Singapore PDPA Consent and deemed consent workflow

Start by confirming that the activity involves personal data and that anonymised or aggregated data cannot achieve the same purpose. Define the purpose before selecting a basis: the PDPA generally limits collection, use, and disclosure to purposes a reasonable person would consider appropriate in the circumstances, even where consent is obtained. If another written law requires or authorises the activity, document that law and keep the PDPA analysis limited to any remaining data protection obligations.

If no other written law applies, check whether a consent exception fits before asking for consent. The general legitimate interests exception is one possible route, but only when the assessment and balancing test support it. If no exception fits, select a consent route: express consent, deemed consent by conduct, deemed consent by contractual necessity, or deemed consent by notification.

Use express consent when the individual is notified of the purpose on or before collection and gives consent in writing or in another accessible record. If the organisation later wants to use or disclose the data for a purpose that was not notified, notify that new purpose and obtain consent before the new use or disclosure unless an exception applies. If consent is verbal, keep a confirmation record or a written note of the fact that consent was given.

Use deemed consent by conduct only when the individual voluntarily provides personal data and the purpose is objectively obvious and reasonably appropriate from the circumstances. Use deemed consent by contractual necessity only for downstream disclosure, collection, use, or further disclosure that is reasonably necessary to conclude or perform the transaction between the individual and the organisation.

Deemed consent by notification is for a notified collection, use, or disclosure where the individual is told how to opt out and does not opt out within the specified period. Before relying on it, complete an assessment covering purpose, notification method, opt-out period and method, likely adverse effects, mitigation, residual adverse effects, and final decision outcome.

Do not start the notified collection, use, or disclosure until the opt-out period has lapsed. If the assessment identifies residual adverse effect after mitigation, choose another basis instead of relying on deemed consent by notification.

The legitimate interests exception is an exception to consent, so it should be recorded separately from express or deemed consent. Use it only where the identified legitimate interests of the organisation or another person outweigh any adverse effect on the individual.

The assessment should define the purpose, identify benefits, assess likely adverse effects, document mitigation and residual effects, and complete the balancing test. If reliance continues, disclose that the organisation is relying on the exception, but do not publish the assessment itself.

Individuals may withdraw consent that has been given or deemed to have been given by giving reasonable notice. Build the withdrawal path before launch, including how a person submits notice, who receives it, how likely consequences are explained, and which systems, data intermediaries, or agents must stop collecting, using, or disclosing the personal data. Withdrawal does not require the organisation to erase data immediately; retention and disposal remain a separate PDPA assessment.

Separate necessary purposes from optional purposes. For example, an individual should be able to withdraw consent for optional marketing without also withdrawing consent needed to provide the contracted service.