Artifact GuideSingapore PDPAConsent exceptions

Singapore PDPA Deemed Consent and Legitimate Interests

Use deemed consent or legitimate interests only after the team has named the purpose, data, affected individuals, notification path, adverse-effect assessment, and evidence record.

This page separates deemed consent by conduct, contractual necessity, deemed consent by notification, and the legitimate interests exception so product, privacy, legal, and marketing teams do not reuse one basis for a different purpose.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

The Singapore PDPA recognises several ways to collect, use, or disclose personal data without obtaining a fresh express consent action in every case. They are not interchangeable. Deemed consent by conduct depends on what the individual voluntarily provides for an obvious purpose; contractual necessity depends on what is reasonably necessary to conclude or perform the individual transaction; requires adequate notice, a reasonable opt-out opportunity, and an adverse-effect assessment; and requires documented assessment, mitigation, a balancing test where residual adverse effects remain, and disclosure that the organisation is relying on the exception.

Section 1

Choose the correct PDPA basis before using the data

Start with the actual purpose and data flow, not the preferred label. The PDPC framework places deemed consent by conduct, , , express consent, and consent exceptions in separate parts of the collection, use, and disclosure analysis.

For an implementation record, describe the personal data, the source of the data, whether the individual provided it voluntarily, whether a downstream disclosure is reasonably necessary for the individual transaction, whether a notified secondary purpose needs opt-out, or whether a consent exception is being used because the organisation has a legitimate interest that outweighs adverse effects. follows the transaction between the individual and the first organisation; it does not cover unrelated analytics, marketing, or product-improvement uses merely because the data was first collected during a contract.

Use deemed consent by conduct only for purposes that are objectively obvious and reasonably appropriate from the circumstances in which the individual voluntarily provides the personal data.
Use only where disclosure, collection, use, or further disclosure is reasonably necessary to conclude or perform the transaction between the individual and the first organisation.
Use only after notice has been given, the opt-out period has expired, and the assessment supports reliance on that route.
Use the general exception only after identifying the interest, assessing adverse effects, applying mitigation, and documenting why the interest outweighs any residual adverse effect.

Sources for this answer

PDPC Advisory Guidelines on Key Concepts in the PDPA

Supports the distinction between deemed consent by conduct, contractual necessity, notification, withdrawal, and legitimate interests safeguards.

PDPA's Framework for the Collection, Use and Disclosure of Personal Data

Shows where deemed consent and legitimate interests sit in the PDPA collection, use, and disclosure framework.

Section 2

Run a deemed-consent-by-notification assessment before notice goes live

is for a notified purpose where the individual has not opted out within a specified period. Silence counts only after the organisation has assessed likely adverse effects, taken reasonable measures to eliminate or mitigate them, given adequate notice and a reasonable opt-out method and period, and allowed that period to expire.

The operating record should include the notified purpose, data categories, collection/use/disclosure mechanics, whether processing is one-off or continuous, the notice channel, the opt-out channel, the opt-out period, foreseeable adverse effects, mitigating measures, residual effects, final decision outcome, outcome date, preparer, endorser, and management approval.

Make the notification adequate by telling individuals the organisation's intention, the purpose, the opt-out period, and the manner for opting out.
Use a notice channel that is likely to reach the affected individuals; direct channels, app notifications, dashboards, and broader mass channels may be appropriate depending on the relationship and scale.
Do not start the notified collection, use, or disclosure until the opt-out period has expired.
Do not rely on where individuals do not have a reasonable opportunity and period to opt out.
Proceed only when the assessment shows no likely residual adverse effect after reasonable mitigation; if a likely adverse effect remains, use another lawful basis or change the proposed processing.
Retain the assessment throughout the period of reliance and provide it to the PDPC if requested; the organisation does not have to give the assessment to individuals because it may contain commercially sensitive information.

Sources for this answer

Assessment Checklist for Deemed Consent by Notification

Provides the PDPC assessment structure for purpose, notification, opt-out, adverse effects, mitigation, residual effect, and approval fields.

PDPC Advisory Guidelines on Key Concepts in the PDPA

Supports the requirements for adequate notification, reasonable opt-out, expiry of the opt-out period, and withdrawal after the period lapses.

Personal Data Protection Regulations 2021

Official subsidiary legislation source for the regulations covering deemed consent by notification and legitimate interests assessments.

Section 3

Document a legitimate interests assessment

The general exception can support collection, use, or disclosure without consent only when the organisation or another person's identified legitimate interests outweigh adverse effects on the individual. The assessment should explain the interest, the direct benefits, who benefits, why the purpose is reasonable, what data is involved, and what individuals could be harmed.

Where adverse effects remain after mitigation, the balancing test should weigh the identified against the residual adverse effects. The PDPC checklist warns against treating the balancing test as a simple tally of affirmative responses; each answer needs justification and an overall evaluation.

Record the legitimate interest in plain terms, such as fraud prevention, service misuse prevention, physical safety, IT and network security, or necessary corporate due diligence when those purposes match the facts.
Assess adverse effects by considering sensitivity, collection scale, whether datasets are combined, whether predictions or decisions are made, and whether those decisions could exclude, discriminate against, defame, or harm an individual.
List mitigation measures and then separately record any residual adverse effects that remain after mitigation.
Retain the assessment throughout the period in which the organisation collects, uses, or discloses personal data based on the exception.
Be ready to provide the assessment, balancing test, mitigation steps, and related documents to the PDPC if requested.

Sources for this answer

Assessment Checklist for Legitimate Interests Exception

Provides the PDPC structure for legitimate-interest purpose, benefits, adverse-effect assessment, mitigation, residual effects, balancing, outcome, and approval.

PDPC Advisory Guidelines on Key Concepts in the PDPA

Supports the legitimate interests safeguards, including assessment, disclosure of reliance, retention of assessments, and PDPC-request justification.

Personal Data Protection Regulations 2021

Official regulations source for assessment rules under deemed consent by notification and legitimate interests.

Section 4

Disclose reliance and keep marketing separate

reliance must be made known to individuals. In practice, the public data protection policy or another external-facing notice should state that the organisation relies on the legitimate interests exception for the relevant purpose and provide business contact information for a person who can answer questions.

The Personal Data Protection Regulations exclude the sending of direct marketing messages from both and the exception. For Singapore telephone numbers, telemarketing also has DNC controls: specified messages require a DNC check or clear and unambiguous consent in evidential form unless the message is excluded from the DNC provisions.

Publish enough information for individuals to understand that the organisation is relying on for a named purpose, but do not publish the commercially sensitive assessment itself unless the organisation chooses to do so.
Route direct marketing campaigns to an express-consent and DNC review instead of a deemed-consent-by-notification or legitimate-interests assessment.
For voice calls, text messages, or faxes to Singapore telephone numbers, check whether the message is a specified message and whether DNC checking or clear and unambiguous consent evidence is required.
Keep assessment records separate from marketing opt-in records, DNC check records, withdrawal records, and campaign approvals so reviewers can see which rule supports each activity.

Sources for this answer

PDPC Advisory Guidelines on Key Concepts in the PDPA

Supports disclosure of reliance on legitimate interests and the rule that direct marketing should not use deemed consent by notification.

Assessment Checklist for Deemed Consent by Notification

States that deemed consent by notification cannot be relied on for sending direct marketing messages.

Advisory Guidelines on the Do Not Call Provisions

Supports the DNC-specific limit that telemarketing to Singapore telephone numbers requires DNC checking or clear and unambiguous consent evidence unless an exemption applies.

Recommended next step

Turn PDPA consent-exception analysis into reviewable records

This Singapore PDPA guide helps turn deemed consent and legitimate interests questions into scoped assessments, notice checks, opt-out records, balancing evidence, and marketing exclusions.

Assessment workflow

Open Assessment Autopilot for Singapore PDPA

Structure deemed-consent and legitimate-interests assessments with owners, evidence fields, and reviewer sign-off.

Explore next step

Research workflow

Review Singapore PDPA source evidence

Use Research Copilot to check PDPC guidance and assessment records against cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review PDPA consent bases, notices, opt-out handling, legitimate-interests balancing, and DNC marketing boundaries.

Explore next step

Primary sources

References and citations

Advisory Guidelines on the Do Not Call Provisions

pdpc.gov.sg

Referenced sections

Supports the DNC-specific limit that telemarketing to Singapore telephone numbers requires DNC checking or clear and unambiguous consent evidence unless an exemption applies.

"Duty to check the DNC Register"

Assessment Checklist for Deemed Consent by Notification

pdpc.gov.sg

Referenced sections

States that deemed consent by notification cannot be relied on for sending direct marketing messages.

"cannot be relied on for sending direct marketing messages"

Assessment Checklist for Legitimate Interests Exception

pdpc.gov.sg

Referenced sections

Provides the PDPC structure for legitimate-interest purpose, benefits, adverse-effect assessment, mitigation, residual effects, balancing, outcome, and approval.