Main Page

Client data would be protected under the Personal Data Protection Act 2012 (PDPA) to the extent that it consists of personal data, which is defined as 'data, whether true or false, about an individual able to be identified (a) through that data, or (b) through that data and other information to which the organisation has or is likely to have access'. There are two key components to the PDPA:

1. protection of an individual's personal data, including in relation to requiring consent, granting access and correction rights, requiring reasonable security and limiting transfers overseas; and
2. establishment of a do-not-call registry for individuals to opt out of receiving certain types of marketing messages addressed via Singapore telephone numbers. ¹

Internet protocol solutions, such as WhatsApp, may still be affected by the do-not-call registry regime since it sends out messages via Singapore phone numbers. The Personal Data Protection (Amendment) Act 2020 will raise the maximum financial penalty that could be imposed on organisations to a higher level of 10 per cent of their annual turnover in Singapore or S$1 million. However, the increased limit is not in effect yet and will only come into force at a future date which has yet to be announced.¹

Client data will also be protected by the common law obligation of confidentiality. Data recipients would be subject to confidentiality obligations when:

1. confidential as regards the giver of the data or information; and
2. imparted under circumstances where the recipient knew or ought to know that the data or information in question was confidential. ¹

It is possible to breach confidentiality if confidential information is disclosed without consent.¹

Singapore has specific regulations in place to ensure the protection of bank customers' information and the confidentiality of trust-related data, such as settlors' and beneficiaries' details. There is no existing legislation specifically aimed at regulating digital profiling; however, organizations running a profiling solution should take into consideration the PDPA and other related laws on privacy and data protection.¹

Cross-border payments in Singapore

Fintech in Singapore

Fintech in other countries

Notes

1. https://thelawreviews.co.uk/title/the-financial-technology-law-review/singapore