appointed by the organisation. A small business may assign the role as part of an existing job, but it remains responsible for its obligations.

Look for a privacy or data-protection contact on the organisation’s website. Send a clear description of the issue and avoid including unnecessary sensitive information in the first email. Ask for a reference number and keep the correspondence.

What is the Do Not Call Registry?

The Do Not Call (DNC) Registry allows individuals to register Singapore telephone numbers to opt out of receiving specified marketing messages from organisations. There are three separate registers: No Voice Call, No Text Message and No Fax Message. You can choose one or more, depending on the type of telemarketing you want to stop.

Registration is free through the official DNC Registry website. The service verifies that you control the number, commonly through an OTP. The DNC rules generally require organisations to check the relevant register before sending specified marketing messages to a Singapore number, unless an exception applies, such as clear and unambiguous consent.

Register at the official DNC consumer registration page. A DNC registration does not block every call. It does not stop personal calls, service or transactional messages, messages covered by an applicable exception, or scam calls from criminals who ignore the law.

How long does DNC registration take?

The DNC Registry’s consumer page says registration takes about five minutes. The number must be verified. Allow time for the status to take effect according to the registry’s current rules; do not assume a telemarketer’s message sent immediately after registration is automatically proof of a breach.

If you continue to receive marketing messages, record the date, time, number or sender identity, organisation name and message content. Check whether the message is marketing, a service update or an exempt communication. You can then raise the issue with the organisation or PDPC using the relevant reporting route.

Does PDPA stop spam and scam messages?

No. The PDPA and DNC rules address how organisations handle personal data and specified telemarketing messages. Criminals may ignore these laws, spoof caller IDs or send messages from overseas. A number registered with DNC may still receive scam messages.

Do not click suspicious links or provide passwords and OTPs. Use official scam-reporting tools and contact your bank if you have disclosed financial credentials or authorised a suspicious transfer. Privacy rights reduce certain unwanted uses of information; they are not a substitute for scam prevention.

What if an organisation experiences a data breach?

A data breach may involve unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data. The organisation has obligations under the PDPA to assess the breach and notify PDPC and affected individuals where the notification criteria are met. Not every incident automatically requires public notification; the organisation must assess the nature and likely harm under the law.

If you are affected, follow the organisation’s instructions, change relevant passwords where appropriate, watch for suspicious contact and contact your bank if financial information may be involved. Be wary of follow-up messages claiming to help you recover exposed data or offering a paid “privacy protection” service.

How can I make a PDPA complaint?

Where appropriate, first contact the organisation’s DPO and give it a reasonable opportunity to address the matter. State what happened, what personal data is involved, what response you seek and any supporting documents. If you cannot resolve the concern, you may submit a complaint to PDPC through its official website.

PDPC assesses complaints according to the PDPA and its enforcement approach. It may seek information from the organisation and decide what regulatory action is appropriate. A complaint does not automatically result in compensation to the individual. If you suffered financial loss or have a separate contractual dispute, another legal or dispute-resolution route may also be relevant.

Practical privacy habits for everyday life

Do not post your full NRIC, passport, address or bank details publicly.
Check whether a form genuinely needs the information it requests.
Use unique passwords and multi-factor authentication for important accounts.
Review privacy settings and app permissions periodically.
Remove old accounts or update inaccurate contact details where appropriate.
Use the DNC Registry if you want to opt out of specified telemarketing calls or messages.
Keep a copy of access, correction and complaint requests.

Frequently asked questions

Can I ask a company what personal data it has about me?

Generally yes. The Access Obligation provides a right to request personal data in the organisation’s possession or control and certain use and disclosure information, subject to exceptions.

Can I make a company correct my name or address?

You can request correction of an error or omission in personal data. The organisation may verify the information and certain exceptions apply.

Can I demand that a company delete every record about me?

The PDPA does not create an unrestricted right to erase every record. Organisations may have legal, contractual or other grounds to retain information, subject to their obligations.

Does the DNC Registry block all calls?

No. It covers specified telemarketing messages. Service communications, certain consent-based messages and scam calls may still reach you.

Is DNC registration free?

Yes. Use the official DNC Registry website and verify the number.

Does PDPA apply to public agencies?

Public agencies are not covered by the PDPA in the same way as private-sector organisations. Other public-sector rules and safeguards apply.

Official sources and related eduKateSG reading

Editorial review: 6 November 2026. This is a general explanation, not legal advice. The PDPA contains exceptions and other sector-specific laws may also apply. Check PDPC’s current guidance and the statutory text for a particular request or complaint.

The useful conclusion

Good privacy practice begins with knowing what information an organisation needs and why. Use the access and correction routes when your records are incomplete or inaccurate, register your number with the relevant DNC registers if you wish to opt out of specified marketing messages and keep evidence when something goes wrong. The PDPA gives individuals useful rights, but it works best when people also protect their accounts and share personal information carefully.