Personal data must generally be collected directly from the data subject, unless: 

• the data is publicly available;
• the data subject consents to third party collection;
• direct collection impracticable;
• indirect collection is necessary for compliance with the laws; or
• direct collection would prejudice the lawful purpose. 

Data subject must be informed of: 

• the purpose of collection,
• the lawful basis of the collection; and
• intended recipients of the personal data. 

The data subject must be provided with clear consent mechanisms and afforded with a simplified means to withdraw their consent. 

Personal data collected must only be used for the intended purpose, unless: 

• the data subject consents to a further purpose;
• authorised or required by law;
• secondary/further purpose is directly related to the original purpose;
• data is anonymised for statistical/research purposes; or
• the use for a further purpose is necessary to prevent or lessen a serious and imminent harm or public health or safety. 

Processing must respect data subjects’ rights, including the right to: 

• be informed about the processing, description of the personal data being processed, the purposes for the processing and the recipients or classes of recipients the data;
• not be subject to solely automated decisions with significant effects;
• object to processing, including automated decision-making and profiling used for commercial advertising.

Where processing is by automated means, data controllers/processors must disclose the logic behind the decision-making, the purpose and effects of the processing, storage procedures and how adverse impacts will be addressed. Exceptions apply when the automated decision relates to inaccurate personal data, is required or authorised by the law or such notification is prohibited by a court order. 

Other data subject rights include:

• right to restriction of processing, if processing may cause substantial harm.
• right to erasure (right to be forgotten), where data is no longer needed, consent is withdrawn, the subject no longer wishes to continue processing, data is processed for direct marketing, processing is unlawful, erasure is required by law. Exceptions apply where the processing is necessary to exercise the right to freedom of information and expression, to fulfil a legal obligation or for public interest.
• right to rectification i.e., correction of inaccurate, outdated or misleading data. 

Sensitive personal data may only be processed with a prior written consent of the data subject or in cases where the data subject is a minor, a person of unsound mind or otherwise unable to consent, the data subject’s parents, guardians, heirs, attorneys or any other person recognized by the law to be acting on behalf of the data subject ("data subject’s legal representative"). 

Exceptions apply where processing is:

• necessary to comply with another law;
• required to protect vital interests;
• necessary for the institution, trial, or defence of legal claims;
• personal data has been made public by the data subject;
• necessary for scientific research under the PDPC guidelines; or
• necessary for medical reasons’ purposes in the data subject’s interest and under supervision of health professionals.