← Global Privacy Laws Research Library
Personal Data Protection Act 2012
Personal Data Protection Act 2012: Singapore
Prepared by Shubhank Suman · Last reviewed
Current. Singapore Statutes Online identifies a current version as of September 2026, including amendments through 2025. (AGC)
- Legal character
- National statute
- Region
- Asia-Pacific
What it covers
The PDPA provides Singapore's baseline general personal-data protection framework.
It regulates:
- collection
- use
- disclosure
- accountability
- consent
- notification
- accuracy
- protection
- retention
- overseas transfers
- access/correction
- breach notification.
The PDPC explicitly describes it as Singapore's baseline privacy standard, subject to sector-specific regimes. (IMDA PDPC)
AI, privacy and cybersecurity relevance
- AI: Moderate
- Privacy: Very High
- Cyber: Very High
AI
Moderate / indirect
The PDPA is not an AI Act and does not contain a general AI governance chapter.
Its relevance to AI arises because AI applications process personal data and must therefore comply with:
- purpose limitation
- consent/lawful processing
- security
- retention
- transfer
- accountability requirements.
For AI governance specifically, Singapore's Model AI Governance Framework is the separate relevant instrument.
Privacy
Very High
Key provisions include:
Sections 11–12: accountability Sections 13–17: consent and related collection/use/disclosure rules Section 18: purpose limitation Sections 21–22: access and correction Section 24: protection Section 25: retention Section 26: transfer outside Singapore Sections 26A–26E: data breaches.
The current Statutes Online version also records amendments through Act 19 of 2025. (AGC)
Cybersecurity
Very High
Section 24 requires reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal and loss of storage media/devices. (AGC)
Sections 26A–26D establish the statutory breach-notification framework.
Current validity
CURRENT
Read first
Sections 11–18 → Sections 21–26 → Sections 26A–26D → enforcement provisions.
Provisions / sections covered
Data portability
The PDPC currently identifies the data-portability obligation but notes that it will take effect when the relevant Regulations are issued. (IMDA PDPC)
Do not present data portability as an already operative general obligation merely because it appears in the Act.
Subject-matter tags
- Lawful basis
- Consent
- Data subject rights
- Data portability
- Data breach
- Cross-border transfers
- Data protection officer
- Retention
- Enforcement and penalties
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.