Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Scam Alert

NHG Health will never ask you over the phone to transfer money, disclose bank log-in details or for your account passwords, PIN or OTP. Call the ScamShield Helpline at 1799 or visit www.scamshield.gov.sg (opens in new tab) to check if you are unsure.

NHG-REDCap Helpdesk

Personal Data Protection Act (PDPA)

Learn how Singapore's PDPA governs the collection, use, and disclosure of personal data, balancing individual rights with organisational needs.

Last updated on 1 July 2026

The purpose of Singapore's Personal Data Protection Act is to govern the collection, use and disclosure of personal data by organizations in a manner that recognizes both the right of individuals to protect their personal data, and the need of organizations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances.

PERSONAL DATA refers to data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which the organization has or is likely to have access.

This includes unique identifiers (e.g. NRIC number, passport number), as well as any set of data (e.g. name, age, address, telephone number, occupation, etc) which when taken together would be able to identify the individual.

Researchers should note that the scope of PDPA only applies to identifiable data. The PDPA does not apply to data that is used in anonymized form.

The PDPA takes into account the following concepts:

  • Consent – organizations may collect, use or disclose personal data only with the individual's knowledge and consent (with some exceptions);

  • Purpose – organizations may collect, use or disclose personal data in an appropriate manner for the circumstances, and only if they have informed the individual of purposes for the collection, use or disclosure; and

  • Reasonableness – organizations may collect, use or disclose personal data only for purposes that would be considered appropriate to a reasonable person in the given circumstances.

 References and Further Reading