Singapore Recording Laws: Consent Rules and Penalties (2026)

Quick Answer: Singapore Recording Laws

Singapore is effectively a one-party consent jurisdiction for private individuals. There is no statute that prohibits a participant from recording their own conversation, whether in person or by phone, without telling the other party.

The one-party rule comes with real limits. If the recording captures confidential information and you later share or use it, you face liability for breach of confidence. Organizations are subject to a completely different regime: the Personal Data Protection Act 2012 (PDPA) requires consent and prior notification before any business-related recording.

Singapore's patchwork framework rests on five pillars:

1. Personal Data Protection Act 2012 (PDPA) - governs all organizational recording
2. Penal Code 1871 - voyeurism offenses (sections 377BB-377BE) and general criminal provisions
3. Computer Misuse Act 1993 - unauthorized third-party interception
4. Protection from Harassment Act 2014 (POHA) - harassment by recording, stalking, NCII
5. Common law breach of confidence - civil liability for misuse of confidential recordings

The absence of a wiretapping statute does not mean Singapore is permissive. Misuse of recordings draws civil suits, PDPA financial penalties up to S$1 million, and criminal sanctions including caning.

Personal Data Protection Act 2012 (PDPA)

The Personal Data Protection Act 2012 is the cornerstone of Singapore's data privacy regime. Enacted in 2012 and brought into force in phases from January 2013, the PDPA establishes comprehensive rules for how organizations collect, use, and disclose personal data, which expressly includes voice and video recordings of identifiable individuals.

The PDPA applies to organizations, not to individuals acting in a personal or domestic capacity. This distinction is fundamental: an individual recording their own conversation for personal reasons is outside the PDPA's scope entirely.

Consent Obligation (Section 13)

Section 13 requires organizations to obtain the consent of individuals before collecting, using, or disclosing their personal data. For recordings, this means a business must inform the person that a recording is taking place and obtain agreement before the recording begins.

The PDPA recognizes three forms of consent:

• Express consent (Section 14): Consent given explicitly, whether verbally, in writing, or through a clear affirmative action.
• Deemed consent (Section 15): Implied when an individual voluntarily provides personal data for a purpose a reasonable person would regard as appropriate.
• Deemed consent by notification (Section 15A): Introduced by the 2020 amendments, this allows an organization to notify individuals of a purpose and proceed if the individual does not opt out within a reasonable period. This mechanism is used for CCTV notices posted at premises.

Notification Obligation (Section 20)

Before or at the time of collection, organizations must notify individuals of the purposes for which their personal data is being collected. In a recording context, this means clearly stating that a call or meeting is being recorded and explaining why, before the recording starts.

Purpose Limitation Obligation (Section 18)

Recordings may only be used for the purposes communicated to the individual. A business that records calls for quality assurance cannot later use those recordings for marketing or disciplinary purposes without obtaining fresh consent. This is an ongoing obligation, not a one-time checkbox.

PDPA Penalties

The Personal Data Protection Commission (PDPC) enforces the PDPA and can impose financial penalties following the enhanced penalty framework that took effect on 1 October 2022:

Organization Size	Maximum Penalty
Annual local turnover up to S$10 million	S$1 million
Annual local turnover exceeding S$10 million	10% of annual turnover in Singapore

Individuals who suffer damage from PDPA breaches may also bring civil claims under Section 48O for injunctions, declarations, and compensation.

2020 Amendments and Recent Developments

The Personal Data Protection (Amendment) Act 2020 introduced mandatory data breach notification, higher financial penalties, expanded consent exceptions, and a data portability framework. The PDPC has been increasingly active in enforcement. In a 2025 enforcement action, the PDPC imposed a financial penalty of S$315,000 on Marina Bay Sands Pte Ltd for failing to protect member personal data.

The PDPC Advisory Guidelines on the PDPA for Selected Topics (revised May 2024) provide granular guidance on workplace surveillance, CCTV deployment, and the consent framework for various recording scenarios.

Phone Call Recording in Singapore

Private Individuals

For individuals calling in a personal capacity, Singapore has no statute that prohibits recording your own phone call. You are not required to notify the other party. The legal risk arises after the call: if the conversation contains confidential information and you later share or use the recording, a breach of confidence claim becomes possible.

The Computer Misuse Act 1993 does not apply to participant recording. Section 6 of that Act targets unauthorized third-party interception of electronic communications by means of an electromagnetic, acoustic, mechanical, or other device. If someone other than a participant intercepts your call without authority, the penalties are:

• First offense: Fine up to S$10,000, imprisonment up to 3 years, or both
• Subsequent offenses: Fine up to S$20,000, imprisonment up to 5 years, or both
• If damage is caused: Fine up to S$50,000, imprisonment up to 7 years, or both

Organizations

Businesses must notify callers before recording begins. Most Singapore call centres and businesses use an automated message such as "This call may be recorded for quality and training purposes" as the notification mechanism. Proceeding to record after this message constitutes deemed consent by notification under Section 15A of the PDPA, provided callers are given a realistic opportunity to object.

Recordings must be retained only as long as necessary for the stated purpose and must be securely deleted when no longer needed. The purpose-limitation obligation also extends to archived recordings: data collected for quality assurance cannot be repurposed for performance management reviews without revisiting consent.

Penal Code 1871: Breach of Confidence and General Provisions

The Penal Code 1871 does not contain a wiretapping provision, but several sections interact with recording conduct.

Breach of Confidence (Common Law)

The most significant civil risk for individuals who record comes from the common law tort of breach of confidence. The Singapore Court of Appeal established the modern framework in I-Admin (Singapore) Pte Ltd v Hong Ying Ting [2020] SGCA 32. Under this framework, a claimant must show that:

1. The information possesses the necessary quality of confidence.
2. The information was imparted in circumstances that impose an obligation of confidence.
3. There was unauthorized use or disclosure.

A key development in I-Admin was placing the burden on the defendant to demonstrate that their conscience is unaffected by the unauthorized use. This matters in recording disputes because the person who made the recording must affirmatively justify why using or disclosing the recorded confidential information was appropriate. A 2024 Court of Appeal decision ([2024] SGCA 16) further elaborated on the law of confidence, reinforcing this framework.

Admissibility of Secretly-Made Recordings

Singapore courts generally admit all relevant evidence regardless of how it was obtained. A secretly-made recording of a conversation you participated in can be tendered as evidence in civil and criminal proceedings. The Singapore judiciary expressly accepts audio recordings, video footage, and CCTV captures for Protection from Harassment Act cases.

The admissibility of a recording and the legality of creating it are treated as distinct questions. Submitting a recording as evidence does not provide immunity from civil or criminal consequences that flow from making or sharing it.

Cheating and Criminal Defamation

If a recording is used to deceive another person for financial advantage, Section 415 (cheating) or Section 420 of the Penal Code may apply. Where a recording is fabricated or edited to impute something false to an identifiable person, Section 499 (criminal defamation) carries imprisonment up to two years, a fine, or both under Section 500.

Protection from Harassment Act 2014 (POHA)

The Protection from Harassment Act 2014 addresses harassment, stalking, and related conduct. POHA does not create a general consent requirement for recording, but it governs how recordings are used after the fact.

Section 3 and Section 4: Harassment Offenses

Section 3 of POHA prohibits conduct intended to cause harassment, alarm, or distress, including through communications. Section 4 covers acts likely to cause harassment, alarm, or distress even without intent. Using a recording to intimidate, humiliate, or repeatedly contact someone can constitute a Section 3 or Section 4 offense.

Penalties under Sections 3 and 4:

• Fines up to S$5,000 and/or imprisonment up to 6 months
• Doubled for repeat offenders

Section 7: Unlawful Stalking

Section 7 of POHA criminalizes stalking. Covert recording as part of a pattern of monitoring and following a person is captured by Section 7's prohibition on "acts associated with stalking," which include:

• Photographing, filming, or recording a person
• Monitoring a person's use of the internet, telephone, or other electronic communications
• Following a person

A key element is that the course of conduct must cause harassment, alarm, or distress to the victim or a related person. Penalties include fines up to S$5,000 and/or imprisonment up to 12 months; on a second conviction the penalties double.

Protection Orders and Other Remedies

Victims of harassment by recording may apply to the Protection from Harassment Court for protection orders, stop publication orders, and expedited orders. Courts can issue stop publication orders requiring the immediate removal of online content, sometimes within 48 hours.

Voyeurism and Non-Consensual Intimate Recordings

Singapore's most detailed and severe recording offenses are the voyeurism provisions introduced into the Penal Code in 2020, replacing the former Section 509.

Section 377BB: Voyeurism

Section 377BB criminalizes intentionally observing or recording another person in circumstances where there is a reasonable expectation of privacy, without consent. The offense captures:

• Recording someone in a bathroom, changing room, or bedroom
• Using a device to view or capture private body parts (genitals, buttocks, breasts) that would not otherwise be visible
• Installing a camera or other device to facilitate such observation or recording

Penalties under Section 377BB(7):

• Imprisonment up to 2 years, or a fine, or caning, or any combination
• If the victim is under 14: mandatory imprisonment, plus fine or caning

In Nicholas Tan Siew Chye v Public Prosecutor [2023] SGHC 35, the General Division of the High Court established that deterrence is the dominant sentencing principle for Section 377BB offenses. The court adopted a harm-and-culpability matrix with these starting points:

• Low harm, low culpability: Fine or up to 4 months
• Moderate harm, moderate culpability: 8 to 12 months with possible caning
• High harm, high culpability: 18 to 24 months with caning

Section 377BC: Distribution of Voyeuristic Content

Section 377BC makes it an offense to distribute or possess for distribution any recording obtained through voyeurism, knowing or having reason to believe that the recording was obtained without the victim's consent.

Penalties:

• Imprisonment up to 5 years, or a fine, or caning, or any combination
• Mandatory imprisonment plus fine or caning if the victim is under 14

Section 377BD: Possession of Voyeuristic or Intimate Images

Section 377BD criminalizes possession of or access to voyeuristic or intimate images, where the person knows or has reason to believe the images were obtained without consent or that possession is likely to cause humiliation, alarm, or distress.

Physical possession of the original device is not required. Access to electronic data, such as files stored in a cloud account or on a remote server, is sufficient to establish the offense.

Penalties:

• Imprisonment up to 2 years, or a fine, or caning, or any combination
• Mandatory imprisonment plus fine or caning if the victim is under 14

Section 377BE: Distributing Intimate Images

Section 377BE specifically targets the distribution of intimate images or recordings without the subject's consent (commonly called non-consensual intimate imagery or NCII). The offense applies regardless of whether the original recording was made with consent. Threatening to distribute intimate images without consent also constitutes a distinct criminal offense.

The High Court in Public Prosecutor v GED [2022] SGHC 301 set out a detailed sentencing framework for Section 377BE offenses using harm (slight, moderate, severe) and culpability (low, medium, high). Indicative sentencing ranges are:

Culpability	Slight Harm	Moderate Harm	Severe Harm
Low	Fine or up to 6 months	6-15 months	15-30 months
Medium	6-15 months	15-30 months	30-45 months with caning
High	15-30 months	30-45 months with caning	45-60 months with caning

Caning is presumptively warranted where bare intimate regions are captured or where content is widely disseminated with the victim identifiable.

Deepfakes and AI-Generated Intimate Images

Current Law

The current Section 377BE definition of "intimate image" was drafted to include images created by altering or manipulating existing recordings or images. A fully synthetic AI-generated intimate image that does not derive from an actual recording of the victim sits in a legal gap: it may not meet the current statutory definition.

Prosecutors and victims can currently rely on adjacent provisions:

• Section 499 (criminal defamation): AI-generated intimate images falsely attributing conduct to an identifiable person can constitute defamation, carrying up to two years imprisonment under Section 500.
• Section 415 (cheating): Deepfakes used to deceive victims for financial gain engage the cheating provisions.
• POHA Sections 3 and 4: Distributing a deepfake to cause harassment, alarm, or distress constitutes a harassment offense.
• Films Act Section 29-30: Possessing or distributing obscene films, which may include deepfake pornographic videos, carries fines up to S$20,000 and imprisonment up to six months.

Proposed Criminal Law (Miscellaneous Amendments) Bill 2025

In October 2025, Singapore's Ministry of Home Affairs introduced the Criminal Law (Miscellaneous Amendments) Bill for first reading. The Bill proposes to extend the definition of "intimate image" in Section 377BE to include completely synthetic AI-generated material that does not alter an existing image. The Bill also introduces a new standalone offense of producing intimate images without consent, including AI-generated versions, with penalties equivalent to Section 377BB (up to two years imprisonment, fine, or caning).

This Bill responds directly to the gap identified in the current law. Once passed, Singapore's regime will cover the full spectrum from voyeuristic recording through to AI-generated NCII at the production, distribution, and possession stages.

Online Safety Codes

The Infocomm Media Development Authority's (IMDA) Online Safety Code, effective July 2023, requires designated social media services to proactively reduce exposure to harmful content including NCII. Designated services face operational obligations to remove such content promptly.

Online Criminal Harms Act 2023 (OCHA)

The Online Criminal Harms Act 2023 commenced in part on 1 February 2024, with codes-of-practice provisions taking effect on 24 June 2024. OCHA operates primarily as a platform-regulation statute rather than an individual-conduct law.

OCHA empowers designated officers to issue directions to online service providers and individuals when there is reasonable suspicion that an online activity is in furtherance of a scheduled criminal offense. Relevant directions in the recording context include:

• Stop Communication Directions: Requiring an online platform to remove or restrict access to content
• Account Restriction Orders: Restricting or suspending accounts used to facilitate criminal activities
• Implementation Directives: Requiring platforms to implement systems to detect and counter criminal content

OCHA covers offenses affecting national security, national harmony, and individual safety with an online nexus. Distribution of voyeuristic or NCII content online could trigger OCHA powers in addition to direct criminal liability under the Penal Code. The Elections (Integrity of Online Advertising) (Amendment) Act 2024 also prohibits deepfake content depicting election candidates during election periods, with fines up to S$1,000 and/or imprisonment up to 12 months for individuals.

Recording Police Officers in Singapore

There is no statute in Singapore that specifically prohibits filming or recording police officers in a public place in the ordinary course of their duties. Recording a police arrest, confrontation, or public interaction is generally lawful.

However, several restrictions apply:

• Protected Areas: Under the Protected Areas and Protected Places Act, it is an offense to photograph or film a police station or any designated protected area without authorization. Penalties include fines up to S$20,000 and/or imprisonment up to two years.
• Obstruction: If recording physically interferes with police operations, Section 353 of the Penal Code (assault or criminal force on a public servant in execution of duty) and related provisions could apply.
• Special Emergency Powers: Under emergency or special incident powers granted to the Commissioner of Police, authorities may prohibit photographing or filming defined areas during operations where doing so would compromise law enforcement effectiveness.
• Public Order Act 2009: Filming activities may be subject to directions given by a police officer managing a public order situation.

Practically, the Singapore Police Force expects bystanders to maintain a safe distance from active operations. Recording from a distance without obstructing officers remains lawful.

Workplace Recording

Employees Recording Colleagues or Management

No Singapore statute explicitly prohibits an employee from recording a workplace conversation they are a party to. An employee who records a disciplinary meeting, performance review, or confrontation with management does not commit a criminal offense by making that recording.

The legal risks come at the disclosure stage. If the recording captures confidential business information and the employee shares it with competitors, press, or other third parties, the employer may bring a breach of confidence claim. Employment contracts in Singapore frequently include confidentiality provisions; breaching these through unauthorized disclosure of recorded information can constitute grounds for disciplinary action or dismissal.

Employer Surveillance and CCTV

Employers in Singapore may deploy CCTV cameras and other monitoring tools, but must comply with the PDPA. The PDPC Advisory Guidelines (revised May 2024) set out the requirements:

• Notice is required: Employers must display clear, visible notices informing employees and visitors that CCTV is in operation, before they enter the monitored area.
• Legitimate purpose: Monitoring must serve a legitimate business purpose such as security, loss prevention, or safety.
• Data minimization: Footage should be retained only as long as reasonably necessary for the stated purpose.
• Access controls: Only authorized personnel should be able to view or access recordings.
• Covert surveillance is restricted: Secret monitoring is generally not permissible under the PDPA unless there is a specific, documented justification such as investigating credible suspicion of criminal conduct.

The Employment Act does not impose additional consent requirements for workplace monitoring beyond the PDPA, but employers should establish a documented monitoring policy and communicate it to employees.

PDPA Employment Exemption

Section 17 and the Second Schedule of the PDPA allow employers to collect, use, and disclose employee personal data without consent when it is reasonably necessary for managing or terminating the employment relationship or for evaluative purposes such as performance appraisal or determination of suitability for promotion. Recordings made for these purposes do not require individual consent, provided the purpose is genuine and the data use is proportionate.

Recording in Public Places

Singaporean law generally permits photography and video recording in public spaces. There is no statute requiring consent before capturing individuals on the street, at public events, or in shopping areas.

The key limitation is reasonable expectation of privacy. Even in nominally public spaces, recording someone in a changing area, a toilet cubicle, or in a manner that captures intimate body parts constitutes voyeurism under Section 377BB regardless of whether the location is technically accessible to the public.

Additional restrictions include:

• Commercial use: When recordings of identifiable individuals in public are used for commercial purposes, the PDPA may require consent from those depicted.
• Protected places: Photography at designated protected areas including government facilities, military installations, and police stations is prohibited without authorization.
• Filming permits: Recording on public streets does not require a permit (subject to not obstructing traffic), but filming inside shopping malls, commercial buildings, and managed public facilities typically requires property owner permission.
• POHA: Using recordings to systematically monitor, harass, or intimidate a person violates POHA regardless of whether the recording occurs in public.

Cross-Border Recording

When a call or communication crosses national borders, the recording laws of multiple jurisdictions can apply simultaneously. A call between Singapore and Australia, for example, may engage both Singapore's PDPA and Australian state consent laws.

The practical risk-management approach is to comply with the stricter of all applicable jurisdictions. For organizations, this typically means obtaining express consent from all parties before recording any international call, rather than relying on Singapore's deemed consent by notification mechanism.

PDPA extraterritorial reach: Section 26 of the PDPA governs cross-border data transfers. An organization in Singapore that records a conversation with a party overseas collects personal data in Singapore; the PDPA applies to that recording. When the recording is subsequently transferred outside Singapore, the organization must ensure the receiving party maintains a comparable standard of protection.

Computer Misuse Act extraterritorial reach: The Computer Misuse Act applies to any person, regardless of nationality or location, where the relevant computer or electronic communication is located in Singapore. A person overseas who intercepts a communication passing through Singapore infrastructure may face liability.

For businesses managing international contact centres, the safest practice is a uniform consent-first approach: provide a clear recording notification in the appropriate language for each jurisdiction and allow callers the option to decline before recording begins.

Business Compliance Summary

Organizations operating in Singapore that record conversations or deploy surveillance should implement the following:

Requirement	Action	PDPA Reference
Consent	Obtain consent or notify before recording	Section 13, 15A
Notification	Inform individuals of recording purpose before it starts	Section 20
Purpose limitation	Use recordings only for the stated purpose	Section 18
Access controls	Restrict access to authorized personnel only	Section 24
Retention limits	Delete recordings when no longer needed	Section 25
Data breach response	Notify PDPC of mandatory-notification breaches	Section 26D
Data protection officer	Designate a DPO for the organization	Section 11(3)
Cross-border transfers	Ensure comparable protection before transfer	Section 26

Individuals vs. Organizations: Side-by-Side

Scenario	Individuals	Organizations
Recording own conversations	Generally permitted, no notification needed	Must notify and obtain consent under PDPA
Recording phone calls	No specific prohibition	Must notify caller before recording begins
CCTV / monitoring	Subject to voyeurism laws	Must comply with PDPA, display notices
Sharing recordings	Risk of breach of confidence civil claim	Must comply with PDPA disclosure rules
Recording in public	Generally permitted, voyeurism exceptions apply	PDPA commercial-use consent requirement
Penalties for violations	Civil liability, criminal sanctions for voyeurism	Financial penalties up to S$1M or 10% of turnover