Ever wondered what a gym, a bank, an online shop or a former employer actually keeps on file about you? In Singapore you have a legal right to ask. Under the Personal Data Protection Act (PDPA), you can make a PDPA access request to find out what personal data an organisation holds about you and how it has been used, and you can ask it to correct mistakes.
This guide is written for individuals, not businesses. It explains your rights, how to write a request, what responses to expect, and what to do if an organisation does not reply. It is general information, not legal advice. For the full rules and current guidance, refer to the Personal Data Protection Commission (PDPC) website.
Your Two Main Rights: Access and Correction
The PDPA gives individuals several protections. The two you can actively use to find out what is held about you are:
- The right of access. You can ask an organisation for the personal data about you that is in its possession or under its control. You can also ask for information about the ways that data has been used or disclosed within roughly the year before your request.
- The right of correction. If personal data about you has an error or omission, you can ask the organisation to correct it. If it agrees, it should generally also send the corrected data to other organisations it disclosed the data to recently, where needed.
You also have the right to withdraw consent for an organisation to collect, use or disclose your data for a purpose, with reasonable notice. That is a separate request, and withdrawing may affect services you receive. Our overview of your personal data and privacy rights in Singapore covers the broader picture.
Who You Can and Cannot Ask
The PDPA applies to private sector organisations, which covers most companies you deal with: retailers, banks, telcos, insurers, clinics, gyms, property agents, apps and employers.
It does not apply to public agencies such as government ministries and statutory boards. They follow separate public sector data rules. If you want to know what a government agency holds, contact that agency directly and ask how it handles such requests.
Some categories of data and situations have specific exceptions under the Act. For example, an organisation may not have to share certain opinion data kept for evaluative purposes, or information that could reveal another person’s personal data. The PDPC’s guidelines list these exceptions in detail.
How to Make a PDPA Access Request, Step by Step
- Find the Data Protection Officer. Organisations must appoint a Data Protection Officer (DPO) and make business contact details available. Look in the privacy policy or data protection notice on the website, usually linked at the bottom of the page.
- Put your request in writing. Email is fine and gives you a record. Some organisations have their own online form; using it can speed things up.
- Be specific. Say exactly what you want, for example “all personal data you hold about me in connection with my membership” or “recordings of my calls with your customer service in a given month”. A focused request is easier to fulfil.
- Identify yourself. Give enough detail for the organisation to find your records, such as your full name, contact details and account or membership number. Expect it to verify your identity before releasing anything; that protects you too. Avoid sending more sensitive documents than it actually asks for.
- Ask about usage and disclosure, if relevant. If you want to know who your data was shared with, say so.
- Keep a copy of your request and note the date you sent it.
A short sample request:
Dear Data Protection Officer, under section 21 of the Personal Data Protection Act 2012, I request access to the personal data you hold about me, and information about how it has been used or disclosed in the past year. My name is [name], my account number is [number], and you can reach me at [email]. Please let me know if you need anything further to verify my identity.
What to Expect After You Ask
| Stage | What usually happens | What you can do |
|---|---|---|
| Acknowledgement | The organisation confirms receipt and may ask to verify your identity | Reply promptly with what is reasonably requested |
| Fee notice | For access requests, it may tell you about a reasonable fee to cover its costs | Ask for an estimate before it starts; you can narrow the request |
| Response timing | It should respond as soon as reasonably possible; if it needs longer than the PDPC’s set timeframe, it should tell you when it expects to respond | Note the dates in case you need to escalate |
| Outcome | You receive the data, a partial response with reasons, or a refusal citing an exception | Ask which exception applies if it is unclear |
Two points worth knowing. First, organisations may charge a reasonable fee for access requests, but should not charge for correction requests. Second, for correction, the organisation may decide not to correct the data if it has reasonable grounds; in that case it should annotate the data with the correction you asked for but did not make. Check the current specifics, including the response timeframes, on the PDPC website, as guidance is updated from time to time.
Making a Correction Request
Correction requests work in the same way. Write to the DPO, explain what is wrong, and give the correct information with supporting proof if you have it, such as a new address or an updated name. Common examples include outdated contact details, a misspelt name that keeps causing problems, or an incorrect record of a past transaction.
If the Organisation Does Not Respond or Refuses
Start by following up politely with the DPO, quoting your first request and its date. Many delays are simple oversights.
If that does not work, you can contact the PDPC. It can look into complaints about how organisations handle access and correction requests, and in some cases help resolve disputes or review an organisation’s response. The PDPC website explains how to lodge a complaint and what information to include. Keep copies of your emails and any replies; they make the process much smoother.
Practical Tips Before You Send
- Start with one organisation. If you are worried about data spreading widely, our guide to understanding data brokers and your personal data explains how information is shared and resold.
- Use a dedicated email address for these requests so replies are easy to track.
- Be reasonable in scope. Asking for “everything ever” from a large company may mean a longer wait or higher fee.
- Combine requests if useful. You can ask for access and withdraw consent for marketing in the same letter, as separate points.
- Remember the Do Not Call Registry for unwanted marketing calls and messages; it is separate from an access request.
If you run a business and are on the receiving end of these requests, our guide on PDPA and data protection for SMEs covers your obligations.
Knowing what is held about you is the first step to keeping it accurate and under control. A clear, polite written request is usually all it takes.
Frequently Asked Questions
Can I ask a company for CCTV footage of myself under the PDPA? Video of you can count as your personal data, so you can ask the organisation, but it may refuse if the footage would reveal other people’s data or if an exception applies. Give the date, time and place to narrow the request, and expect a possible fee.
Can I request my employment records from a former employer? You can make an access request to a former employer in the same way, since the PDPA covers private sector employers. The organisation may withhold some evaluative opinion data under exceptions, so be specific about what you need and check the PDPC guidance.
Can I ask a company to delete my personal data? You cannot demand deletion outright under the access and correction rights, but you can withdraw consent for it to use your data for a purpose. Once you do, the organisation may need to stop using it unless it has another lawful reason to keep it. Ask the DPO for details.
Does the PDPA protect foreigners living in Singapore? The PDPA is about the personal data that organisations collect, use or disclose in Singapore, so it generally covers data of individuals whatever their nationality. If you are unsure whether your situation falls under it, check the PDPC website or ask the organisation’s DPO.
What should I do if my data was leaked in a breach? Read any notice from the organisation, change the affected passwords and watch for phishing calls and messages. Ask the DPO what was exposed and what it is doing. If the organisation seems to have handled it badly, you can raise it with the PDPC.
Further reading: How to Stop Your Data Being Used to Train AI · Using Myinfo and Data Sharing