Singapore PDPA: What personal-data rules mean for cookies and website tracking

When should your business review PDPA?

Review the law when your activities involve personal data in Singapore and fall within its scope. A small team or low turnover does not create a general exemption from the main obligations.

Personal data concerns an individual who can be identified from the information alone or together with other information the organisation has or is likely to access.

The PDPC’s overview of data protection obligations is a useful starting point. Assess overseas operations and local data flows in context rather than assuming the location of your company settles the question.

How the rules apply to cookies

Some cookies may involve no personal data. Others connect browsing behaviour to an account, device identifier or profile that makes the individual identifiable.

The PDPC’s Advisory Guidelines on Selected Topics include specific guidance on cookies. The purpose and information collected determine the analysis.

Consent can take different forms under Singapore’s rules, including deemed consent in qualifying circumstances, and statutory exceptions may apply. None of those options should become a blanket “continued browsing means yes to everything” statement.

Five things to get right

1. Identify personal data and the intended purpose

Start with your website’s tools and collection points. Review analytics, account features, advertising, booking tools and embedded services.

For each, record whether the information identifies a person or can do so when combined with other accessible data. Describe the actual purpose: completing a booking, measuring a campaign and building a remarketing audience are different uses.

Remove collection that is unnecessary for a reasonable purpose. Having access to more fields or events in a tool does not mean your business needs to use them.

2. Choose the correct permission route

The PDPA generally requires consent for collection, use and disclosure unless a relevant provision or exception applies. Assess the specific conditions before relying on deemed consent or an exception.

The PDPC’s Key Concepts guidelines explain the consent framework and related obligations.

For optional advertising tracking, a clear affirmative choice is a practical way to make the customer’s decision understandable. If your business relies on a different permitted route, document why it applies and what safeguards or notifications it requires. Do not present your chosen banner design as the only possible legal approach.

3. Notify people clearly

Tell individuals the purposes for collecting, using and disclosing their personal data. Do this at the appropriate time, with information people can find and understand.

The PDPC’s notification guide provides practical guidance. On a website, a short explanation linked to useful detail is often easier to act on than a dense first-screen policy.

Align the banner, form wording and privacy notice. If a newsletter signup also sends information to an advertising platform, review whether that additional use is properly explained and permitted.

4. Make withdrawal and requests practical

Provide a way to withdraw consent with reasonable notice and explain relevant consequences. Stop the consent-based collection, use or disclosure after withdrawal as required, unless another applicable legal permission allows it to continue.

Keep the process separate from general account closure. A customer may want to stop optional tracking while continuing to use a service.

Support applicable access and correction requests. Avoid importing every GDPR right into a Singapore policy as though the laws were identical. If you voluntarily offer broader rights, make sure you can honour the promise.

5. Control retention, suppliers and overseas transfers

Keep personal data only while a business or legal purpose justifies retention. Use appropriate security and review what connected suppliers can do with the information.

The PDPC explains organisations and data intermediaries. Outsourcing processing does not make the commissioning organisation’s responsibilities disappear.

Where information is transferred overseas, assess the transfer limitation obligation and comparable protection requirements. Identify an accountable privacy contact and make the required contact information available.

A practical booking example

A customer provides contact details to reserve a service. Processing needed for that booking and optional advertising use should be assessed separately.

Do not assume that entering an email address to receive a booking confirmation also authorises every future marketing use. Explain the purposes and use the appropriate permission route.

If the customer withdraws optional tracking consent, test the browser, booking integration and relevant exports. A visible “off” setting should not coexist with the same consent-based advertising use continuing elsewhere.

What this means for marketing

Cookie choices, email marketing and telephone marketing are related operationally but do not have identical rules. Singapore’s Do Not Call provisions are a separate consideration for relevant marketing to Singapore telephone numbers.

Keep these permissions distinct in your customer platform. A single “marketing consent” field can hide different channels, purposes and legal conditions.

For reporting, distinguish information you can lawfully use from information you would merely like to have. Explain any gaps without treating them as a reason to override the customer’s choice.

Website checklist

• Check personal data: assess identifiers and combinations, not just names.
• Check purposes: map each tool to a specific, reasonable use.
• Check permission: document consent, deemed consent or the applicable exception.
• Test choices: verify that consent-dependent activity matches the selection.
• Test withdrawal: include relevant suppliers and downstream uses.
• Check information: align notices, forms and settings.
• Check operations: review retention, security and overseas transfers.
• Test requests: make access, correction and privacy contact routes usable.

FAQ