PDPA Consent Management in Singapore

By Amanda Zheng, DPO · January 2025 · Compliance Guide

Consent is the cornerstone of Singapore’s PDPA compliance. Getting it right means obtaining consent that is freely given, specific, informed, and unambiguous, while making withdrawal just as easy. This guide provides practical templates and real-world examples.

1. Express Consent (Most Common)

Clear, explicit agreement through action:

Ticking an opt-in checkbox
Signing a consent form
Verbal consent (documented)
Electronic signature

2. Deemed Consent

Applies when individual voluntarily provides data for an obvious purpose they’re aware of.

✓ Valid Deemed Consent Example: Customer provides email when signing up for event newsletter → Deemed consent to send event updates

✗ Invalid Deemed Consent Example: Customer provides email for order confirmation → Using it for marketing without express consent

The 5 Key Principles of Valid Consent

                Freely Given: No coercion or misleading
Specific: Clear about what data and for what purpose
Informed: Individual understands what they’re consenting to
Unambiguous: Clear affirmative action required
Withdrawable: Easy to withdraw at any time

            

Consent Form Best Practices

✓ DO: Use Clear, Simple Language

Good Example: “☐ I agree to receive marketing emails from DataCare Solutions about PDPA compliance services and industry updates. You can unsubscribe anytime by clicking the link in our emails.”

✗ DON’T: Use Pre-Checked Boxes

Bad Example: “☑ I agree to receive promotional materials (already checked)” This is NOT valid consent under PDPA.

✓ DO: Separate Consent for Different Purposes

Good Example: “☐ Send me service updates about my account (necessary for service delivery)
☐ Send me marketing offers and promotions (optional)
☐ Share my data with partners for relevant offers (optional)”

✗ DON’T: Bundle Consent

Bad Example: “☐ I agree to receive all communications from the company and its partners.” Too vague: doesn’t specify purposes separately.

Sample Consent Templates

Template 1: Website Registration Form

Data Collection & Use Consent

By submitting this form, you consent to DataCare Solutions collecting and using your personal data (name, email, company name, phone number) for the following purposes:

Essential (Required):
• Processing your inquiry and providing requested services
• Sending service-related communications
• Maintaining customer records

Optional (Your Choice):
☐ Send me updates about PDPA compliance news and best practices
☐ Notify me about relevant events and webinars
☐ Contact me about products and services that may interest my business

You may withdraw consent at any time by emailing info@datacaresolutions.biz or clicking unsubscribe in our emails.

For details on how we protect your data, see our Privacy Policy.

Template 2: Event Registration

Event Registration Consent

I consent to providing my personal data (name, email, company, job title) to DataCare Solutions for:

☐ Event registration and attendance confirmation
☐ Sharing my contact details with event sponsors (optional)
☐ Receiving photos/videos from the event
☐ Future event invitations and updates

Data Protection Officer: privacy@datacaresolutions.biz

Consent Recording & Documentation

Under PDPA, you must be able to demonstrate consent was obtained. Maintain records showing:

Who: Identity of individual who gave consent
When: Date and time consent was obtained
What: Exact wording of consent request
How: Method used (checkbox, signature, verbal)
For What: Specific purposes consented to
IP Address: For online consent (helps verify authenticity)

Sample Consent Log Entry:

Consent Withdrawal

Making withdrawal as easy as giving consent is a PDPA requirement. Provide multiple channels:

Email: Dedicated unsubscribe email address
Unsubscribe Link: In every marketing email
Online Portal: Account settings page
Phone: Customer service number
Written Request: Postal address

Withdrawal Response Template:

Subject: Consent Withdrawal Confirmation

Dear [Name],

We have processed your request to withdraw consent for [specific purpose] as of [date].

You will no longer receive [type of communications].

Please note:
• We may still send essential service communications
• Processing may take up to 10 business days
• Your consent for [other purposes] remains active unless you withdraw separately

To manage all your consent preferences, visit [link] or contact us at [email].

Thank you,
DataCare Solutions Data Protection Officer

Special Considerations

Children’s Data (Updated 2024)

On 28 March 2024, PDPC published new guidelines for children’s data:

Obtain parental consent for children under 13
Use age-appropriate language
Implement age verification mechanisms
Provide enhanced data protection for minors

Sensitive Personal Data

For sensitive data (medical, financial, biometric), obtain explicit express consent with enhanced warnings:

Sensitive Data Consent Example: “☐ I explicitly consent to DataCare Solutions collecting and using my NRIC number for identity verification purposes. I understand this is sensitive personal data and will be encrypted and protected with enhanced security measures.”

Third-Party Sharing

Always obtain separate, specific consent before sharing data with third parties:

“☐ I consent to DataCare Solutions sharing my contact information with [Specific Partner Name] for [Specific Purpose]. I understand [Partner Name] will handle my data according to their privacy policy at [link].”

When Consent Is Not Required

Consent is the default basis for collecting, using or disclosing personal data in Singapore, but it is not the only one. The PDPA sets out exceptions, and the practical mistake most organisations make is in both directions: asking for consent they do not need, and relying on an exception that does not actually cover what they are doing.

                The test to apply. Ask which specific exception applies, to which specific purpose, and write that reasoning down before you rely on it. An exception you cannot name and cannot evidence is not a defence if the PDPC asks.
            

Deemed consent

Not an exception exactly, but the most common alternative to express consent. It arises where an individual voluntarily provides data for an obvious purpose, where providing the data is reasonably necessary to perform a contract, or through the notification route, where you notify the individual, allow a reasonable opt-out period, and they do not opt out. The notification route carries conditions, including a risk assessment. See Types of Consent above.

Legitimate interests

Permits collection, use or disclosure where the legitimate interests of the organisation or another person outweigh any adverse effect on the individual. It requires a documented assessment identifying the adverse effects, the mitigations, and why the balance favours proceeding. You must also disclose reliance on this exception, typically in your privacy notice. It is not a catch-all for anything commercially convenient.

Business improvement

Covers using data you already hold to improve or develop products and services, understand customer behaviour, or improve operational efficiency. It does not extend to disclosing that data outside the organisation, and it does not cover sending marketing, which needs its own basis.

Vital interests and public matters

Applies where the collection, use or disclosure is necessary to respond to an emergency threatening life, health or safety, or to matters affecting the public such as an investigation or proceedings. Narrow by design and not a routine operating basis.

Publicly available data

Data that is generally available to the public may be handled without consent. Note what this does not mean: data being technically visible online is not the same as being publicly available in the sense the PDPA intends, and scraped contact details usually fail this test.

Employment

Data reasonably needed to manage or terminate an employment relationship may be handled without separate consent, as may evaluative purposes such as assessing suitability for a role or promotion. Employees must still be notified of the purposes.

                Two things the exceptions never remove. The notification obligation, meaning individuals must still be told the purposes, and every other obligation in the Act: protection, retention limitation, accuracy, access and correction, and the transfer limitation obligation if data goes overseas. An exception excuses consent, not compliance.
            

Deciding which basis applies to each processing activity is exactly the work an outsourced DPO does as part of the data inventory, and it is covered in the audit at the start of a PDPA compliance engagement.

Common Consent Mistakes to Avoid

Pre-checked boxes: Always default to unchecked
Vague purposes: Be specific about how data will be used
Bundling consent: Separate different purposes
Hidden terms: Make consent clear and visible
No withdrawal option: Provide easy opt-out methods
Poor record-keeping: Document all consents
Assuming consent: Silence or inactivity is NOT consent
Exceeding scope: Don’t use data beyond consented purposes

Need Help with Consent Management?

We can review your consent processes and draft the consent wording and records you need, as part of our PDPA compliance work. Building the capture into your website or CRM is done by whoever maintains those systems, working from what the review sets out.

Get Expert Guidance

Useful Resources

Disclaimer: This guide is for informational purposes only. Consult qualified legal counsel for specific compliance advice.