Singapore Data Removal Guide (2026)
Singapore residents may exercise PDPA rights to withdraw consent, request access or correction, and complain about covered processing. The DNC Registry addresses specified telemarketing to Singapore numbers, while consent, ongoing relationships, B2B messages, public records, and other exceptions affect the result.
Research status: sources last checked 2026-09-07.
This page is educational orientation, not legal advice. The legal fields below are a research snapshot; eligibility, exemptions, deadlines, penalty rules and broker routes can change. Verify the current statute and regulator guidance before relying on a right or filing a complaint.
At a glance
- Governing law
- PDPA
- Response deadline
- Access/correction: as soon as reasonably possible; if not completed within 30 calendar days, written notice within 30 days should state the expected response time
- Regulator
- Personal Data Protection Commission (PDPC)
- Private right of action
- Potential: Section 48O civil proceedings for loss or damage directly resulting from specified PDPA contraventions, subject to statutory conditions and the PDPC decision/appeal sequence
Personal Data Protection Act 2012 (PDPA)
The PDPA establishes data-protection obligations for organisations subject to Singapore law, including consent and withdrawal, purpose limitation, access and correction, retention limitation, transfer, security, and breach notification. The PDPC separately lists data portability as a legislated obligation that takes effect when the relevant regulations are issued. Access and correction requests have their own as-soon-as-reasonably-possible and 30-day notice framework, and exceptions apply.
What rights do Singapore residents have?
- →Right to withdraw consent for collection, use, or disclosure of personal data on reasonable notice (Section 16; consequences and exceptions apply)
- →Right to access personal data and information on past-year disclosures (Section 21)
- →Right to correct errors or omissions in personal data (Section 22)
- →Data portability is a legislated obligation that the PDPC marks as not yet in effect until the relevant regulations are issued
- →Option to register Singapore telephone numbers on the national Do Not Call (DNC) Registry for covered telemarketing
- →Right to lodge complaints with the Personal Data Protection Commission (PDPC)
Who holds your data in Singapore?
A Singapore request may involve ACRA business records, property or directory sources, marketing lists, professional profiles, recruitment or B2B providers, and international data services. ACRA confirms that much Bizfile information is publicly accessible for a fee and can include personal data about owners, shareholders, directors, and officers; source access, legal-person records, retention, and provider roles must be distinguished from a deletion request.
Public-record sources brokers scrape
- ACRA Bizfile and other business records: public-access, contact-address, and residential-address rules differ by record and requester
- Commercial telephone directories and marketing lists: provider and DNC routes are separate
- Property records and public listings: source-specific disclosure, correction, and retention rules
- B2B, recruitment, and international data providers: controller, legal-basis, and request routes vary
How to remove your data in Singapore
- 1Send a written Section 16 withdrawal to an organisation when its processing relies on consent, on reasonable notice. Ask about likely consequences; withdrawal does not itself create a universal deletion duty and other statutory grounds may apply.
- 2Register your Singapore telephone number on the national Do Not Call (DNC) Registry at dnc.gov.sg for covered voice calls, text messages, or faxes. Consent, ongoing-relationship, service, research, charitable, government, political, and B2B exceptions can apply; a direct opt-out from an ongoing relationship should be honoured within 21 calendar days.
- 3Ask each directory, marketing-list, B2B, or international provider about access, correction, suppression, or deletion using its current privacy route; ACRA and other source custodians have separate public-record and retention rules.
- 4First approach the organisation and keep the correspondence. If it does not handle an access, correction, consent-withdrawal, or other PDPA concern, use the current PDPC complaint or review route; do not treat 30 days as a universal deletion deadline.
Generate requests in under 60 seconds
Generate requests for 1,034 US/global broker workflows for $9
What if a company ignores your request?
Consider the Personal Data Protection Commission (PDPC) information or complaint route above if the controller does not respond or the response is unsatisfactory. This guide records the following penalty orientation: For organisations with annual Singapore turnover above S$10M: up to the higher of S$1M or 10% of Singapore annual turnover for specified Data Protection Provisions; other and DNC penalties differ. The private-action note is: Potential: Section 48O civil proceedings for loss or damage directly resulting from specified PDPA contraventions, subject to statutory conditions and the PDPC decision/appeal sequence. Neither field is an individual award or a promise of enforcement.
Open the Personal Data Protection Commission (PDPC) information or complaint route ↗FAQ: Singapore data removal
What is the Do Not Call (DNC) Registry in Singapore?+
The DNC Registry lets individuals register Singapore telephone numbers against covered commercial telemarketing voice calls, text messages, and faxes. It does not cover every message or caller: consent, ongoing relationships, service or research messages, charitable or government communications, political messages, and B2B targeting are among the stated boundaries. A direct opt-out from an ongoing relationship should be honoured within 21 calendar days.
What happens when you withdraw consent under Section 16 of Singapore's PDPA?+
On reasonable notice, an organisation should explain the likely consequences of withdrawal and must cease collecting, using, or disclosing the personal data on the withdrawn-consent basis unless the PDPA or another written law permits or requires that processing. Withdrawal does not itself create a universal deletion duty.