Definitions in Singapore
Definition of personal data
Personal data is defined in the Act to mean data, whether true or not, about an individual (whether living or recently deceased*) who can be identified from:
- that data; or
- that data and other information to which the organization has, or is likely to have access.
Note: The Act's application to recently deceased individuals is limited to disclosure and protection of personal data where such data is about an individual who has been deceased for ten years or fewer.
The data protection obligations under the Act do not apply to business contact information. This excludes from the Act the following if provided solely for business purposes:
- Name;
- Position name or title;
- Business telephone number;
- Business address;
- Business electronic mail address;
- Business fax number.
It is important to note that the Act still governs business contact information provided by individuals solely in their personal capacity. Where the purposes of provision of business contact information are mixed (that is, for both business and personal purposes), the Act does not apply.
Definition of sensitive personal data
There is no definition of sensitive personal data in the Act.
However, non-binding guidance from the Commission indicates that sensitivity of data is a factor for consideration in implementing policies and procedures to ensure appropriate levels of security for personal data. For example, encryption is recommended for sensitive data stored in an electronic medium that has a higher risk of adversely affecting the individual should it be compromised. Where any personal data collected is particularly sensitive (e.g. regarding physical or mental health), as a matter of best practice, such data should only be used for limited purposes and the security measures afforded to such data should take into account the sensitivity of the data.
In addition, the non-binding guidelines issued by the Commission also provide that, in its calculation of financial penalties for breaches of the Act, the Commission would consider whether the organization in question is in the business of handling large volumes of sensitive personal data, the disclosure of which may cause exceptional damage, injury or hardship to an individual (such as medical or financial data), but it has failed to put in place adequate safeguards proportional to the harm that might be caused by disclosure of such personal data.
The Commission has also issued a set of advisory guidelines to impose restrictions on the collection, use and disclosure of National Identification Registration Card (“NRIC”) numbers, due to the sensitive nature of the information contained in NRICs (and other similar forms of identification). Organizations are not permitted to collect either the NRIC number or the physical cards or other similar forms of identification unless the organization is permitted to do so under the law or if the collection is necessary for the verification of an individual's identity to “high degree of fidelity” (where it is extremely important the individual’s identity is verified, and failure to do so may, for example, pose a significant safety or security risk). That said, private organisations have until 31 December 2026 to phase out the use of NRIC numbers for authentication. From 1 January 2027, the Commission will step up enforcement action against private organisations that use full or partial NRIC numbers for authentication. Sector regulators such as the Ministry of Health have also issued complementary sector-specific guidance on ceasing of authentication based on NRIC numbers. The Commission and the Cyber Security Agency of Singapore also advise against the use of NRIC numbers by individuals as passwords.
The Commission has also made it clear in advisory guidelines that the personal data of children is generally considered to be sensitive personal data and must be accorded a higher standard of protection.
