Singapore PDPA Legitimate interests FAQ

An organisation may rely on the Singapore PDPA legitimate interests exception to collect, use, or disclose personal data without consent only where the identified legitimate interests of the organisation or another person outweigh any adverse effect on the individual.

Treat the exception as a documented justification, not as a default replacement for consent. The assessment should identify the purpose, the personal data involved, how the data will be collected, used, or disclosed, whether the activity is one-off or continuous, who benefits, and why the interest is legitimate in the circumstances.

A useful assessment should mirror the PDPC checklist: define the context and purpose, list the personal data types, describe the collection, use, or disclosure, state whether the activity is one-off or continuous, identify the benefits, assess sensitivity and reasonableness, and document likely adverse effects.

The checklist is not mandatory, but PDPC says an organisation's own assessment should minimally cover purpose, reasonableness of purpose, whether the benefits clearly outweigh adverse effects, and the final decision outcome.

The assessment should name reasonably foreseeable adverse effects on individuals, including financial, social, physical, or psychological effects. It should also check whether other datasets will be used to make predictions or decisions, whether those predictions or decisions could exclude, discriminate against, defame, or harm an individual, and the likelihood and severity of the impact.

Mitigation must be concrete. Record measures that reduce, eliminate, or lower the likelihood of adverse effects, then reassess what residual adverse effects remain after those measures. The balancing test should explain why the legitimate interests outweigh the residual adverse effects; PDPC warns that this is not a simple count of affirmative answers.

The PDPA framework says organisations relying on the general legitimate interests exception should provide individuals reasonable access to information on the organisation's reliance on the exception. The assessment checklist also asks how the organisation provided contact details for someone who can give individuals more information about the collection, use, or disclosure.

Keep the completed assessment in a form that can explain the reliance if challenged or requested. At minimum, retain the purpose, data categories, benefit analysis, adverse-effect analysis, mitigation, residual-effect evaluation, balancing conclusion, further actions, outcome date, completed-by, endorsed-by, and management agreement fields.