Treat a correction request as a case file, not a customer-service edit. Verify the requester, identify the alleged error or omission, assess any exception, respond within the required timeframe and record whether corrected data must be sent to organisations that received it.
This guide is for a dpo, hr lead or sme administrator receiving a request to correct personal data. Its job is specific: respond lawfully, preserve evidence and update downstream recipients where required. Use the table first, then the worked example and checklist; keep any calculation as a labelled estimate until the controlling body or live service confirms it.
PDPA correction request Singapore: the decision table
| Situation | Practical next step |
|---|---|
| Clear factual error in the requester’s own data | Correct it as soon as practicable and assess downstream updates |
| Request concerns another person’s data | Do not disclose or alter it through this route |
| Organisation has reasonable grounds not to correct | Explain the outcome and preserve the requested annotation where required |
| Full response cannot be completed within 30 days | Write within the period with the next soonest response time |
The table separates the common branches that lead to different outcomes. It is not a substitute for reading the current source: re-open the cited authority on the day the decision is made, especially where a deadline, rate, eligibility rule, opening condition or safety instruction is involved.
Start with the controlling rule
Confirm identity proportionately before showing or changing personal data. The verification process should not collect more information than the risk justifies. PDPC Advisory Guidelines on Key Concepts.
Ask the individual to identify the record, error or omission and the proposed correction. A precise request prevents accidental changes to a different account or historical record. PDPC data-protection obligations.
These two checks define the reader’s starting position. Record the date and the facts used, because a later application, booking or dispute is easier to resolve when the original basis is visible.
Apply the rule to the real decision
PDPC’s review checklist uses a 30-calendar-day response checkpoint. Calendar the received date and make the DPO or case owner responsible for any extension notice. PDPC Advisory Guidelines on Key Concepts.
The organisation should correct an error or omission as soon as practicable unless it is satisfied on reasonable grounds that the correction should not be made. Record those grounds rather than issuing a bare refusal. PDPC data-protection obligations.
Do not compress separate conditions into a single yes-or-no answer. Work through the eligibility, timing, amount and evidence questions in that order, and stop if a live record does not match the assumption.
Build the evidence trail
After correction, consider recipients to which the data was disclosed within the preceding year. The PDPA framework can require corrected data to be sent onward, subject to the individual’s consent to limit recipients. PDPC Advisory Guidelines on Key Concepts.
Distinguish factual errors from professional or evaluative opinions and other exceptions. Route complex cases for legal review instead of forcing them through an automated profile-edit workflow. PDPC data-protection obligations.
Save the relevant confirmation, receipt, official result or case reference. This is not administrative decoration: it is the record that allows the authority, provider or household to reconstruct what happened.
Know the limit of the answer
Preserve the original value, corrected value, source evidence, decision, communications and downstream action. The audit trail should show why the change was made. PDPC Advisory Guidelines on Key Concepts.
Close the case only after systems of record, backups or operational copies have been addressed according to policy. A front-end display change alone may leave inaccurate data in use. PDPC data-protection obligations.
This guide resolves the general task for a Singapore reader. It does not replace an individual notice, contract, clinical assessment, legal advice or an officer’s direction at the point of service.
Worked Singapore example
An employee says payroll has the wrong bank-account digit and supplies a bank document after identity verification. HR logs the request date, corrects the system of record, confirms the change and checks whether the incorrect data was sent to the payroll processor during the prior year. A disputed manager assessment follows a separate review.
The example shows the method, not a promised outcome. Replace its dates, balances, prices, route conditions or personal facts with the reader’s own information. Where the example performs arithmetic, it is an editorial calculation and should be reconciled against the live statement, bill or official calculator.
Action checklist
- Log receipt date and case owner
- Verify the requester’s identity
- Define the exact error or omission
- Assess exceptions and evidence
- Respond within 30 calendar days
- Update systems and required recipients
- Preserve decision and communication records
Work through the list in sequence. If one item cannot be verified, record the gap and use the official contact route rather than guessing. Keep screenshots only as supporting evidence; the live authority page and issued document remain controlling.
Two original tools in this guide
A seven-stage correction request case log. This converts the source material into a reusable decision aid. Copy it into a note or spreadsheet and enter only verified personal inputs.
A downstream-recipient update matrix for the preceding year. This is the final control before an irreversible payment, submission, booking, journey or household decision. It is an editorial framework derived from the sources, not an official form.
Primary-source ledger
| Official or primary source | Material claims checked |
|---|---|
| PDPC Advisory Guidelines on Key Concepts | Correction duties, exceptions, response timing and downstream notification. |
| PDPC data-protection obligations | Correction as soon as practicable and downstream notification obligation. |
Each inline link sits beside the claim it is intended to support. Both source pages were opened during the evidence pass. If a page is revised after publication, use the latest controlling text and treat this article’s worked examples as historical calculations rather than fresh official advice.
Errors that change the outcome
- Editing a record before confirming identity
- Treating a correction request as an access request
- Missing the 30-day communication checkpoint
- Updating one screen but not the system of record
- Refusing without documenting reasonable grounds
The recurring failure is to act on a familiar label without checking its definition. Preserve the original notice, policy wording, booking terms, eligibility record or authority response so that a later review starts from evidence rather than memory.
Continue with the next useful step
For the adjacent task, read setting up the DPO operating file. If the decision moves into another stage, continue with the separate data-breach response route. These links were selected for reader progression, not as mechanical category links.
Questions readers ask
Can someone request correction of another person’s data?
PDPC’s checklist says the request must concern the requester’s own personal data. PDPC Advisory Guidelines on Key Concepts.
What is the response checkpoint?
PDPC uses 30 calendar days before a correction review may be sought for non-response. PDPC data-protection obligations.
Must every disputed opinion be changed?
No. Exceptions can apply; obtain case-specific advice and document the basis. PDPC Advisory Guidelines on Key Concepts.
Accuracy note: This article was checked against the linked primary sources on 2026-07-21. Individual facts and live services can change. No interview, first-hand use, first-hand meal, price check or field observation is claimed unless expressly stated.
