Educational · Singapore · PDPA · SMC
PDPA Singapore: What Clinics Must Get Right Before They Market to Patients
The clinical record is usually well protected. The marketing side of a Singapore clinic often is not.
- Consent sets the boundary. Data given for care is not automatically consent to marketing, so ask a separate question and record the answer.
- Every clinic needs a designated Data Protection Officer, regardless of size.
- Breaches can be notifiable where significant harm is likely or 500 or more people are affected, and the PDPC must then be told within three calendar days of that assessment.
- Penalties can reach 10% of Singapore turnover for larger organisations, or S$1 million in other cases.
- The SMC Ethical Code adds a confidentiality duty for doctors, which reaches social content and replies to reviews.
Your clinic holds some of the most sensitive personal data in Singapore. Names and NRIC numbers, yes, but also diagnoses, treatment histories, photographs and the reasons someone walked through your door.
Most clinics understand that the medical record needs protecting. Clinical systems usually come with access controls, audit logs and a vendor who understands healthcare. Fewer have looked hard at the marketing side: the enquiry forms, the WhatsApp broadcast list, the patient database exported into an email platform so the team can announce a new service. That is usually where personal data drifts outside the controls that protect the clinical record.
This guide covers the Personal Data Protection Act obligations that matter most when a clinic starts marketing, and the practical steps that keep patient trust intact.
What does the PDPA require from a Singapore clinic?
The PDPA sets baseline rules for how private sector organisations collect, use and disclose personal data, and clinics sit squarely inside it. The core principle is consent. Under section 13 of the Act, an organisation must not collect, use or disclose personal data about an individual unless the individual gives, or is deemed to have given, consent, or the Act otherwise permits it.
For a clinic, that principle runs into a practical tension. Patients give you their details to receive care. That does not automatically mean they agreed to receive a newsletter about a new aesthetic treatment. The purpose you told them about at collection sets the boundary for how you use the data afterwards.
The Act also makes you accountable for the data you hold. Section 11 requires every organisation to designate one or more individuals responsible for ensuring it complies with the Act, which is the role most people call the Data Protection Officer. A clinic cannot opt out of having one because it is small.
Can a clinic use patient data for marketing?
It can, but only for purposes the patient has agreed to, and that agreement needs to be real.
The cleanest approach is separate consent. When a patient registers, ask for their details for care and administration, and then ask a separate question: may we send you updates about our services? Record the answer, the date and the channel. A patient who says no still gets their appointment reminders and results. A patient who says yes can be added to your marketing list.
Two habits cause most of the problems we see. The first is bundling marketing consent into the registration form as a condition of treatment, or burying it in the terms. The second is treating the entire patient database as a mailing list the moment someone buys an email platform. Both blur the purpose the patient agreed to.
Withdrawal matters as much as consent. If a patient asks to stop receiving marketing, stop, across every channel, and make sure the clinical team is not affected by the change.
Marketing to patients by phone call, SMS or fax to Singapore numbers also brings in the Do Not Call provisions, which run alongside the data protection rules and have their own checks. Treat them as a separate item on your compliance list.
How should clinics handle a data breach under the PDPA?
Quickly, and with a plan written before you need it.
Since February 2021 the PDPA has included a mandatory data breach notification obligation. The PDPC's guidance explains that a breach is notifiable to the Commission when it is likely to result in significant harm to affected individuals, or when it affects 500 or more individuals. Once you have assessed that a breach is notifiable, you must notify the PDPC as soon as practicable and no later than three calendar days after that assessment.
Health information raises the stakes on the significant harm test. A misdirected email containing one patient's test results can be notifiable even though only one person is affected. An exported marketing list of a few thousand patients sitting in an unsecured shared drive can cross the 500 threshold in one go.
Marketing systems are a common source of breaches precisely because they sit outside the clinical environment. A marketing agency with a login to your email platform, a spreadsheet of enquiries emailed between staff, a form tool that stores submissions indefinitely. Each one is personal data your clinic is responsible for.
What are the penalties for breaching the PDPA?
The financial exposure is significant. Under the Act's financial penalty provisions, the PDPC can impose a financial penalty of up to 10% of an organisation's annual turnover in Singapore where that turnover exceeds S$10 million, or up to S$1 million in any other case, for breaches of the data protection provisions. These higher limits apply to contraventions on or after 1 October 2022.
Most clinics will never face a penalty at the upper end. The more realistic cost is reputational. Enforcement decisions are published, and a clinic named for mishandling patient data carries that into every future enquiry. For a practice that depends on referrals and word of mouth, patient trust is the asset at risk.
How does the PDPA fit with the SMC Ethical Code?
Doctors carry a second layer of obligation. The Singapore Medical Council's Ethical Code sets out a duty of medical confidentiality for doctors, including taking reasonable care over the security of the systems used to store medical records, and not allowing patient information to be disseminated through carelessness or through participation in social media.
In practice, the two sets of rules point in the same direction. The PDPA governs personal data across the whole organisation. The Ethical Code governs the doctor's professional conduct. A clinic that builds its marketing around explicit consent, minimal data and tight vendor controls is working to both at once.
Where clinics come unstuck is social content. A before and after post, a staff photo with a patient in the background, a reply to a patient's review that confirms they were treated. Each of those can raise confidentiality questions under the Ethical Code and personal data questions under the PDPA, and some also run into healthcare advertising rules. Put social content through the same review you apply to any other patient information.
A simple rule helps your team here. If a post, reply or image would let someone work out that a particular person is or was your patient, it needs that patient's consent and a second look before it goes live. That includes replies to reviews. A polite response that confirms a treatment date or procedure discloses information the patient never agreed to share publicly, however positive the review was.
What should a clinic check before its next campaign?
Work through these before any list is uploaded or any broadcast is sent.
- Confirm who your designated Data Protection Officer is, and that their business contact details are available to the public.
- Check that every person on your marketing list gave marketing consent separately from consent for care, and that you can show when and how.
- List every vendor that receives patient or enquiry data, including agencies, form tools, email platforms and messaging tools, and confirm your contracts cover how they protect it.
- Remove clinical information from marketing systems. Your email platform does not need diagnoses to send an invitation.
- Write down your breach response steps, including who assesses whether a breach is notifiable and who notifies the PDPC.
- Run phone and SMS lists through the Do Not Call process where it applies.
Want a second opinion on how your clinic handles patient data in its marketing? Talk to our team and we will walk through it with you.
Frequently asked questions
Does the PDPA apply to a small clinic with only a few staff?
Yes. The Act applies to private sector organisations regardless of size, so a single doctor practice collecting patient details has the same core obligations as a large group.
Is an NRIC number enough to identify a patient for marketing?
You should not need it for marketing at all. The PDPC has issued separate guidance restricting the collection of NRIC numbers, so keep them in the clinical record and out of every marketing system.
Can our marketing agency see patient data?
Only what it needs for the work you have asked it to do, under a contract that sets out how it must protect that data. An agency running an email campaign rarely needs more than names and email addresses of consenting patients.
What if a patient emails us asking what data we hold?
Patients have a right to request access to their personal data. Route the request to your Data Protection Officer, confirm the person's identity and respond within the time the PDPC expects.
Do we need consent to send appointment reminders?
Reminders tied to care the patient has already booked are part of providing the service they asked for. Promotional content added to those reminders changes the purpose, so keep the two separate.
This article is general information only and is not legal or regulatory advice. It summarises the Personal Data Protection Act 2012, PDPC guidance and the SMC Ethical Code and Ethical Guidelines as published at the time of writing, and does not address MOH requirements, the Healthcare Services Act or platform policies, which can impose further requirements. Regulatory guidance changes, and how it applies depends on your circumstances. Confirm your obligations with a qualified adviser before relying on any of it.
References
- Personal Data Protection Act 2012 (Singapore). sso.agc.gov.sg
- Personal Data Protection Commission. (2026, April 22). Report your organisation's data breach. pdpc.gov.sg
- Singapore Medical Council. (2016). SMC ethical code and ethical guidelines (2016 ed.). isomer-user-content.by.gov.sg
About the author
Dr Sandy Adel · Content Strategist, ContentClicks
Sandy is a practising dentist with a Bachelor of Dentistry from Alexandria University and over eight years of clinical experience in general dentistry. She brings that firsthand clinical knowledge directly to her writing, so the content she produces for dental and medical audiences is accurate at the clinical level before it is optimised for anything else.
Before joining ContentClicks she spent more than four years writing dental copy for practices across the Australian, US and UK markets, including two years as a dental copywriter at one of Australia's specialist healthcare marketing agencies. She writes about ethical marketing, realistic patient expectations, and the gap between what clinics promise and what biology can guarantee. More from Sandy.
