Singapore's PDPA: when cookies need consent

What is the PDPA?

The Personal Data Protection Act 2012 is Singapore's general data protection law. Its data protection provisions have applied since 2 July 2014, and the Personal Data Protection (Amendment) Act 2020 added mandatory breach notification, new forms of deemed consent, a legitimate interests exception and higher penalties, mostly from 1 February 2021, with the higher penalty cap from 1 October 2022. The Personal Data Protection Commission (PDPC) enforces the Act and publishes advisory guidelines that explain how it reads it, including a chapter on cookies.

The PDPA also contains the Do Not Call provisions on marketing messages to Singapore telephone numbers, which are separate from the cookie rules discussed here.

Who does the PDPA apply to?

The Act defines an organization as any individual, company, association or body of persons, whether or not formed or recognized under Singapore law, and whether or not resident or with an office or place of business in Singapore. The PDPC's Key Concepts guidelines say every organization must comply with the Act for the collection, use and disclosure of personal data in Singapore unless it is in an excluded category, such as public agencies or individuals acting in a personal capacity. A foreign website that collects personal data from people in Singapore is therefore within reach. Organizations that only process data on behalf of another, called data intermediaries, have a narrower set of duties.

Do cookies need consent in Singapore?

Chapter 7 of the PDPC's Advisory Guidelines on the PDPA for Selected Topics answers the question in steps.

• No personal data, no consent. The PDPA applies to the collection, use or disclosure of personal data using cookies. Not all cookies collect personal data, and consent is not needed for those that do not, such as a session cookie that only stores technical data to play a video.
• Activities the user clearly requested. There may be no need to seek consent when the user is aware of the purposes and voluntarily provides the data, for example storing what the user types into a web form to complete a purchase, or reasonable activities that cannot work without cookies, such as authentication and security, user preferences, network management and streaming.
• Advertising targeting. Where targeting advertisements involves collecting and using personal data through cookies, the individual's consent is required. As good practice, the PDPC says organizations should let people set their cookie preferences on the website to enable or disable cookies used for personalized advertising.

The guidelines add two points that matter for banners. Consent may be reflected in browser settings: a person who configures the browser to accept some cookies and reject others may have consented to the ones accepted. But the mere failure to manage browser settings does not imply consent to collection by all websites. And the obligation to obtain consent rests with the organization that collects the personal data; where a third party collects data through your website and you do not, the duty to get consent is on the third party.

Whether a cookie collects personal data depends on context. The same chapter says an IP address or a tracking cookie may become personal data when it is matched with browsing history, purchase history or other data that lets the organization identify a person.

What must consent look like?

Under sections 13 and 14, an organization must obtain consent and notify the purposes before or at the time of collection, and it may not require consent beyond what is reasonable to provide a product or service. Consent obtained through false or misleading information is not valid. Section 15 recognizes deemed consent when a person voluntarily provides data for a purpose and it is reasonable that they would, and when disclosure is necessary to perform a contract. Section 15A allows deemed consent by notification: the organization assesses that the purpose is not likely to have an adverse effect, tells people the purpose and gives them a reasonable period to opt out before it starts. Neither deemed consent by notification nor the legitimate interests exception can be used to send direct marketing messages; these need express consent.

The legitimate interests exception in Part 3 of the First Schedule lets an organization collect, use or disclose personal data without consent when it has assessed the adverse effects, concluded that its interests outweigh them, and disclosed that it relies on the exception. Withdrawal of consent must be possible on reasonable notice.

How are transfers abroad regulated?

Section 26, the Transfer Limitation Obligation, prohibits transferring personal data outside Singapore except in accordance with the requirements of the Personal Data Protection Regulations 2021. In practice the organization must ensure that the recipient is bound by legally enforceable obligations that give the data a standard of protection comparable to the PDPA. Those obligations can come from the law of the destination, a contract, binding corporate rules for related companies, or a certification such as the APEC Cross-Border Privacy Rules. The Regulations also accept consent given after the person is told how the data will be protected abroad, and transfers reasonably necessary for a contract with the individual.

Who enforces the PDPA, and what are the penalties?

The PDPC investigates on complaint or on its own initiative and can give directions to stop collection, destroy data or pay a financial penalty. For breaches on or after 1 October 2022, the maximum financial penalty is 10% of the organization's annual turnover in Singapore if that turnover exceeds S$10 million, and S$1 million in any other case (section 48J and the Enforcement Regulations 2021). The PDPC publishes its decisions. Most concern failures to protect personal data: on 28 October 2025 it fined Marina Bay Sands S$315,000 after an attacker used six members' credentials to reach the records of about 665,495 loyalty program members. No published decision has fined an organization over cookies alone.

What should a website serving Singapore do?

• Find out which cookies collect personal data; the cookie scanner lists what your pages set.
• Leave strictly functional cookies on, and explain them in the privacy notice.
• Ask for consent before advertising cookies that profile people, and give a way to change the choice on the website, as the PDPC recommends.
• Check that analytics and ad vendors outside Singapore are bound by comparable protection.

Singapore is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan, so you can add Singapore to a custom list or show the banner everywhere. Its preferences center lets visitors turn the marketing category on or off, and every choice is kept in the consent log. See also Thailand, Indonesia and the GDPR.