Organisations must obtain your consent to the collection, use or disclosure of your personal data, unless any exception under the PDPA applies. You may refer to the
Second, Third and Fourth Schedules of the PDPA for a list of exceptions. You should also be notified of the purposes for the collection, use and disclosure of your personal data.
In this regard, organisations shall not, as a condition of supplying a product or service, require you to consent to the collection, use or disclosure of personal data beyond what is reasonable to provide the product or service. For example, an organisation that sells a consumer product should not require you to reveal your annual household income as a condition of selling you the product, although it may still ask you to provide such personal data as an optional field.
If the organisation wishes to collect any additional personal data, the organisation should provide you the option of whether to consent to this.