Protecting Children's Data in Singapore: PDPA Obligations for EdTech and Digital Services

The digital lives of children in Singapore are extensive. From online learning platforms and educational apps to social media and gaming, children generate and share vast amounts of personal data. The Personal Data Protection Act (PDPA) applies to children's data just as it does to adults' data, but the vulnerability of minors creates additional responsibilities for organisations that collect and process their information. With Singapore's EdTech sector growing rapidly and digital adoption among young people at an all-time high, understanding these obligations is essential.

How the PDPA Applies to Children's Data

The PDPA does not define a specific age threshold for children or establish a separate regime for minors' data. Instead, the general data protection principles apply to all personal data, including that of children. However, the PDPC has provided guidance indicating that organisations should exercise greater care when processing children's data, reflecting their reduced capacity to understand and consent to data collection.

The key principle is that children below the age of capacity to give consent require a parent or legal guardian to provide consent on their behalf. While the PDPA does not specify an exact age, organisations typically treat individuals under 13 or under 18 as requiring parental consent, depending on the context and nature of the data processing.

Parental Consent Requirements

When an organisation collects personal data from a child who is not capable of giving valid consent, consent must be obtained from a parent or legal guardian. This creates several practical challenges:

Verifying Parental Identity

Organisations must take reasonable steps to verify that the person providing consent is indeed the child's parent or guardian. In the online environment, this can be difficult. Methods range from requiring a parent's email address or mobile number to more robust verification through identity documents or payment card authorisation.

Informed Consent

Parents must be provided with sufficient information to make an informed decision about their child's data. This includes what data is collected, how it will be used, who will have access to it and how long it will be retained. The information should be presented in clear, accessible language rather than buried in lengthy terms and conditions.

Ongoing Control

Best practice suggests that parents should have ongoing ability to review their child's data, withdraw consent and request deletion. Organisations that provide parent dashboards or account controls demonstrate a commitment to responsible data handling that goes beyond minimum compliance.

EdTech Industry Obligations

Singapore's EdTech sector has experienced significant growth, with schools and institutions increasingly adopting digital learning platforms, assessment tools and communication systems. These platforms typically collect extensive personal data about students, including academic performance, behaviour patterns, attendance records and sometimes biometric data.

Data Collection Minimisation

EdTech providers should collect only the personal data that is necessary for the educational purpose. The temptation to collect additional data for analytics, product development or commercial purposes must be resisted when dealing with children's data. The PDPA's purpose limitation obligation is particularly important in this context.

Security of Student Data

Student data is attractive to cyber criminals and can be used for identity theft that may not be discovered until the child reaches adulthood. EdTech providers must implement robust security measures, including encryption, access controls and regular penetration testing, to protect student data from unauthorised access.

Data Retention and Deletion

EdTech platforms should not retain student data indefinitely. Once the educational purpose has been fulfilled or the student's enrolment ends, personal data should be deleted or anonymised in accordance with the PDPA's retention limitation obligation. Clear data retention policies should be communicated to schools and parents.

School Data Protection Responsibilities

Schools in Singapore have a dual role as both collectors and processors of student data. They collect personal data directly from students and parents, and they engage EdTech providers and other vendors who process data on their behalf.

Schools should:

• Appoint a Data Protection Officer: Designate a DPO responsible for overseeing data protection practices within the school
• Develop clear policies: Create and communicate data protection policies that address the collection, use and disclosure of student data
• Conduct vendor due diligence: Assess the data protection practices of EdTech providers and other vendors before sharing student data with them
• Train staff: Ensure teachers and administrative staff receive regular data protection training relevant to handling student data
• Manage consent: Obtain proper parental consent for data collection and processing activities, particularly those involving third-party platforms

Age Verification Challenges

One of the most significant practical challenges in protecting children's data online is accurately determining a user's age. Common approaches include:

• Self-declaration: Asking users to enter their age or date of birth. This is the simplest method but also the least reliable, as children can easily misrepresent their age
• Parental email verification: Sending a verification email to a parent's address. This provides some assurance but is not foolproof
• Identity verification: Requiring government-issued identification. This is more reliable but raises additional privacy concerns and may create barriers to access
• AI-based age estimation: Using artificial intelligence to estimate age from facial features. This technology is improving but remains imprecise and raises its own privacy implications

No single method is perfect, and organisations should adopt an approach proportionate to the risk associated with their service. Higher-risk services that involve sensitive data or interactions should implement more robust age verification mechanisms.

Marketing and Children's Data

Using children's personal data for marketing purposes is a particularly sensitive area. While the PDPA does not contain a blanket prohibition on marketing to children, organisations should exercise extreme caution. The PDPC's Do Not Call (DNC) registry provisions apply to marketing messages, and parental consent is required for marketing to children.

Best practice is to avoid targeting marketing at children altogether. If marketing involves children's data, organisations should ensure that consent has been obtained from parents, that marketing content is appropriate and that clear opt-out mechanisms are available.

Cross-Border Considerations

Many EdTech platforms and digital services used by Singapore children are operated by overseas companies. When children's data is transferred overseas, the PDPA's transfer limitation obligation applies. Organisations must ensure that overseas recipients provide a comparable standard of protection, which is particularly important when dealing with the sensitive data of minors.

Practical Recommendations

1. Conduct a children's data audit: Identify all instances where your organisation collects or processes children's personal data and assess compliance with the PDPA
2. Implement privacy by design: Build data protection into new products and services from the outset, with specific consideration for children as users
3. Create child-friendly privacy notices: Develop privacy notices that are understandable to both parents and, where appropriate, to children themselves
4. Establish parental controls: Provide mechanisms for parents to review, manage and delete their child's personal data
5. Review vendor arrangements: Ensure all vendors and service providers that process children's data meet adequate data protection standards
6. Monitor regulatory developments: Stay informed about evolving guidance from the PDPC and IMDA regarding children's data protection

Conclusion

Protecting children's personal data is both a legal obligation and an ethical responsibility. Organisations that handle children's data in Singapore must go beyond minimum compliance and adopt practices that genuinely safeguard young people's privacy. The PDPA provides the legal framework, but effective protection requires a combination of thoughtful policy design, robust technical controls and a culture of responsibility. For organisations seeking to strengthen their approach to children's data protection, engaging professional DPO support can provide the guidance needed to meet both regulatory expectations and the trust of parents and schools.