Singapore

The statutory obligations for legal grounds, notices, and data subject rights in Singapore are necessary to ensure the effective protection of consumer privacy and, at the same time, the usefulness of data for companies under the Personal Data Protection Act 2012 (PDPA), regulated by the PDPC. Under the PDPA, the consent of an individual or implied is the legal basis for processing of data; however, companies may process data without consent using the specific exceptions like Legitimate Interests Exception provided the company conducts a risk assessment first. The Notification Obligation helps companies to give consumers notices that will provide an explanation of the specific reason for which data is collected before processing it. On the other hand, the Act gives consumers powerful data subject rights that will allow them legally to access their personal data records within the previous year, to correct errors urgently, to withdraw consent after giving adequate notice, and to use the Data Portability Right that allows them to move their data from one platform to another. Violation of the data subject rights and notice provisions will lead to heavy penalties for companies, up to 10% of their local annual turnover.

The mandatory data breach notification obligation in Singapore is a strict legislative requirement outlined in Part 6A of the PDPA and entails the systematic review of security breaches by private companies [PDPC]. Imposed by the PDPC, this legislation states that if an organisation becomes aware of a security incident, it must conduct a review within 30 days [PDPC]. Data breach notification is required if there is an effect on 500 or more individuals and the breach poses significant harm to those who have been affected (in terms of leaked credit card details, passwords, or NRIC numbers) [PDPC]. The data breach then becomes a notifiable one, and the company will have a very strict regulatory deadline in that it must notify PDPC as soon as possible but no later than 3 days after such conclusion [PDPC]. Individuals whose information has been compromised must also receive such a notice at the same time unless their information is encrypted [PDPC]. Non-compliance with the above results in strict penalties up to 10% of turnover in Singapore.