My child's school shared data without my consent. Any violation?

What the Law Says

The Personal Data Protection Act 2012 (PDPA) sets rules for how organisations in Singapore — including schools — collect, use, and disclose personal data.

Under the PDPA, an organisation must generally obtain an individual’s consent before collecting, using, or disclosing their personal data. This applies to children’s data too — but consent must usually be given by the parent or legal guardian if the child is under 13 years old.

Section 13 of the PDPA states that an organisation must not collect, use or disclose personal data about an individual unless it has obtained the individual’s consent, or unless an exception applies. Schools are considered 'organisations' under the PDPA and must comply.

There are limited exceptions — for example, disclosure required by law, or necessary to respond to an emergency threatening life or health. But routine sharing with third parties (e.g., vendors, other schools, or marketing partners) without consent is not permitted.

Statutory Text

An organisation must not collect, use or disclose personal data about an individual unless it has obtained the individual’s consent, or unless an exception applies.

— Personal Data Protection Act 2012, s. 13 — Consent

What to Do

Sources