SingaporeWhat exceptions allow data collection without consent?
In Singapore, personal data can be collected without consent under specific exceptions in the PDPA, such as when required by law, necessary for legal proceedings, or for legitimate interests that outweigh the individual’s privacy rights.
What the Law Says
The Personal Data Protection Act (PDPA) generally requires consent before collecting personal data — but it sets out clear statutory exceptions where consent is not needed.
Under the PDPA, organisations must obtain an individual’s consent before collecting, using, or disclosing their personal data — unless a specific exception applies. These exceptions are set out in Part IV of the PDPA and allow lawful collection without consent in defined circumstances.
For example, data may be collected without consent if it is necessary to respond to an emergency threatening life or health, or if it is required or authorised by law. Another key exception permits collection without consent where it is necessary for the organisation’s legitimate interests — provided those interests do not override the individual’s privacy rights.
The PDPA also allows collection without consent when the data is publicly available, or when it is necessary for evaluative purposes (e.g., job applications), or for journalistic, artistic, or literary purposes — subject to safeguards.
Statutory TextAn organisation must not collect personal data about an individual unless the organisation has obtained the individual’s consent…
— Personal Data Protection Act 2012, s. 13 — Consent Obligation
Statutory TextAn organisation may collect personal data about an individual without the individual’s consent if the collection is necessary for the organisation’s legitimate interests…
— Personal Data Protection Act 2012, s. 14 — Legitimate Interests Exception
Statutory TextAn organisation may collect personal data about an individual without the individual’s consent if the collection is required or authorised by law.
— Personal Data Protection Act 2012, s. 15 — Collection Without Consent
What to Do
Review whether your data collection falls under one of the 11 statutory exceptions in Sections 14–26 of the PDPA.
Document the specific exception relied upon and why it applies — including how legitimate interests were balanced against privacy risks.
Ensure data collected without consent is still protected, used only for its intended purpose, and retained no longer than necessary (generally ≤3 years unless law requires otherwise).
Update your Data Protection Policy and notify individuals (where practicable) about the basis for collection without consent.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.