Singapore PDPA Consent and deemed consent workflow

Start by confirming that the activity involves personal data and that anonymised or aggregated data cannot achieve the same purpose. If another written law requires or authorises the activity, document that law and keep the PDPA analysis limited to any remaining data protection obligations.

If no other written law applies, check whether a consent exception fits before asking for consent. The general legitimate interests exception is one possible route, but only when the assessment and balancing test support it. If no exception fits, select a consent route: express consent, deemed consent by conduct, deemed consent by contractual necessity, or deemed consent by notification.

Use express consent when the individual is notified of the purpose and gives consent in writing or in another accessible record. If consent is verbal, keep a confirmation record or a written note of the fact that consent was given.

Use deemed consent by conduct only when the individual voluntarily provides personal data and the purpose is objectively obvious and reasonably appropriate from the circumstances. Use deemed consent by contractual necessity only for downstream disclosure, collection, use, or further disclosure that is reasonably necessary to conclude or perform the transaction between the individual and the organisation.

Deemed consent by notification is for a notified collection, use, or disclosure where the individual is told how to opt out and does not opt out within the specified period. Before relying on it, complete an assessment covering purpose, notification method, opt-out period and method, likely adverse effects, mitigation, residual adverse effects, and final decision outcome.

Do not start the notified collection, use, or disclosure until the opt-out period has lapsed. If the assessment identifies residual adverse effect after mitigation, choose another basis instead of relying on deemed consent by notification.

The legitimate interests exception is an exception to consent, so it should be recorded separately from express or deemed consent. Use it only where the identified legitimate interests of the organisation or another person outweigh any adverse effect on the individual.

The assessment should define the purpose, identify benefits, assess likely adverse effects, document mitigation and residual effects, and complete the balancing test. If reliance continues, disclose that the organisation is relying on the exception, but do not publish the assessment itself.

Individuals may withdraw consent that has been given or deemed to have been given. Build the withdrawal path before launch, including how a person submits notice, who receives it, how consequences are explained, and which systems, data intermediaries, or agents must stop collecting, using, or disclosing the personal data.

Separate necessary purposes from optional purposes. For example, an individual should be able to withdraw consent for optional marketing without also withdrawing consent needed to provide the contracted service.