How to Make a Complaint to the PDPC in Singapore

If an organisation has mishandled your personal data, you can raise it with the Personal Data Protection Commission, but there is a sequence to follow and there are limits on what the PDPC can do for you. This guide sets out both.

This is general legal information, not legal advice. Consult a qualified advocate and solicitor about your situation.

Information last verified on 22 July 2026. This page provides general legal information about Singapore law and is not legal advice in an individual case.

Step one: contact the organisation's DPO

The PDPC expects you to approach the organisation first. Every organisation must designate a Data Protection Officer, and your first step is to raise your concern with that DPO, setting out what happened and what you want the organisation to do about it.

Many complaints are resolved at this stage, because the organisation can correct the data, stop the unwanted use, or explain what occurred. The PDPC treats contacting the DPO as a precondition to escalation, so keep a record of when and how you contacted the organisation.

Step two: escalate to the PDPC

If the organisation does not respond, you can escalate to the PDPC. The PDPC states that you may bring the matter to it if you contacted the organisation's DPO but did not receive a response after 10 business days for a general concern, or after 30 business days for an access or correction request.

The two windows matter. The longer 30 business day window applies specifically to a request to access or correct your personal data, while a general concern uses the 10 business day window. When you escalate, provide the details of your concern and evidence of your earlier contact with the organisation.

What the PDPC does and does not do

The PDPC is a regulator. It can investigate a suspected contravention of the PDPA, issue directions to an organisation, and impose financial penalties. It looks at matters such as personal data collected, used or disclosed without consent, and personal data exposed through poor security, for example where one customer receives another customer's invoice.

There are things the PDPC does not do. It does not award damages or compensation to you, and it does not order an organisation to apologise. It also has no jurisdiction over an individual acting in a personal or domestic capacity, because the PDPA obligations do not apply to such an individual under s 4(1)(a). A complaint that is really about a private individual rather than an organisation is outside the PDPC's remit.

Getting compensation: the private right of action

If what you want is compensation, the route is not the PDPC but the courts. Section 48O of the PDPA gives an individual who suffers loss or damage directly as a result of a contravention a right of private action for relief in civil proceedings, and the court can award damages, an injunction or a declaration.

There is a timing gate built into s 48O. Where the PDPC has made a decision on the same contravention, the private action generally cannot be brought until that decision is final, with no further right of appeal. In practice this means the regulatory process and the compensation claim are sequenced rather than run in parallel. Because a private action is a court claim, it is sensible to take advice from an advocate and solicitor before starting one.

Where to go for the wider picture

For how the PDPA is structured as a whole, including the data protection obligations, breach notification and penalties, see the data protection and the PDPA section page. A shorter country-level summary sits in the Singapore entry in the world data privacy survey. If your concern is about online falsehoods rather than personal data, the separate POFMA regime is explained on the POFMA explained guide.