Public Sector (Governance) (Amendment) Bill

This Act is the Public Sector (Governance) (Amendment) Act 2025 and comes into operation on a date that the Minister appoints by notification in the Gazette.

In the Public Sector (Governance) Act 2018 (called in this Act the principal Act), in section 2(1) —(a)before the definition of “chairperson”, insert —“ “anonymised information” means any information which is in anonymised or de‑identified form;”;(b)replace the definition of “data sharing direction” with —“ “data sharing and use direction” has the meaning given by section 4(5);”;(c)after the definition of “function”, insert —“ “further authorisation” has the meaning given by section 4(5)(b);”;(d)after the definition of “member”, insert —“ “non‑public sector person” has the meaning given by section 4(5)(b);”; and(e)in the definition of “share”, delete “(or be provided with)”.

In the principal Act, in section 4 —(a)in subsection (3)(e), replace “and sharing of information” with “, and sharing and use of information”;(b)in subsection (3)(e), after “another Singapore public sector agency”, insert “or a non‑public sector person”; and(c)after subsection (4), insert —“(5) A direction under subsection (1) relating to the sharing and use of information under the control of a Singapore public sector agency (called in this Act a data sharing and use direction) may authorise the Singapore public sector agency to whom the direction is given (A) to do all or any of the following:(a)share information under the control of A with any other Singapore public sector agency;(b)share information under the control of A with any person that is not a Singapore public sector agency (called in this Act a non‑public sector person), but only with the further authorisation of any Minister to do so (called in this Act a further authorisation);(c)use information under the control of A;(d)re‑identify anonymised information under the control of A.(6) A data sharing and use direction given to a Singapore public sector agency (A) must specify —(a)the purposes for which A may share or use information, or re‑identify anonymised information, under the direction;(b)in the case of a direction authorising the acts mentioned in subsection (5)(a), (b) or (c) — the information under the control of A that A may share or use under the direction;(c)in the case of a direction authorising the acts mentioned in subsection (5)(a) or (b) — the other Singapore public sector agencies, or non‑public sector persons, with whom A may share information under the direction; and(d)in the case of a direction authorising the act mentioned in subsection (5)(d) — the anonymised information under the control of A that A may re‑identify under the direction.(7) A data sharing and use direction authorising the act mentioned in subsection (5)(b) may (but need not) —(a)specify the Minister or Ministers who may give a further authorisation pursuant to the direction; or(b)provide that any Minister may delegate, under section 36(2) or (3) of the Interpretation Act 1965, the function of giving a further authorisation pursuant to the direction.(8) A further authorisation pursuant to a data sharing and use direction given to a Singapore public sector agency (A) authorising the act mentioned in subsection (5)(b) must specify —(a)the specific purpose or purposes (among the purposes specified under subsection (6)(a) in the direction) for which A may share information with a non‑public sector person;(b)the specific information (of the information specified under subsection (6)(b) in the direction) that A may share with a non‑public sector person; and(c)the specific non‑public sector person or persons (among the non‑public sector persons specified under subsection (6)(c) in the direction) with whom A may share information.”.

“(5) A direction under subsection (1) relating to the sharing and use of information under the control of a Singapore public sector agency (called in this Act a data sharing and use direction) may authorise the Singapore public sector agency to whom the direction is given (A) to do all or any of the following:(a)share information under the control of A with any other Singapore public sector agency;(b)share information under the control of A with any person that is not a Singapore public sector agency (called in this Act a non‑public sector person), but only with the further authorisation of any Minister to do so (called in this Act a further authorisation);(c)use information under the control of A;(d)re‑identify anonymised information under the control of A.

A data sharing and use direction given to a Singapore public sector agency (A) must specify —(a)the purposes for which A may share or use information, or re‑identify anonymised information, under the direction;(b)in the case of a direction authorising the acts mentioned in subsection (5)(a), (b) or (c) — the information under the control of A that A may share or use under the direction;(c)in the case of a direction authorising the acts mentioned in subsection (5)(a) or (b) — the other Singapore public sector agencies, or non‑public sector persons, with whom A may share information under the direction; and(d)in the case of a direction authorising the act mentioned in subsection (5)(d) — the anonymised information under the control of A that A may re‑identify under the direction.

A data sharing and use direction authorising the act mentioned in subsection (5)(b) may (but need not) —(a)specify the Minister or Ministers who may give a further authorisation pursuant to the direction; or(b)provide that any Minister may delegate, under section 36(2) or (3) of the Interpretation Act 1965, the function of giving a further authorisation pursuant to the direction.

A further authorisation pursuant to a data sharing and use direction given to a Singapore public sector agency (A) authorising the act mentioned in subsection (5)(b) must specify —(a)the specific purpose or purposes (among the purposes specified under subsection (6)(a) in the direction) for which A may share information with a non‑public sector person;(b)the specific information (of the information specified under subsection (6)(b) in the direction) that A may share with a non‑public sector person; and(c)the specific non‑public sector person or persons (among the non‑public sector persons specified under subsection (6)(c) in the direction) with whom A may share information.”.

In the principal Act, in Part 2, in Division 2, in the Division heading, after “data sharing”, insert “and use”.

In the principal Act, replace section 6 with —“Authority to share, use and re‑identify6.—(1) If a data sharing and use direction is given to a Singapore public sector agency (A) —(a)the persons mentioned in subsection (2) are authorised to share information under the control of A with another Singapore public sector agency, to the extent permitted by the direction;(b)if a further authorisation pursuant to that direction is given to A — the persons mentioned in subsection (2) are authorised to share information under the control of A with any non‑public sector person, to the extent permitted by the direction and the further authorisation;(c)the persons mentioned in subsection (2) are authorised to use information under the control of A, to the extent permitted by the direction;(d)the persons mentioned in subsection (2) are authorised to re‑identify anonymised information under the control of A, to the extent permitted by the direction; and(e)any Singapore public sector agency (other than A) may be provided with information under the control of A, to the extent permitted by the direction.(2) For the purposes of subsection (1)(a), (b), (c) and (d), the persons mentioned are —(a)A and every officer of A; and(b)if A is a public body — the members of A.(3) Subsection (1) overrides any obligation as to confidentiality under the common law.(4) However, subsection (1) does not override —(a)any obligation as to confidentiality because of legal professional privilege; or(b)any obligation as to confidentiality because of contract.(5) To avoid doubt, this Act is not intended to prevent or discourage the sharing or use of information by Singapore public sector agencies as permitted or required by or under any Act or other law (apart from this Act).”.

For the purposes of subsection (1)(a), (b), (c) and (d), the persons mentioned are —(a)A and every officer of A; and(b)if A is a public body — the members of A.

Subsection (1) overrides any obligation as to confidentiality under the common law.

However, subsection (1) does not override —(a)any obligation as to confidentiality because of legal professional privilege; or(b)any obligation as to confidentiality because of contract.

To avoid doubt, this Act is not intended to prevent or discourage the sharing or use of information by Singapore public sector agencies as permitted or required by or under any Act or other law (apart from this Act).”.

If a data sharing and use direction is given to a Singapore public sector agency (A) —(a)the persons mentioned in subsection (2) are authorised to share information under the control of A with another Singapore public sector agency, to the extent permitted by the direction;(b)if a further authorisation pursuant to that direction is given to A — the persons mentioned in subsection (2) are authorised to share information under the control of A with any non‑public sector person, to the extent permitted by the direction and the further authorisation;(c)the persons mentioned in subsection (2) are authorised to use information under the control of A, to the extent permitted by the direction;(d)the persons mentioned in subsection (2) are authorised to re‑identify anonymised information under the control of A, to the extent permitted by the direction; and(e)any Singapore public sector agency (other than A) may be provided with information under the control of A, to the extent permitted by the direction.

In the principal Act, in section 7 —(a)in subsections (1)(b) and (3)(b) and (d)(i) and (ii), replace “data sharing direction” with “data sharing and use direction or further authorisation”;(b)in subsection (1)(d)(i) and (ii), after “direction”, insert “or further authorisation”;(c)after subsection (1), insert —“(1A) If —(a)information (other than personal data) has been shared by a Singapore public sector agency with a non‑public sector person in accordance with a data sharing and use direction;(b)an individual discloses, or the individual’s conduct causes disclosure of, the information to another person (whether or not a Singapore public sector agency);(c)the disclosure is not authorised by the data sharing and use direction or by any further authorisation given pursuant to that direction;(d)the individual is an employee or officer of the non‑public sector person at the time of the disclosure; and(e)the individual does so —(i)knowing that the disclosure is not authorised by that data sharing and use direction or further authorisation; or(ii)reckless as to whether the disclosure is authorised by that data sharing and use direction or further authorisation,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.”;(d)in subsection (2), replace “subsection (1)” with “subsection (1) or (1A)”;(e)in subsection (2)(a), delete “under the control of the Singapore public sector agency”;(f)in subsections (2)(b) and (6), delete “under the control of a Singapore public sector agency”;(g)after subsection (4), insert —“(4A) If —(a)information (other than personal data) has been shared by a Singapore public sector agency with a non‑public sector person in accordance with a data sharing and use direction;(b)an individual makes use of the information;(c)the use is not authorised by the data sharing and use direction or by any further authorisation given pursuant to that direction;(d)the individual is an employee or officer of the non‑public sector person at the time of the use; (e)the individual does so —(i)knowing that the use is not authorised by that data sharing and use direction or further authorisation; or(ii)reckless as to whether the use is authorised by that data sharing and use direction or further authorisation; and(f)the individual as a result of that use —(i)obtains a gain for the individual or another person;(ii)causes harm to another individual; or(iii)causes a loss to another person,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.”;(h)in subsection (5), replace “subsection (3) or (4)” with “subsection (3), (4) or (4A)”;(i)in subsection (5)(a) and (b), delete “under the control of A”; and(j)in subsection (7), after the definition of “loss”, insert —“ “officer” —(a)in relation to a non‑public sector person that is a corporation or partnership, means any director, partner, chief executive, manager, secretary or other similar officer of the corporation, and includes —(i)any person purporting to act in any such capacity; and(ii)for a corporation whose affairs are managed by its members, any of those members as if the member were a director of the corporation; and(b)in relation to a non‑public sector person that is an unincorporated association (other than a partnership), means the president, the secretary or any member of the committee of the unincorporated association, and includes —(i)any person holding a position analogous to that of president, secretary or member of the committee of the unincorporated association; and(ii)any person purporting to act in any such capacity;”.

“(1A) If —(a)information (other than personal data) has been shared by a Singapore public sector agency with a non‑public sector person in accordance with a data sharing and use direction;(b)an individual discloses, or the individual’s conduct causes disclosure of, the information to another person (whether or not a Singapore public sector agency);(c)the disclosure is not authorised by the data sharing and use direction or by any further authorisation given pursuant to that direction;(d)the individual is an employee or officer of the non‑public sector person at the time of the disclosure; and(e)the individual does so —(i)knowing that the disclosure is not authorised by that data sharing and use direction or further authorisation; or(ii)reckless as to whether the disclosure is authorised by that data sharing and use direction or further authorisation,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.”;

“(4A) If —(a)information (other than personal data) has been shared by a Singapore public sector agency with a non‑public sector person in accordance with a data sharing and use direction;(b)an individual makes use of the information;(c)the use is not authorised by the data sharing and use direction or by any further authorisation given pursuant to that direction;(d)the individual is an employee or officer of the non‑public sector person at the time of the use; (e)the individual does so —(i)knowing that the use is not authorised by that data sharing and use direction or further authorisation; or(ii)reckless as to whether the use is authorised by that data sharing and use direction or further authorisation; and(f)the individual as a result of that use —(i)obtains a gain for the individual or another person;(ii)causes harm to another individual; or(iii)causes a loss to another person,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.”;

In the principal Act, in section 8 —(a)in subsection (1)(b) and (d)(i) and (ii), replace “data sharing direction” with “data sharing and use direction or further authorisation”; and(b)in subsection (4), delete the definition of “anonymised information”.

In the Personal Data Protection Act 2012, in section 48C —(a)in subsection (1), before the definition of “disclose”, insert —“ “data sharing and use direction” and “further authorisation” have the meanings given by section 2(1) of the Public Sector (Governance) Act 2018;”; and(b)after subsection (2), insert —“(3) For the purposes of this Part, where a public agency (A) that is also a Singapore public sector agency shares personal data in its possession or control in accordance with a data sharing and use direction with an organisation or another public agency (B) —(a)A does not cease to have possession or control of the personal data merely by reason that A shared the personal data with B;(b)any disclosure of the personal data by an individual that is not authorised by the data sharing and use direction or by any further authorisation pursuant to that direction is, for the purposes of section 48D(1)(b) and (c), not authorised by A or by B;(c)any use of the personal data by an individual that is not authorised by the data sharing and use direction or by any further authorisation pursuant to that direction is, for the purposes of section 48E(1)(b) and (c), not authorised by A or by B; and(d)if the personal data is or consists of anonymised information — any re‑identification of the person to whom the anonymised information relates that is not authorised by the data sharing and use direction or by any further authorisation pursuant to that direction is, for the purposes of section 48F(1)(b) and (c), not authorised by A or by B.”.

“(3) For the purposes of this Part, where a public agency (A) that is also a Singapore public sector agency shares personal data in its possession or control in accordance with a data sharing and use direction with an organisation or another public agency (B) —(a)A does not cease to have possession or control of the personal data merely by reason that A shared the personal data with B;(b)any disclosure of the personal data by an individual that is not authorised by the data sharing and use direction or by any further authorisation pursuant to that direction is, for the purposes of section 48D(1)(b) and (c), not authorised by A or by B;(c)any use of the personal data by an individual that is not authorised by the data sharing and use direction or by any further authorisation pursuant to that direction is, for the purposes of section 48E(1)(b) and (c), not authorised by A or by B; and(d)if the personal data is or consists of anonymised information — any re‑identification of the person to whom the anonymised information relates that is not authorised by the data sharing and use direction or by any further authorisation pursuant to that direction is, for the purposes of section 48F(1)(b) and (c), not authorised by A or by B.”.

In the Copyright Act 2021, in section 283(2)(b) and (4), replace “data sharing direction” with “data sharing and use direction”.

In the Food Safety and Security Act 2025, in section 35(6), replace “data sharing direction” with “data sharing and use direction”.

In the Moneylenders Act 2008, in section 81A —(a)in the section heading, replace “data sharing direction” with “data sharing and use direction”;(b)in subsections (1) and (2), replace “data sharing direction” with “data sharing and use direction”; and(c)in subsection (3), replace the definitions of “control” and “Singapore public sector agency” and “data sharing direction” with —“ “control”, “data sharing and use direction” and “Singapore public sector agency” have the meanings given by section 2(1) of the Public Sector (Governance) Act 2018;”.

In the Online Safety (Relief and Accountability) Act 2025, in section 55 —(a)in subsection (1)(b), replace “data sharing direction” with “data sharing and use direction”; and(b)replace subsection (4) with —“(4) In this section, “data sharing and use direction” has the meaning given by section 2(1) of the Public Sector (Governance) Act 2018.”.

“(4) In this section, “data sharing and use direction” has the meaning given by section 2(1) of the Public Sector (Governance) Act 2018.”.

For a period of 2 years after the date of commencement of any provision of this Act, the Minister charged with the responsibility for public sector data governance may, by regulations, prescribe any provision of a saving or transitional nature consequent on the enactment of that provision that the Minister may consider necessary or expedient.