Consent is not the only lawful basis, and it is often the weakest. It can be withdrawn, it must be freely given, and it cannot be bundled into terms as a condition of a service beyond what is reasonably required. Where another basis genuinely applies, use it — but identify it and, where required, assess and document it before relying on it.
Consent and Notification
Collecting personal data lawfully
Consent is not the only lawful basis, and it is often the weakest. It can be withdrawn, it must be freely given, and it cannot be bundled into terms as a condition of a service beyond what is reasonably required. Where another basis genuinely applies, use it — but identify it and, where required, assess and document it before relying on it.
| Item | Detail |
|---|---|
| Organisation | [COMPANY NAME], UEN [UEN] |
| Data Protection Officer | [NAME], [EMAIL], [PHONE] |
| Version | [NUMBER], effective [DATE] |
| Applies to | [Customers / Employees / Applicants / Website visitors / Event attendees] |
| Review | Annually and on any change to processing |
1. Choosing the Basis
| Basis | When it applies | What is required of us |
|---|---|---|
| Consent | Where no other basis fits and the individual can genuinely choose | Clear notification of purposes; voluntary agreement; a route to withdraw |
| Deemed consent by conduct | The individual voluntarily provides data for an obvious purpose — giving a card to make a booking | The purpose must be genuinely obvious |
| Deemed consent by contractual necessity | Disclosure necessary to conclude or perform a contract the individual requested | Notification, and limited to what is necessary |
| Legitimate interests | Where the benefit to the public or a section of it outweighs adverse effect on the individual | An assessment must be carried out and documented before relying on it; disclose reliance |
| Business improvement | Improving or developing goods, services, methods or processes; learning about customer needs | Confined to the permitted purposes; assessment where required |
| Research | Research and development meeting the prescribed conditions | Conditions must be met and documented |
| Vital interests, emergencies, legal requirement | Where prescribed exceptions apply | Confirm the specific exception; do not use as a general fallback |
1.1Record the basis for each processing activity in the data inventory. An organisation that cannot say why it is entitled to hold something is not in a position to defend it.
2. Rules for Valid Consent
2.1The individual must be notified of the purposes before or at the time of collection.
2.2Consent must be voluntary. Consent obtained by requiring it as a condition of providing a product or service, beyond what is reasonably required to provide that product or service, is not valid.
2.3Consent must not be obtained by providing false or misleading information about the purposes, or by deceptive practices.
6 more pages in the Word file
This is page 1 of the Word document, exactly as it appears when you open it. Fields shown like THIS are placeholders for you to complete.
These notes accompany the template and explain the drafting choices, the compliance points and the mistakes most often made with this document. They appear as a final page in the Word file, intended to be deleted before the document is executed.
Organisations default to consent because it feels safest, and then discover it is the most fragile option — withdrawable at any time, invalid if bundled, and specific to the purposes notified. Where deemed consent, legitimate interests or business improvement genuinely applies, that is often both more accurate and more robust. Identify the basis per activity and record it.
Consent required as a condition of a product or service, beyond what is reasonably required to provide it, is not valid. The classic failure is a single tick box covering service delivery and marketing together. Annexure A separates necessary from optional deliberately, and the optional items must be genuinely optional.
This is not a free pass. An assessment must be carried out and documented, and reliance disclosed. Annexure D is that record. Deciding after a complaint that the basis was legitimate interests all along, with no contemporaneous assessment, is not a defence.
A notification saying data will be used "for business purposes" or "for such purposes as we may determine" notifies nothing and will not support any later use. Purposes must be specific enough that an individual can understand what they are agreeing to.
Data collected to deliver a service cannot later be used for profiling, partner marketing or a new product without fresh consent or another basis. This is the most common way organisations drift into non-compliance without any single decision to do so.
An individual may withdraw consent on reasonable notice. Where withdrawal requires a written letter, a phone call in office hours, or navigating several screens, the consent itself begins to look less than voluntary. Tell them the consequences, then stop the processing.
Notices change. Knowing that someone consented is of limited use without knowing what they were told at the time. Annexure C records the version, which is what allows the position to be reconstructed years later.
The purpose limitation and data minimisation principles both point the same way. Identification numbers in particular are collected far more often than needed, and they carry disproportionate breach consequences because their disclosure is prescribed as likely to cause significant harm. Ask whether the field is genuinely required.
Marketing to Singapore telephone numbers engages the Do Not Call obligations in addition to the data protection ones. A person may have consented to marketing generally and still be on the register, and clear and unambiguous consent in evidential form is required to override it. Row 3 of Annexure A flags this because the two are frequently conflated.
The notification obligation applies to employees. An employee privacy notice at induction is not optional in substance, and it is the document most often missing from an otherwise complete policy set.
Where employee email, systems, building access, vehicles or CCTV are monitored, say so in the privacy notice. Undisclosed monitoring is a data protection problem and, separately, a trust problem that is very difficult to recover from once discovered.
Where the individual is a minor, consider whether they can meaningfully understand and consent, and whether a parent or guardian should. Collecting data about children for marketing purposes warrants particular caution.
Deemed consent by conduct covers purposes that are genuinely obvious from the circumstances. It does not stretch to cover marketing, profiling or sharing with third parties merely because the individual handed over their details. Do not use it as a substitute for asking.
Notices and consent forms drift out of alignment with what the organisation actually does, usually because a new system or vendor was introduced without anyone revisiting the notice. Tie the review to the data inventory so both move together.
Reflects Singapore law current as of {{DATE OF USE}}. The Personal Data Protection Act has been amended and further provisions may come into force — confirm current requirements and Commission guidance, and take advice before relying on legitimate interests or business improvement for anything significant.
This is a ready-to-use template provided for convenience. Laws and requirements change, and every situation is different — please have it reviewed by a qualified professional (a lawyer, corporate secretary, or accountant as relevant) before you rely on it.