Skip to main content
Public Healthcare Institutions will NEVER ask you to transfer money over a phone call.

Call the 24/7 ScamShield helpline at 1799 to check, if you suspect a call to be a scam.

NHG Health Office of Human Research Protection Programme (OHRPP)

Personal Data Protection Act (PDPA)

Understand how the PDPA governs the collection, use, and disclosure of personal data. Learn the key principles of consent, purpose, and reasonableness that organisations must follow.

Last updated 8 July 2026

The purpose of the Personal Data Protection Act (PDPA) is to govern the collection, use and disclosure of personal data by organizations in a manner that recognizes both the right of individuals to protect their personal data, and the need of organizations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances.

PERSONAL DATA refers to data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which the organization has or is likely to have access.

This includes unique identifiers (e.g. NRIC number, passport number), as well as any set of data (e.g. name, age, address, telephone number, occupation, etc.) which when taken together would be able to identify the individual.

Researchers should note that the scope of PDPA only applies to identifiable data. The PDPA does not apply to data that is used in anonymized form.

The PDPA takes into account the following concepts:

  • Consent – organizations may collect, use or disclose personal data only with the individual's knowledge and consent (with some exceptions);

  • Purpose – organizations may collect, use or disclose personal data in an appropriate manner for the circumstances, and only if they have informed the individual of purposes for the collection, use or disclosure; and

  • Reasonableness – organizations may collect, use or disclose personal data only for purposes that would be considered appropriate to a reasonable person in the given circumstances.

References and Further Reading

For more information on the Personal Data Protection Act, please refer to the following websites:

NHG Health Data Protection Offices

Download the List of NHG Health DPOs and DP Offices here (opens in new tab). (Restricted: NHG Health Intranet access required)