Singapore PDPA — Children's Guidelines

Ensure children aged 13-17 can understand consent consequences; obtain parental consent if understanding is insufficient

PDPC Advisory Guidelines on Children's Personal Data, Section 3.2 - Consent for Children Aged 13 to 17 · Read the full page →

Enable parents and age-appropriate children to access and correct personal data, with responses within 30 days

PDPA Sections 21-22; PDPC Advisory Guidelines on Children's Personal Data, Section 9 - Access and Correction · Read the full page →

Implement comprehensive accountability measures including DPO designation, children-specific policies, staff training, and regular compliance audits

PDPA Sections 11-12; PDPC Advisory Guidelines on Children's Personal Data, Section 13 - Accountability · Read the full page →

Implement proportionate age assurance mechanisms to identify child users and ensure age-appropriate access

PDPC Advisory Guidelines on Children's Personal Data, Section 4 - Age Assurance Mechanisms · Read the full page →

Algorithmic profiling of children requires enhanced safeguards including transparency, opt-out mechanisms, and human review of consequential decisions

PDPC Advisory Guidelines on Children's Personal Data, Section 10 - Algorithmic Profiling · Read the full page →

Notify PDPC within 3 days and parents or guardians when a data breach involving children's data is likely to cause significant harm

PDPA Sections 26A-26E; PDPC Advisory Guidelines on Children's Personal Data, Section 11 - Data Breach Notification · Read the full page →

Restrict cross-border transfers of children's data to jurisdictions with comparable protection and implement additional safeguards

PDPA Section 26; PDPC Advisory Guidelines on Children's Personal Data, Section 14 - Transfer Limitation · Read the full page →

Data intermediaries processing children's data on behalf of organisations must comply with protection and retention obligations; the principal organisation remains accountable

PDPA Section 4(2); PDPC Advisory Guidelines, Section 6 - Data Intermediaries · Read the full page →

Collect only the minimum personal data necessary from children and do not condition service access on excessive data collection

PDPA Section 18; PDPC Advisory Guidelines on Children's Personal Data, Section 7 - Data Minimisation · Read the full page →

Comply with Do Not Call Registry requirements and exercise heightened caution when marketing to or via channels used by minors

PDPA Part IX - Do Not Call Registry; PDPC Advisory Guidelines on Children's Personal Data, Section 12 - Direct Marketing to Children · Read the full page →

Conduct Data Protection Impact Assessments before launching or significantly changing services that process children's data

PDPC Advisory Guidelines on Children's Personal Data, Section 5 - Data Protection Impact Assessment · Read the full page →

Organisations should align with IMDA's Code of Practice for Online Safety and relevant advisory guidelines when processing children's data

PDPC Advisory Guidelines on Children's Personal Data, Section 16 - IMDA Code Alignment · Read the full page →

Apply children's data protection guidelines to all services likely to be accessed by children, including those not specifically designed for them

PDPC Advisory Guidelines on Children's Personal Data, Section 2 - Scope and Applicability · Read the full page →

Financial penalties up to S$1M (or 10% of turnover) per breach, with aggravating factors for children's data violations

PDPA Sections 48A-48O; PDPC Advisory Guidelines on Children's Personal Data, Section 15 - Enforcement and Penalties · Read the full page →

Restrict the purposes for which children's data may be collected, used, or disclosed to those a reasonable person would consider appropriate for children

PDPA Sections 18-20; PDPC Advisory Guidelines on Children's Personal Data, Section 6 - Purpose Limitation · Read the full page →

Retain children's personal data only as long as necessary and implement shorter retention periods with automated deletion

PDPA Section 25; PDPC Advisory Guidelines on Children's Personal Data, Section 8 - Retention Limitation · Read the full page →

Obtain verified parental or guardian consent before collecting, using, or disclosing personal data of children under 13

PDPC Advisory Guidelines on Children's Personal Data, Section 3.1 - Consent for Children Under 13 · Read the full page →

Provide clear mechanisms for parents and children to withdraw consent and cease data processing without penalty

PDPA Section 16; PDPC Advisory Guidelines on Children's Personal Data, Section 10 - Withdrawal of Consent · Read the full page →