Singapore PDPA Deemed Consent and Legitimate Interests

Start with the actual purpose and data flow, not the preferred label. The PDPC framework places deemed consent by conduct, deemed consent by contractual necessity, deemed consent by notification, express consent, and consent exceptions in separate parts of the collection, use, and disclosure analysis.

For an implementation record, describe the personal data, the source of the data, whether the individual provided it voluntarily, whether a downstream disclosure is reasonably necessary for the individual transaction, whether a notified secondary purpose needs opt-out, or whether a consent exception is being used because the organisation has a legitimate interest that outweighs adverse effects. Deemed consent by contractual necessity follows the transaction between the individual and the first organisation; it does not cover unrelated analytics, marketing, or product-improvement uses merely because the data was first collected during a contract.

Deemed consent by notification is for a notified purpose where the individual has not opted out within a specified period. Silence counts only after the organisation has assessed likely adverse effects, taken reasonable measures to eliminate or mitigate them, given adequate notice and a reasonable opt-out method and period, and allowed that period to expire.

The operating record should include the notified purpose, data categories, collection/use/disclosure mechanics, whether processing is one-off or continuous, the notice channel, the opt-out channel, the opt-out period, foreseeable adverse effects, mitigating measures, residual effects, final decision outcome, outcome date, preparer, endorser, and management approval.

The general legitimate interests exception can support collection, use, or disclosure without consent only when the organisation or another person's identified legitimate interests outweigh adverse effects on the individual. The assessment should explain the interest, the direct benefits, who benefits, why the purpose is reasonable, what data is involved, and what individuals could be harmed.

Where adverse effects remain after mitigation, the balancing test should weigh the identified legitimate interests against the residual adverse effects. The PDPC checklist warns against treating the balancing test as a simple tally of affirmative responses; each answer needs justification and an overall evaluation.

Legitimate interests reliance must be made known to individuals. In practice, the public data protection policy or another external-facing notice should state that the organisation relies on the legitimate interests exception for the relevant purpose and provide business contact information for a person who can answer questions.

The Personal Data Protection Regulations exclude the sending of direct marketing messages from both deemed consent by notification and the legitimate interests exception. For Singapore telephone numbers, telemarketing also has DNC controls: specified messages require a DNC check or clear and unambiguous consent in evidential form unless the message is excluded from the DNC provisions.