Deemed Consent Under PDPA: When You Don't Need a Tick Box

What deemed consent means under PDPA

The PDPA's consent obligation says you need consent to collect, use or disclose personal data, unless an exception applies. Consent doesn't have to be express. PDPC's Advisory Guidelines on Key Concepts explain that sections 15 and 15A of the PDPA provide for three forms of deemed consent.

Deemed consent is consent all the same, so people can still withdraw it. Section 16 says individuals may withdraw consent given or deemed to have been given at any time, with reasonable notice.

Deemed consent by conduct: everyday examples

This applies when a person voluntarily gives you their data, and only for purposes that are objectively obvious and reasonably appropriate in the circumstances. PDPC's examples include a spa customer handing over a credit card to pay, a clinic patient proceeding with tests after being told what they involve, and a caller giving a taxi hotline their number so the operator can text when the cab arrives.

PDPC's taxi example makes the limit clear: the operator could text about the booked trip, but if it wanted to market its limousine service to the same caller, deemed consent would not cover that. Anything beyond the obvious purpose needs express consent, an exception, or deemed consent by notification.

Deemed consent by contractual necessity

When a customer gives you data for a transaction and you need to pass it to another organisation to complete that transaction, consent to that disclosure is deemed. PDPC says this extends down the chain to further organisations where it is reasonably necessary to fulfil the contract between the customer and you.

• Payments: card details passing from your shop to your bank, the card scheme and payment processors.
• Delivery: PDPC's furniture example lets the retailer give the address and number to the delivery company, and the delivery company to its sub-contractors, including last-mile delivery.
• Donations and GIRO: a charity's donor data passing to banks and the tax authority for deductions and tax relief.

The test is necessity. Giving a courier the delivery address is necessary; giving the same courier the customer's purchase history is not. If you use vendors who process data for you, our PDPA checklist covers the contracts and protection steps that still apply.

Deemed consent by notification: the conditions

Section 15A lets you use data you already hold for a new, secondary purpose if you notify people and they don't opt out within a reasonable period. PDPC says it is useful where you can't rely on another exception, such as business improvement. It comes with conditions you must meet before you start:

1. 1

   Assess adverse effects first, in writing

   Before collecting, using or disclosing the data, assess that it is not likely to have an adverse effect on the individual, and note any measures to reduce risks. PDPC's Annex B checklist covers purpose, notification and opt-out, likely adverse effects and the decision.

2. 2

   Notify adequately

   Tell people your intention, the purpose, and a reasonable period and manner to opt out. PDPC suggests using your usual direct channels, such as email, SMS or app notifications, and mass channels only where direct ones won't work.

3. 3

   Give a reasonable opt-out period

   PDPC doesn't fix a number. Its examples use 10 days for a hotel emailing members and 14 days for a bank emailing customers, and it says monthly-use apps should allow at least a month.

4. 4

   Start only after the period ends

   Consent is deemed only once the opt-out period has lapsed. Don't begin the new use before then.

5. 5

   Keep honouring withdrawals

   People who didn't opt out can still withdraw consent later, and you must facilitate that.

When deemed consent by notification won't work

PDPC gives clear cases where it can't be used:

• Marketing messages: excluded by regulation, as above.
• No real chance to opt out: PDPC says it should not be relied on where people have no reasonable opportunity and period to opt out, such as security cameras monitoring premises.
• Notices at the point of collection: its example of an exhibition using sensors to collect visitors' facial images fails because a sign at the venue gives no reasonable opt-out period.
• Adverse effects you can't mitigate: if the assessment finds likely adverse effects that remain after mitigation, you can't rely on it.

In these cases, get express consent, or check whether another exception applies, such as legitimate interests, which has its own assessment checklist (Annex C of the guidelines).

Records to keep

Deemed consent is easy to claim and hard to prove later. Keep enough to show how you met each condition.

PDPC's guidelines say the regulations require you to retain the notification assessment throughout the period you rely on it and provide it to PDPC on request, though you don't have to give it to individuals who ask. For forms where you do need express consent, our guide to PDPA consent form wording has sample text.

Do it yourself or get help?

Most small businesses rely on deemed consent by conduct and contractual necessity every day without paperwork. The main work is writing down which uses rely on it, making sure marketing has proper opt-in, and doing a real assessment before using notification for anything new.

Our PDPA Compliance Pack (S$690) includes a website privacy policy, a personal data inventory from our online questionnaire, a staff data protection policy, DPO appointment notes, a breach response plan and a cookie and consent notice. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront and complete the questionnaire online. This guide is general information, not legal advice; for a specific deemed consent decision, speak to a lawyer.