Cybercrime Law in Singapore
Singapore has a mature, actively enforced and frequently amended cybercrime and cybersecurity framework.
Key laws
- Computer Misuse Act 1993 (Act 19 of 1993; renamed from the Computer Misuse and Cybersecurity Act in 2018) — the core offences: unauthorised access to computer material (s 3), access with intent to commit or facilitate an offence (s 4), unauthorised modification of computer material (s 5), unauthorised use or interception of a computer service (s 6), unauthorised obstruction of use (s 7), unauthorised disclosure of an access code (s 8), disclosure of a password or access code relating to the national digital identity service (s 8A), supplying another person’s credential (s 8B), dealing in personal information obtained in breach of the Act (s 9) and obtaining items for use in offences (s 10), with enhanced punishment where a protected computer is involved (s 11). The Act is amended often — most recently by Act 21 of 2025, in force 30 December 2025 — and now carries a Second Schedule of “scam offences”, so always read the current version rather than a summary.
- Cybersecurity Act 2018 (Act 9 of 2018) — regulates Critical Information Infrastructure and puts the Cyber Security Agency of Singapore (CSA) on a statutory footing. Amended by Act 19 of 2024, in force 31 October 2025; the current text distinguishes provider-owned critical information infrastructure from other regulated categories.
- Online Criminal Harms Act 2023 (Act 24 of 2023) — directions and codes of practice aimed at online activity connected with criminal offences, including scams and malicious cyber activity.
- Personal Data Protection Act 2012 — data protection, including the notifiable data breach regime in Part 6A and the offences relating to personal data and anonymised information in Part 9B.
Enforcement
The Singapore Police Force, including its Cybercrime Command, investigates offences under the Computer Misuse Act. The Cyber Security Agency of Singapore (CSA) administers the Cybersecurity Act, and the Personal Data Protection Commission (PDPC) enforces the PDPA.
Plain-language overview, not legal advice. Laws change — read the current versions on Singapore Statutes Online linked above and consult a qualified lawyer for any specific question.
Sources verified 26 August 2026 against Singapore Statutes Online (Attorney-General’s Chambers). Singapore is not a party to the Budapest Convention on Cybercrime.