Singapore

A company refuses my data access request. What now?

30 days
Response deadline
PDPC
Oversight body
s. 21
PDPA section
Act 26/2012
PDPA year/number
The Short Answer

If a company refuses your data access request in Singapore, you may file a complaint with the Personal Data Protection Commission (PDPC) — they can investigate and order the company to comply.

What the Law Says

Under Singapore’s Personal Data Protection Act (PDPA), individuals have the right to request access to their personal data held by an organisation. Organisations must respond within a reasonable time — typically interpreted as within 30 days — and either provide the data or give reasons for refusal.

Section 21 of the PDPA gives you the legal right to request access to your personal data that an organisation holds about you. This includes information such as your name, contact details, transaction history, or any other data used for business purposes.

The organisation must respond to your request within a reasonable time — while the PDPA does not specify an exact number of days, the PDPC’s Advisory Guidelines state that 30 calendar days is the expected timeframe for responding to access requests.

If the organisation refuses your request, it must inform you of the reasons — for example, because disclosure would reveal confidential commercial information, breach another person’s privacy, or is prohibited by law.

Statutory Text

An individual may make a request to an organisation for access to his personal data which the organisation holds.

Personal Data Protection Act 2012, s. 21 — Right of access to personal data

What to Do

1

Write a clear, dated access request specifying the data you want and how you’d like to receive it (e.g., email or printed copy).

2

If you don’t receive a response within 30 days, or if the refusal seems unjustified, gather copies of your request and any reply.

3

File a formal complaint with the Personal Data Protection Commission (PDPC) via its online portal at https://www.pdpc.gov.sg/complaint.

4

PDPC will assess your complaint and may require the organisation to provide the data or explain its position — it has enforcement powers under the PDPA.

Sources

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.