The Singapore Shopper’s Guide to Shopping Accounts and Your Personal Data: PDPA Rights, Marketing Consent, the Do Not Call Registry and Account Security
Description: How shopping accounts and your personal data work in Singapore: what shops and marketplaces collect, your PDPA rights to access, correction and withdrawing consent, marketing consent and unsubscribing, the Do Not Call Registry’s three registers, NRIC collection, data breach notification, passwords, 2FA, Singpass safety and ScamShield.
Primary Keyword: shopping accounts and your personal data
Secondary Keywords: PDPA Singapore shoppers, marketing consent, withdraw consent PDPA, personal data access request, Do Not Call Registry, DNC registry Singapore, NRIC collection retailers, data breach notification, unsubscribe marketing, account security 2FA, ScamShield
Website: wahliao.com
Article Type: Series Guide
Parent Article: How Shopping Works | Online Shopping in Singapore, From Search Bar to Doorstep
Last checked: 19 October 2026
Quick Answer
Shopping accounts and your personal data travel together.
Every account, loyalty card and saved delivery address is a small file about you, held by someone else.
In Singapore, the Personal Data Protection Act (PDPA) sets the rules for how private organisations collect, use and disclose that file.
A shop should tell you why it wants your data.
It needs your consent for those purposes.
You can ask what it holds and how it was used.
You can ask it to correct mistakes.
You can withdraw consent, including for marketing.
Separately, the Do Not Call (DNC) Registry lets you opt your Singapore number out of marketing calls, texts and faxes.
And your own habits, like unique passwords and two-factor authentication, decide how safe the account actually is.
The smart shopper does not only ask:
“Do I want the member discount?”
The smart shopper asks:
“What am I handing over, what is it for, and how do I take it back?”
1. Every Shopping Account Is a Data File
A shopping account is not just a login.
It is a growing record.
The more you shop, the more it knows.
Examples:
your name, mobile number and email address
home and office delivery addresses, sometimes with unit numbers and access notes
saved cards or linked payment methods
order history, returns and reviews
loyalty points, birthday month and member tier
browsing, search and app activity on the platform
chat messages with sellers and customer service
Some of this is needed to deliver your parcel.
Some of it is used for recommendations and advertising.
Some of it is simply kept because nobody deleted it.
Ask:
How many shopping accounts do I have right now?
Which of them still store my card or home address?
When did I last use each one?
Every account you open is a file you are responsible for closing.
2. The PDPA in One Page
The PDPA is Singapore’s main law on personal data in the private sector.
It is administered by the Personal Data Protection Commission (PDPC).
PDPC lists a set of obligations that organisations must meet. In plain terms:
Notification: tell you why your data is being collected, used or disclosed.
Consent: get your consent for those purposes, and let you withdraw it.
Purpose limitation: use data only for purposes a reasonable person would consider appropriate.
Accuracy: make reasonable efforts to keep data correct and complete.
Protection: make reasonable security arrangements.
Retention limitation: stop keeping data once it is no longer needed for business or legal purposes.
Access and correction: respond to your requests to see and fix your data.
Data breach notification: tell PDPC and affected people about serious breaches.
Accountability: have policies, a data protection officer (DPO) and published contact details.
PDPC’s page also lists data portability, the right to have your data moved to another organisation.
As of October 2026, PDPC says that obligation takes effect only when the regulations for it are issued.
This page is general information, not legal advice. For a specific situation, read PDPC’s own pages or get proper advice.
The PDPA does not stop shops from using your data. It makes them say why, ask first and look after it.
3. Consent and Purpose: Why the Form Must Explain Itself
The consent rule and the purpose rule work as a pair.
The shop says what the data is for.
You agree to that purpose.
The shop stays within it.
PDPC says organisations cannot make you consent to more than is reasonable to provide the product or service.
That matters at checkout.
A delivery address is reasonable for a delivery.
Your full date of birth, your income range and your marital status usually are not needed to send you a phone case.
Examples:
an optional field asking for your birthday “for a birthday treat”
a sign-up form with a pre-filled marketing tick box
a lucky draw form asking for more details than the prize needs
an app asking for contacts or location access to browse products
Ask:
What will this field be used for?
Is it required or optional?
Would the order still go through if I left it blank?
If a field does not help deliver what you are buying, treat it as optional until you are told otherwise.
4. Marketing Consent Is a Separate Switch
Agreeing to buy something and agreeing to receive marketing are two different decisions.
Good shops keep them apart.
You can check out without joining the mailing list.
Marketing usually arrives through several channels at once.
Email newsletters.
App push notifications.
SMS and WhatsApp messages.
Phone calls.
Each one tends to have its own setting.
Turning off email does not always turn off SMS.
Turning off push notifications in your phone settings does not change what the shop is allowed to send by text.
Ask:
Which channels did I agree to?
Where in the app are the communication preferences?
Did I tick something when I joined a loyalty programme in store?
Consent is per purpose and often per channel. Check each switch, not just the first one you see.
5. Your Right to Ask: Access and Correction
Under the PDPA, you can ask an organisation for the personal data about you that it holds or controls.
PDPC says you can also ask how that data has been used or disclosed in the past 12 months.
There are exceptions, for example where access could reveal another person’s personal data or threaten someone’s safety.
You can also ask for errors or omissions to be corrected.
PDPC says the organisation should correct the data as soon as practicable.
It should generally also send the corrected data to organisations it disclosed the data to in the past year.
For a shopper, the practical uses are simple.
A wrong address that keeps resurfacing.
A misspelt name on invoices.
Not knowing why a partner brand suddenly knows your email.
Ask:
Who is the data protection officer, and how do I contact them?
What exactly do I want: a copy, an explanation of disclosures, or a correction?
Have I made the request in writing, with my account details?
Ask in writing, be specific, and keep a copy of what you sent.
6. Withdrawing Consent and Unsubscribing
PDPC says you can withdraw consent at any time, with reasonable notice.
The organisation should tell you the likely consequences, then stop collecting, using or disclosing your data for that purpose.
“Likely consequences” is worth reading.
Withdrawing consent for marketing usually just means fewer messages.
Withdrawing consent for data the service genuinely needs may mean the shop cannot keep your account running.
The easy routes, in order:
the unsubscribe link at the bottom of a marketing email
the opt-out instruction inside a marketing SMS
communication or privacy settings in the app or website account page
a written request to the shop’s DPO if the first three do not work
Use unsubscribe links only in messages you know are genuine.
If an email looks off, go to the shop’s app or website directly instead.
Unsubscribe from the account page when in doubt. It is the one link you know is real.
7. The Do Not Call Registry: What It Covers
The DNC Registry is run under the PDPA.
It lets you opt out of marketing messages sent to your Singapore telephone number.
The DNC website says this covers mobile, fixed-line, residential and business numbers.
There are three separate registers:
No Voice Call Register
No Text Message Register
No Fax Message Register
You choose one, two or all three.
The DNC site says registration is free and does not expire.
Ways to register, as listed on dnc.gov.sg in October 2026:
online at dnc.gov.sg, confirmed with a one-time password
by SMS: send “DNC” to 78771 from the number you want to register
by phone: call the toll-free number 1800 248 0771 from that number
The same website lets you check the status of a number, or remove it.
Organisations have had to check the Registry before sending telemarketing messages since 2 January 2014.
Register once, choose all the registers you want, and check the status after.
8. What the Registry Does Not Cover
The DNC Registry is not a block on every unwanted message.
Knowing the gaps saves frustration.
The DNC site says organisations with an ongoing relationship with you may send text or fax messages about similar or related products, services or memberships without checking the Registry.
Those messages must include a way to opt out.
Once you opt out, the site says the organisation has 30 days to stop.
Consent also overrides registration.
If you give a specific shop clear and unambiguous consent to contact you, it may do so even if your number is registered.
You can withdraw that consent later.
The DNC site also lists types of messages that fall outside the rules, including:
pure market research or surveys
charitable or religious appeals
personal messages
public messages from the government
political messages
business-to-business marketing
Scam messages are a separate problem.
Scammers ignore the Registry entirely.
Registering your number will not stop them.
If you think an organisation has broken the DNC rules, the DNC site points you to PDPC’s complaints page.
The Registry stops honest marketers from calling. It does nothing about dishonest ones.
9. NRIC Numbers at the Counter
Singapore shoppers have long been asked for NRIC numbers at counters, for memberships, warranties and lucky draws.
PDPC has issued Advisory Guidelines on NRIC numbers, which took effect in September 2019.
In broad terms, they say organisations should generally not collect full NRIC numbers unless the law requires it or identity must be verified to a high degree of accuracy.
In closing remarks on responsible NRIC use, Minister Josephine Teo said retail membership sign-ups and lucky draws have no need for NRIC numbers at all.
A mobile number or email address works instead.
There is a newer, separate rule about authentication.
PDPC says an NRIC number identifies a person but is not a secret, so it should not be used to prove identity.
MDDI announced in February 2026 that private organisations must finish phasing out NRIC numbers, full or partial, for authentication by 31 December 2026.
PDPC says it will step up enforcement from 1 January 2027.
Ask:
Why does this shop need my NRIC number?
Would a mobile number or email do the same job?
Is my NRIC number, or part of it, being used as a password or default PIN?
MDDI says misuse of NRIC numbers for authentication can be reported to PDPC at go.gov.sg/reportnric.
Your NRIC number is an identifier, not a password. Do not use it as one, and question any shop that does.
10. When Shops Lose Data: Breach Notification
Even careful businesses get breached.
The PDPA requires organisations to assess whether a data breach is notifiable.
PDPC says a breach that is likely to cause significant harm to individuals, or is of significant scale, must be notified to PDPC.
Where significant harm is likely, affected individuals must be told as soon as practicable.
A breach notice from a shop is worth reading slowly.
It should say what was affected and what to do next.
Scammers also use breach news as bait, so check any notice through the shop’s official app or website, not through a link in an unexpected message.
If you are told your data was exposed:
change the password on that account
change it on any other account that used the same password
turn on two-factor authentication if it is offered
watch for messages that mention your recent orders
check your card statements for charges you do not recognise
After a breach, assume scammers know your name, number and recent orders. Verify everything that arrives.
11. Account Security: Passwords and 2FA
The law covers the shop’s side.
Your login is your side.
CSA’s guidance is practical.
Use a password of at least 12 characters.
A passphrase built from unrelated words, mixed with capitals, numbers or symbols, is easier to remember and harder to crack.
Avoid names, birthdates, NRIC numbers and anything easily found online.
CSA also says to use a different password for each online account.
Reusing one password means one leak can open many doors.
Shopping accounts are often the weak link, because people sign up quickly for a one-off sale.
Turn on two-factor authentication (2FA) wherever it is available.
CSA explains that 2FA pairs something you know with something you have, or with a biometric, so a stolen password alone is not enough.
Ask:
Does my marketplace account use a password I have used anywhere else?
Is 2FA switched on for my email, which can reset every other password?
Would I notice a login from a new device?
Protect your email first. Whoever controls your inbox can reset your shopping accounts.
12. Singpass, OTPs and the Login You Never Give Away
Ordinary online shopping does not involve handing your Singpass login to a seller.
Some services may offer Singpass to fill in forms or verify you, but that happens through the official Singpass login, not by sharing your details with a person.
GovTech’s Singpass safety tips are clear.
Never share your Singpass ID, password or 2FA details with anyone.
Singpass does not send links or QR codes by SMS or messaging apps.
Check for “singpass.gov.sg” in the address bar before logging in.
The same idea applies to one-time passwords from shops, banks and couriers.
CSA says never give a password or OTP in response to a call, email or suspicious website.
Examples:
a “seller” asking for your OTP to “confirm payment”
a “courier” asking you to log in with Singpass to reschedule delivery
a “customer service agent” asking for your login to process a refund
An OTP is for you to type into the official app or site. It is never for a person to hear.
13. The Singapore Layer
Several agencies share this space, and it helps to know who does what.
PDPC administers the PDPA and the DNC Registry, and handles personal data complaints.
CSA, the Cyber Security Agency of Singapore, publishes practical security advice for individuals.
MDDI, the Ministry of Digital Development and Information, sets the direction on NRIC use.
ScamShield helps you check suspicious messages and calls.
ScamShield’s helpline is 1799, open 24 hours.
It can help you check whether something is a scam, and can connect scam victims to several major banks.
It does not file police reports for you.
For a data issue with a shop, PDPC’s page suggests approaching the organisation first.
Contact its DPO, ask for an explanation, and keep records.
If that fails, PDPC’s complaints page is the next step.
A consumer dispute about a faulty product or a refund is a different track.
That is consumer protection, not data protection, and it runs through the business, CASE and the Small Claims Tribunals.
Data problems go to the shop’s DPO, then PDPC. Scam doubts go to ScamShield. Product disputes go down the consumer track.
14. Strong Signs and Weak Signs
Strong signs:
a short, readable privacy notice linked at sign-up
marketing consent left unticked by default
separate switches for email, SMS and push notifications
a named DPO contact or privacy email address
2FA offered for your account
login alerts when a new device signs in
a clear way to close your account
membership that works with a mobile number or email, not an NRIC number
Weak signs:
a sign-up form that will not submit without optional-looking details
marketing boxes already ticked
an unsubscribe link that leads nowhere or asks you to log in again and again
a request for your full NRIC number for a lucky draw or membership
a part of your NRIC number used as a default PIN or password
no way to remove a saved card
no contact for privacy questions anywhere on the site
Ask:
Would I trust this shop to hold my home address for five years?
Can I find its privacy contact in under a minute?
Is it asking for more than the order needs?
The way a shop asks for your data tells you how it is likely to treat it.
15. Practical Method: The Shopping Account Clean-Up
Set aside about half an hour. Do it once, then repeat a lighter version each year.
1. List your accounts
Search your email for “welcome”, “verify your email” and “order confirmation”.
Write down every shop, marketplace, delivery app and loyalty programme you find.
2. Sort into keep and close
Keep accounts you used in the past year and expect to use again.
Mark the rest for closing.
3. Secure the keepers
Give each one a unique password.
Switch on 2FA where offered.
Remove saved cards you no longer use and old addresses you have moved from.
4. Set your marketing switches
Open communication preferences in each account.
Turn off the channels you do not want, one by one.
5. Register with the DNC Registry
Visit dnc.gov.sg and choose the registers you want.
Check the status once it is done.
6. Close the leftovers
Use each shop’s account deletion option, or write to its privacy contact.
Keep the confirmation.
7. Install your safety net
Save 1799 in your contacts as ScamShield.
Consider installing the ScamShield app on your phone.
16. Deleting an Account: What Actually Happens
Deleting an account is not always instant, and not always total.
Some platforms have an in-app “delete account” option with a waiting period, and some ask you to settle open orders, refunds or wallet balances first.
The PDPA’s retention limitation obligation is the key rule here.
PDPC says organisations should stop keeping personal data, or dispose of it properly, once it is no longer needed for business or legal purposes.
Records such as invoices may still be kept for as long as there is a legal or business reason.
PDPC’s list of obligations does not include a stand-alone “right to be forgotten” of the kind some overseas laws provide.
In practice, asking to close your account and withdrawing consent for marketing and other optional uses are your main levers.
Ask:
Do I have any open orders, refunds, vouchers or wallet balances?
Have I downloaded any receipts I may need for warranties?
Did I get written confirmation that the account is closed?
Before you delete, collect your receipts. After you delete, keep the confirmation.
Final Summary
Shopping accounts and your personal data are tied together from the first sign-up.
The PDPA requires shops to say why they collect data, get consent, keep it accurate and secure, and let you see and correct it.
You can withdraw consent, including for marketing, and unsubscribe channel by channel.
The DNC Registry lets you opt your Singapore number out of marketing calls, texts and faxes, but not everything is covered, and scammers ignore it.
NRIC numbers should not be asked for casually, and from 2027 PDPC will step up enforcement against organisations that still use them to authenticate people.
Unique passwords, 2FA and never sharing OTPs or Singpass details do the rest.
So the smartest question is not:
“What do I get for signing up?”
It is:
“What does this shop know about me, and could I get it back or shut it off today?”
Simple Checklist
Before you create a shopping account, or while you clean up the ones you have, ask:
- Do I know why the shop wants each piece of data it asks for?
- Did I leave marketing boxes unticked unless I really want them?
- Have I checked the email, SMS and push notification settings separately?
- Do I know how to contact the shop’s data protection officer?
- Have I registered my number on the DNC Registry for the registers I want?
- Did I refuse to give my NRIC number where a mobile number or email would do?
- Is my password for this account unique, and at least 12 characters?
- Is two-factor authentication switched on, especially for my email?
- Have I removed old saved cards and addresses I no longer use?
- Do I know how to delete this account, and have I closed the ones I no longer use?
If the answer is unclear, pause.
Check the settings, ask the shop in writing, and share only what the order needs.
Where the Facts Come From
PDPC – Data Protection Obligations
PDPC – Individuals Overview
PDPC – Do Not Call Registry and You
Do Not Call Registry – Home (registration by SMS and phone)
Do Not Call Registry – For Consumers
Do Not Call Registry – Register your number
PDPC – Advisory Guidelines for NRIC Numbers
PDPC – Reply to media queries on the use of NRIC numbers (December 2024)
MDDI – Closing remarks by Minister Josephine Teo on responsible use of NRIC numbers
MDDI – Responsible use of NRIC numbers across public and private sectors (February 2026)
PDPC – Stepping up enforcement against misuse of NRIC numbers
CSA – Joint advisory against using NRIC numbers for authentication
CSA – Use strong passwords and enable 2FA
GovTech – Five ways to keep your Singpass safe
ScamShield – 1799 Helpline
Prices, rules and platform features change. We last checked this page on 19 October 2026. General information, not financial, legal or medical advice.
Continue Reading
How Shopping Works | Online Shopping in Singapore, From Search Bar to Doorstep
How Shopping Works | The Big Picture
Your Data and Super Intelligence: What Happens to What You Type, and What the PDPA Covers
Fake Parcel and Delivery Messages: How the Scam Works and What Couriers Really Send
How Shopping Works | Shopping Scams in Singapore
Subscriptions, Free Trials and Auto-Renewals: How to Stay in Control
Search Ranking and Sponsored Listings: Why Marketplaces Show You What They Show
Live Selling and Social Commerce: How Buying Through Videos and Live Streams Works
Group Buys in Singapore: How Telegram and WhatsApp Group Orders Work
Buying From Overseas Stores: Shipping Forwarders, Overseas Addresses and Customs
shopping accounts and your personal data, PDPA Singapore, PDPA for shoppers, personal data protection act shopping, PDPC, marketing consent, withdraw consent PDPA, unsubscribe from marketing, stop marketing SMS, personal data access request, correct personal data, data protection officer, Do Not Call Registry, DNC registry Singapore, register DNC 78771, No Voice Call Register, No Text Message Register, No Fax Message Register, DNC exemptions, ongoing relationship marketing, NRIC collection retailers, NRIC advisory guidelines, NRIC lucky draw, NRIC not a password, NRIC authentication 31 December 2026, data breach notification, shop data breach what to do, retention limitation, delete shopping account, loyalty programme data, delivery address privacy, account security, strong passphrase, unique passwords, two-factor authentication, CSA password tips, never share OTP, Singpass safety, ScamShield, ScamShield helpline 1799, how shopping works, online shopping Singapore, Singapore shopper guide, wahliao shopping guide
