---
title: "Singapore PDPA Deemed Consent and Legitimate Interests"
canonical_url: "https://www.sorena.io/artifacts/apac/singapore-pdpa/deemed-consent-and-legitimate-interests"
source_url: "https://www.sorena.io/artifacts/apac/singapore-pdpa/deemed-consent-and-legitimate-interests"
author: "Sorena AI"
description: "How to apply Singapore PDPA deemed consent by conduct, contractual necessity, notification, and legitimate interests with opt-out, adverse-effect, disclosure, and assessment records."
published_at: "2026-05-09"
updated_at: "2026-05-09"
keywords:
  - "Singapore PDPA deemed consent"
  - "legitimate interests exception"
  - "deemed consent by notification"
  - "PDPA opt-out"
  - "PDPA direct marketing"
  - "Singapore PDPA"
  - "deemed consent"
  - "legitimate interests"
  - "Do Not Call"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# Singapore PDPA Deemed Consent and Legitimate Interests

How to apply Singapore PDPA deemed consent by conduct, contractual necessity, notification, and legitimate interests with opt-out, adverse-effect, disclosure, and assessment records.

*Artifact Guide* *Singapore PDPA* *Consent exceptions*

## Singapore PDPA Deemed Consent and Legitimate Interests

Use deemed consent or legitimate interests only after the team has named the purpose, data, affected individuals, notification path, adverse-effect assessment, and evidence record.

This page separates deemed consent by conduct, contractual necessity, deemed consent by notification, and the legitimate interests exception so product, privacy, legal, and marketing teams do not reuse one basis for a different purpose.

The Singapore PDPA recognises several ways to collect, use, or disclose personal data without obtaining a fresh express consent action in every case. They are not interchangeable. Deemed consent by conduct depends on what the individual voluntarily provides for an obvious purpose; contractual necessity depends on what is reasonably necessary to conclude or perform the individual transaction; deemed consent by notification requires adequate notice, a reasonable opt-out opportunity, and an adverse-effect assessment; and legitimate interests requires documented assessment, mitigation, a balancing test where residual adverse effects remain, and disclosure that the organisation is relying on the exception.

## Choose the correct PDPA basis before using the data

Start with the actual purpose and data flow, not the preferred label. The PDPC framework places deemed consent by conduct, deemed consent by contractual necessity, deemed consent by notification, express consent, and consent exceptions in separate parts of the collection, use, and disclosure analysis.

For an implementation record, describe the personal data, the source of the data, whether the individual provided it voluntarily, whether a downstream disclosure is reasonably necessary for the individual transaction, whether a notified secondary purpose needs opt-out, or whether a consent exception is being used because the organisation has a legitimate interest that outweighs adverse effects.

- Use deemed consent by conduct only for purposes that are objectively obvious and reasonably appropriate from the circumstances in which the individual voluntarily provides the personal data.
- Use deemed consent by contractual necessity only where disclosure, collection, use, or further disclosure is reasonably necessary to conclude or perform the transaction between the individual and the first organisation.
- Use deemed consent by notification only after notice has been given, the opt-out period has expired, and the assessment supports reliance on that route.
- Use the general legitimate interests exception only after identifying the interest, assessing adverse effects, applying mitigation, and documenting why the interest outweighs any residual adverse effect.

Sources for this answer:

- [PDPC Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act?ref=sorena.io) - Supports the distinction between deemed consent by conduct, contractual necessity, notification, withdrawal, and legitimate interests safeguards.
- [PDPA's Framework for the Collection, Use and Disclosure of Personal Data](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-a--pdpas-framework-for-the-collection-use-and-disclosure-of-personal-data-1-feb-2021.pdf?ref=sorena.io) - Shows where deemed consent and legitimate interests sit in the PDPA collection, use, and disclosure framework.

## Run a deemed-consent-by-notification assessment before notice goes live

Deemed consent by notification is for a notified purpose where the individual has not opted out within a specified period. It is especially sensitive because silence is treated as consent only after the PDPA conditions are met.

The operating record should include the notified purpose, data categories, collection/use/disclosure mechanics, whether processing is one-off or continuous, the notice channel, the opt-out channel, the opt-out period, foreseeable adverse effects, mitigating measures, residual effects, final decision outcome, outcome date, preparer, endorser, and management approval.

- Make the notification adequate by telling individuals the organisation's intention, the purpose, the opt-out period, and the manner for opting out.
- Use a notice channel that is likely to reach the affected individuals; direct channels, app notifications, dashboards, and broader mass channels may be appropriate depending on the relationship and scale.
- Do not start the notified collection, use, or disclosure until the opt-out period has expired.
- Do not rely on deemed consent by notification where individuals do not have a reasonable opportunity and period to opt out.
- Proceed only when the assessment shows no residual adverse effect after reasonable mitigation.

Sources for this answer:

- [Assessment Checklist for Deemed Consent by Notification](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-b--assessment-checklist-for-deemed-consent-by-notification-1-feb-2021.pdf?ref=sorena.io) - Provides the PDPC assessment structure for purpose, notification, opt-out, adverse effects, mitigation, residual effect, and approval fields.
- [PDPC Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act?ref=sorena.io) - Supports the requirements for adequate notification, reasonable opt-out, expiry of the opt-out period, and withdrawal after the period lapses.
- [Personal Data Protection Regulations 2021](https://sso.agc.gov.sg/SL/PDPA2012-S63-2021?ref=sorena.io) - Official subsidiary legislation source for the regulations covering deemed consent by notification and legitimate interests assessments.

## Document legitimate interests as an assessment, not a shortcut

The general legitimate interests exception can support collection, use, or disclosure without consent only when the organisation or another person's identified legitimate interests outweigh adverse effects on the individual. The assessment should explain the interest, the direct benefits, who benefits, why the purpose is reasonable, what data is involved, and what individuals could be harmed.

Where adverse effects remain after mitigation, the balancing test should weigh the identified legitimate interests against the residual adverse effects. The PDPC checklist warns against treating the balancing test as a simple tally of affirmative responses; each answer needs justification and an overall evaluation.

- Record the legitimate interest in plain terms, such as fraud prevention, service misuse prevention, physical safety, IT and network security, or necessary corporate due diligence when those purposes match the facts.
- Assess adverse effects by considering sensitivity, collection scale, whether datasets are combined, whether predictions or decisions are made, and whether those decisions could exclude, discriminate against, defame, or harm an individual.
- List mitigation measures and then separately record any residual adverse effects that remain after mitigation.
- Retain the assessment throughout the period in which the organisation collects, uses, or discloses personal data based on the legitimate interests exception.
- Be ready to provide the assessment, balancing test, mitigation steps, and related documents to the PDPC if requested.

Sources for this answer:

- [Assessment Checklist for Legitimate Interests Exception](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-c--assessment-checklist-for-legitimate-interests-exception-1-feb-2021.pdf?ref=sorena.io) - Provides the PDPC structure for legitimate-interest purpose, benefits, adverse-effect assessment, mitigation, residual effects, balancing, outcome, and approval.
- [PDPC Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act?ref=sorena.io) - Supports the legitimate interests safeguards, including assessment, disclosure of reliance, retention of assessments, and PDPC-request justification.
- [Personal Data Protection Regulations 2021](https://sso.agc.gov.sg/SL/PDPA2012-S63-2021?ref=sorena.io) - Official regulations source for assessment rules under deemed consent by notification and legitimate interests.

## Disclose reliance and keep marketing separate

Legitimate interests reliance must be made known to individuals. In practice, the public data protection policy or another external-facing notice should state that the organisation relies on the legitimate interests exception for the relevant purpose and provide business contact information for a person who can answer questions.

Do not use deemed consent by notification or legitimate interests to send direct marketing messages. For Singapore telephone numbers, telemarketing also has DNC controls: the DNC guidance explains that specified messages require DNC checks or clear and unambiguous consent in evidential form unless an exemption applies.

- Publish enough information for individuals to understand that the organisation is relying on legitimate interests for a named purpose, but do not publish the commercially sensitive assessment itself unless the organisation chooses to do so.
- Route direct marketing campaigns to an express-consent and DNC review instead of a deemed-consent-by-notification or legitimate-interests assessment.
- For voice calls, text messages, or faxes to Singapore telephone numbers, check whether the message is a specified message and whether DNC checking or clear and unambiguous consent evidence is required.
- Keep assessment records separate from marketing opt-in records, DNC check records, withdrawal records, and campaign approvals so reviewers can see which rule supports each activity.

Sources for this answer:

- [PDPC Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act?ref=sorena.io) - Supports disclosure of reliance on legitimate interests and the rule that direct marketing should not use deemed consent by notification.
- [Assessment Checklist for Deemed Consent by Notification](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-b--assessment-checklist-for-deemed-consent-by-notification-1-feb-2021.pdf?ref=sorena.io) - States that deemed consent by notification cannot be relied on for sending direct marketing messages.
- [Advisory Guidelines on the Do Not Call Provisions](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-dnc-provisions-1-feb-2021.pdf?ref=sorena.io) - Supports the DNC-specific limit that telemarketing to Singapore telephone numbers requires DNC checking or clear and unambiguous consent evidence unless an exemption applies.

*Recommended next step*

*Placement: after the practical guidance*

## Turn PDPA consent-exception analysis into reviewable records

Use this Singapore PDPA guide to turn deemed consent and legitimate interests questions into scoped assessments, notice checks, opt-out records, balancing evidence, and marketing exclusions.

- [Open Assessment Autopilot for Singapore PDPA](/solutions/assessment.md): Structure deemed-consent and legitimate-interests assessments with owners, evidence fields, and reviewer sign-off.
- [Review Singapore PDPA source evidence](/solutions/research-copilot.md): Use Research Copilot to check PDPC guidance and assessment records against cited source material.
- [Talk through implementation](/contact.md): Review PDPA consent bases, notices, opt-out handling, legitimate-interests balancing, and DNC marketing boundaries.

## Primary sources

- [PDPC Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act?ref=sorena.io) - Primary PDPC guidance for deemed consent by conduct, contractual necessity, notification, withdrawal, legitimate interests safeguards, disclosure of reliance, and assessment retention.
  - Quote: "different forms of deemed consent"
- [PDPA's Framework for the Collection, Use and Disclosure of Personal Data](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-a--pdpas-framework-for-the-collection-use-and-disclosure-of-personal-data-1-feb-2021.pdf?ref=sorena.io) - Framework source showing express consent, deemed consent routes, and consent exceptions in the PDPA collection, use, and disclosure analysis.
  - Quote: "Deemed consent by contractual necessity"
- [Assessment Checklist for Deemed Consent by Notification](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-b--assessment-checklist-for-deemed-consent-by-notification-1-feb-2021.pdf?ref=sorena.io) - PDPC checklist for notification adequacy, opt-out reasonableness, adverse effects, mitigation, residual effects, and management approval.
  - Quote: "Assessment Checklist for Deemed Consent by Notification"
- [Assessment Checklist for Legitimate Interests Exception](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/annex-c--assessment-checklist-for-legitimate-interests-exception-1-feb-2021.pdf?ref=sorena.io) - PDPC checklist for legitimate-interest purpose, benefits, adverse-effect analysis, mitigation, residual effects, balancing test, outcome, and approvals.
  - Quote: "Assessment Checklist for Legitimate Interests Exception"
- [Personal Data Protection Regulations 2021](https://sso.agc.gov.sg/SL/PDPA2012-S63-2021?ref=sorena.io) - Official regulations source for deemed consent by notification and legitimate interests assessment provisions.
  - Quote: "DEEMED CONSENT BY NOTIFICATION AND LEGITIMATE INTERESTS"
- [Advisory Guidelines on the Do Not Call Provisions](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-dnc-provisions-1-feb-2021.pdf?ref=sorena.io) - PDPC DNC guidance for specified messages, DNC register checks, and clear and unambiguous consent in evidential form.
  - Quote: "clear and unambiguous consent in evidential form"

## Related Topic Guides

- [Singapore PDPA Anonymisation and DPIA Records](/artifacts/apac/singapore-pdpa/anonymisation-and-dpias.md): Build Singapore PDPA anonymisation and DPIA records around PDPC guidance: release model, re-identification risk, data flows, action plans, safeguards, and monitoring.
- [Singapore PDPA anonymisation FAQ](/artifacts/apac/singapore-pdpa/faq/anonymisation.md): FAQ on anonymisation under the Singapore PDPA: de-identification, pseudonymisation, re-identification risk, when PDPA may no longer apply, and evidence records.
- [Singapore PDPA Applicability Test](/artifacts/apac/singapore-pdpa/applicability-test.md): Test whether Singapore PDPA obligations apply by checking personal data, organisation role, data intermediary status, public agency and individual boundaries, and business contact information.
- [Singapore PDPA Breach Notification Playbook](/artifacts/apac/singapore-pdpa/breach-notification-playbook.md): A grounded Singapore PDPA breach-notification playbook covering assessment, notifiable-breach thresholds, PDPC and affected-individual notification steps, roles, records, and citations.
- [Singapore PDPA breach notification thresholds FAQ](/artifacts/apac/singapore-pdpa/faq/breach-thresholds.md): FAQ on Singapore PDPA notifiable data breach tests: significant harm, significant scale, 500 affected individuals, assessment timing, PDPC notices, and affected-individual notices.
- [Singapore PDPA Breach Notification Workflow](/artifacts/apac/singapore-pdpa/breach-notification-workflow.md): A grounded Singapore PDPA workflow for containing a personal data breach, assessing notifiability, notifying PDPC or affected individuals, and retaining evidence.
- [Singapore PDPA Compliance Checklist](/artifacts/apac/singapore-pdpa/checklist.md): A grounded Singapore PDPA checklist for scope, DPO accountability, consent, data intermediaries, breach notification, DNC checks, transfers, and evidence records.
- [Singapore PDPA Compliance Guide](/artifacts/apac/singapore-pdpa/compliance.md): Build a Singapore PDPA compliance plan covering DPO accountability, consent and notification, protection, retention, access and correction, transfers, breach notification, and DNC checks.
- [Singapore PDPA Consent and Deemed Consent Workflow](/artifacts/apac/singapore-pdpa/consent-and-deemed-consent-selection-workflow.md): Choose express consent, deemed consent by conduct, contractual necessity, notification, or the legitimate interests exception under Singapore PDPA with grounded intake fields and evidence records.
- [Singapore PDPA Consent, Notification and Purpose Rules](/artifacts/apac/singapore-pdpa/consent-notification-and-purposes.md): How Singapore PDPA consent, notification, purpose limitation, deemed consent, withdrawal, and consent exceptions should be handled in product and privacy workflows.
- [Singapore PDPA Cross-Border Transfers](/artifacts/apac/singapore-pdpa/cross-border-transfers.md): Grounded Singapore PDPA guidance for overseas personal data transfers, comparable protection, ASEAN MCCs, APEC certifications, vendor roles, and evidence records.
- [Singapore PDPA Data Breach Notification Thresholds](/artifacts/apac/singapore-pdpa/breach-notification-thresholds.md): Grounded Singapore PDPA breach notification thresholds covering significant harm, the 500-individual significant-scale test, assessment records, and notification timing.
- [Singapore PDPA Data Intermediaries FAQ](/artifacts/apac/singapore-pdpa/faq/data-intermediaries.md): FAQ guidance on Singapore PDPA data intermediary roles, direct obligations, organisation accountability, contracts, retention, protection, and breach escalation.
- [Singapore PDPA Data Intermediary Responsibilities](/artifacts/apac/singapore-pdpa/data-intermediary-responsibilities.md): Practical Singapore PDPA guide to data intermediary role boundaries, organisation accountability, protection, retention, breach escalation, and contract evidence.
- [Singapore PDPA Deadlines and Compliance Calendar](/artifacts/apac/singapore-pdpa/deadlines-and-compliance-calendar.md): A grounded Singapore PDPA compliance calendar for breach notification, DNC checks, access and correction requests, retention reviews, and DPMP maintenance.
- [Singapore PDPA Deemed Consent FAQ](/artifacts/apac/singapore-pdpa/faq/deemed-consent.md): FAQ on Singapore PDPA deemed consent by conduct, contractual necessity, notification, opt-out periods, adverse-effect assessment, withdrawal, and direct-marketing limits.
- [Singapore PDPA DNC and Marketing Messages Guide](/artifacts/apac/singapore-pdpa/dnc-and-marketing-messages.md): A grounded Singapore PDPA guide to DNC checks, specified marketing messages, Singapore telephone numbers, consent evidence, opt-outs, sender duties, and excluded messages.
- [Singapore PDPA DNC checking FAQ: when to check the DNC Registry](/artifacts/apac/singapore-pdpa/faq/dnc-checking.md): FAQ guidance on Singapore PDPA DNC checking: when to check the DNC Registry, which registers apply, 8-digit numbers, 21-day result validity, consent evidence, on-behalf checks, opt-outs, and supported exclusions.
- [Singapore PDPA DNC Marketing Checks](/artifacts/apac/singapore-pdpa/dnc-marketing-checks.md): Operational checklist for Singapore PDPA DNC marketing checks: account evidence, register status, 21-day result validity, consent evidence, and campaign owner records.
- [Singapore PDPA DNC Marketing Workflow](/artifacts/apac/singapore-pdpa/dnc-marketing-workflow.md): Workflow for Singapore PDPA DNC marketing campaigns: classify specified messages, check Singapore telephone numbers, document consent, suppress opt-outs, and approve sends.
- [Singapore PDPA DPIAs: when to run and what to document](/artifacts/apac/singapore-pdpa/faq/dpias.md): FAQ-style implementation guidance on Singapore PDPA DPIAs, including when PDPC guidance recommends them, data-flow mapping, risk treatment, DPO review, and evidence records.
- [Singapore PDPA DPMP Accountability FAQ | DPO, Policies, Evidence](/artifacts/apac/singapore-pdpa/faq/dpmp-accountability.md): FAQ for implementing Singapore PDPA accountability through a DPMP: DPO designation, policies, evidence, training, monitoring, incident logs, and review records.
- [Singapore PDPA DPMP Accountability Guide](/artifacts/apac/singapore-pdpa/dpmp-accountability.md): Build a Singapore PDPA Data Protection Management Programme with DPO ownership, policies, data inventories, DPIAs, training, monitoring, breach logs, and review records.
- [Singapore PDPA FAQ: scope, DPO, consent, breaches and DNC](/artifacts/apac/singapore-pdpa/faq.md): FAQ answers for Singapore PDPA implementation, covering scope, accountability, consent, access and correction, security, retention, transfers, data intermediaries, breach notification, and DNC checks.
- [Singapore PDPA legitimate interests FAQ](/artifacts/apac/singapore-pdpa/faq/legitimate-interests.md): FAQ guidance on Singapore PDPA legitimate interests: assessment fields, adverse effects, mitigation, balancing, disclosure, records, and marketing limits.
- [Singapore PDPA NRIC Handling FAQ](/artifacts/apac/singapore-pdpa/faq/nric-handling.md): FAQ guidance on when Singapore organisations may collect, use, disclose, retain, mask, or replace NRIC and other national identification numbers under PDPC guidance.
- [Singapore PDPA NRIC Handling Rules](/artifacts/apac/singapore-pdpa/nric-handling.md): When Singapore organisations may collect, use, disclose, retain, mask, or replace NRIC numbers under PDPC guidance.
- [Singapore PDPA Penalties and Enforcement Cases](/artifacts/apac/singapore-pdpa/pdpa-penalties-and-enforcement-cases.md): How PDPC enforcement under Singapore's PDPA works: directions, voluntary undertakings, published decisions, financial penalty caps, and implementation lessons from cases.
- [Singapore PDPA Penalties and Fines](/artifacts/apac/singapore-pdpa/penalties-and-fines.md): Singapore PDPA penalty ceilings, PDPC directions, undertakings, breach notification context, and practical controls grounded in official PDPC and Singapore Statutes sources.
- [Singapore PDPA Privacy Policy Template](/artifacts/apac/singapore-pdpa/pdpa-privacy-policy-template.md): A Singapore PDPA privacy policy template for writing notices, DPO contact details, access and correction routes, retention, transfers, protection, withdrawal, and complaint handling without overclaiming compliance.
- [Singapore PDPA Requirements: Core Obligations](/artifacts/apac/singapore-pdpa/requirements.md): Map Singapore PDPA obligations across consent, notification, access, security, retention, transfers, accountability, breaches, DNC checks, and data intermediaries.
- [Singapore PDPA Scope, Exclusions, and Data Intermediaries](/artifacts/apac/singapore-pdpa/scope-exclusions-and-data-intermediaries.md): Classify Singapore PDPA coverage, business contact information, personal or domestic activity, employee acts, and data intermediary obligations with grounded implementation records.
- [Singapore PDPA Transfer Assessment Workflow](/artifacts/apac/singapore-pdpa/transfer-assessment-workflow.md): A Singapore PDPA workflow for assessing overseas personal data transfers, comparable protection, ASEAN MCCs, APEC CBPR/PRP certifications, vendor due diligence, onward transfers, and evidence records.
- [Singapore PDPA Transfer Clauses](/artifacts/apac/singapore-pdpa/transfer-clauses.md): Draft Singapore PDPA transfer clauses for overseas vendors, affiliates, data intermediaries, onward transfers, breach support, ASEAN MCCs, and APEC CBPR or PRP evidence.
- [Singapore PDPA transfer clauses FAQ](/artifacts/apac/singapore-pdpa/faq/transfer-clauses.md): FAQ guidance on Singapore PDPA transfer clauses, comparable protection, ASEAN MCCs, APEC CBPR and PRP certifications, onward transfers, and evidence records.
- [Singapore PDPA Vendor Outsourcing and Contracts](/artifacts/apac/singapore-pdpa/vendor-outsourcing-and-contracts.md): Contract and operating checklist for Singapore PDPA vendor outsourcing: data intermediary status, written terms, security, retention, breach, transfers, sub-contracting, and exit evidence.
- [Singapore PDPA vs GDPR Comparison](/artifacts/apac/singapore-pdpa/singapore-pdpa-vs-gdpr.md): Compare Singapore PDPA and GDPR implementation work across consent, DPO accountability, processors, transfers, breach notification, DNC marketing, rights, retention, and penalties.


---

[Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/apac/singapore-pdpa/deemed-consent-and-legitimate-interests