Online safety & content laws in Singapore (2026)

Designated app distribution services — Apple App Store, Google Play Store, Huawei App Gallery, Microsoft Store and Samsung Galaxy Store — must implement age assurance measures that prevent users under 18 from accessing and downloading age-inappropriate apps. This is the most concrete age-verification requirement yet in Singapore's online safety architecture.

Key provisions of the 2024 amendment take effect, extending CII obligations to cloud-hosted and virtual systems, mandating 2-hour reporting of suspected APT incidents, and requiring disclosure of supply-chain cyber incidents. This modernises critical infrastructure protection for cloud-era architectures.

Parliament passed amendments to the Cybersecurity Act ensuring CII owners remain legally accountable for cybersecurity even when relying on third-party cloud or outsourced infrastructure, and expanding incident-reporting requirements to include supply-chain events — a direct response to cloud adoption risks.

The OCHA (passed July 2023) entered force, empowering the police and MHA to issue directions to online services to disable or restrict content facilitating scams and malicious cyber activities targeting Singapore users, with blocking orders available against non-compliant platforms — creating a law-enforcement-led complement to IMDA's content-safety regime.

IMDA designated Facebook, HardwareZone, Instagram, TikTok, X and YouTube under its Online Safety Code, requiring them to implement systems-and-processes measures to curb sexual, violent, self-harm, cyberbullying and other harmful content for Singapore users, with mandatory annual compliance reports — the first binding obligations on major social media platforms in Singapore.

This Act (gazetted December 2022) inserted a new Part into the Broadcasting Act establishing IMDA's powers to designate Online Communication Services and compel compliance with Codes of Practice on harmful content, providing the statutory basis for the social-media and app-store codes that followed.

POFMA empowers ministers to issue Correction Directions and Targeted Correction Directions to individuals and platforms that spread deliberate falsehoods of public interest; non-compliance triggers blocking orders. Enacted in May 2019 following the Select Committee's recommendations, it is Singapore's most-invoked and most-litigated online-speech law.

Singapore's first standalone cybersecurity statute established the Commissioner of Cybersecurity, a licensing regime for cybersecurity service providers, and mandatory CII owner obligations to report incidents, conduct audits and comply with directions — elevating cybersecurity from administrative policy to legally enforceable national obligation.

Parliament convened a Special Select Committee to examine the causes, consequences and countermeasures for deliberate online falsehoods; its September 2018 report unanimously recommended new legislation, directly triggering the drafting of POFMA and marking the pivot from self-regulation to statute for online speech.

Singapore's first comprehensive data-protection law established the Personal Data Protection Commission, created the Do Not Call registry, and set binding rules on collection, use and disclosure of personal data — providing the privacy-rights foundation that underpins online safety and data-handling obligations across the digital economy.

The Singapore Broadcasting Authority issued the Internet Code of Practice — the first formal content-regulation instrument for the internet — requiring ISPs and Internet Content Providers to prohibit content threatening public order, national security or racial/religious harmony. It established the class-licence model that remains the structural template for subsequent online-content rules.

Singapore's foundational cybercrime statute criminalised unauthorised computer access, modification of computer material and interception of computer services. Repeatedly amended (including a 2017 expansion to cover cyber-attacks on critical infrastructure), it remains the primary instrument for prosecuting individual online offences and complements every subsequent online-safety law.