Law note · Singapore

Personal Data Protection Act, enforcement and private right of action

cite Personal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020 stage IN FORCE in force since 2022-10-01 kind Enforcement supervision binds private bodies reviewed 2026-08-29

What it requires

An app processing the personal data of an individual in Singapore must be prepared to answer to the PDPC for a Part 4 through 6B violation, facing a financial penalty of up to 10 percent of Singapore annual turnover for a serious contravention, and an individual harmed by such a violation may bring a civil claim for relief directly.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Private right of action: Yes

What we found

The Personal Data Protection Commission (PDPC) is Singapore's supervisory authority. Financial penalties under s.48J, added by the 2020 amendment and commencing 1 October 2022, reach up to 10 percent of Singapore annual turnover for an organisation with turnover exceeding S$10 million (otherwise up to S$1 million), and up to S$200,000 for an individual, or up to 5 percent of turnover exceeding S$20 million.

Section 48O(1), also added by the 2020 amendment, gives a person who suffers loss or damage directly from a contravention of the Consent Obligation (Part 4), Access and Correction (Part 5), Care of Personal Data (Part 6), Notification of Data Breaches (Part 6A), or Data Portability (Part 6B) provisions a right of action for relief in civil proceedings; its own specific commencement date within the 2020 amendment was not independently isolated this pass.

Primary source

official statute text, Singapore Statutes Online (SSO)

← Back to the example · Lint your app →