What Is Illegal Doxxing Under Singapore Law and What to Do If You Are Targeted

Save every piece of evidence immediately. A WhatsApp group shares your home address, your NRIC number, and a photo of your family. Within an hour, strangers are messaging you. This is doxxing, and under Singapore's Protection from Harassment Act (POHA), the person who published that data may have committed a criminal offence. Take screenshots that show the full URL, the timestamp, and the app interface. Without these, you cannot prove the publication element to the police or to the Protection from Harassment Court. Then work through the legal and platform routes below to get the material removed and secure a court order.

Doxxing is defined under the Protection from Harassment Act (POHA) as the publication of personal data with the intent to cause harassment, alarm, or distress. The relevant provision is Section 3(1)(c), which came into effect on 1 January 2020 under the Protection from Harassment (Amendment) Act 2019. The law also covers publication that causes, or is likely to cause, fear of violence or provocation of violence under Section 5.

The term 'identity information' is defined in Section 2 of POHA. It includes anything that identifies or is likely to identify a person: name, employment details, photographs, contact details, residential address. It also covers NRIC numbers, family details, and any other data that can be linked back to an individual. The key is the intent behind the publication. If the person publishing the information intended to cause harassment, alarm, or distress, or knew or had reasonable cause to believe that such harm was likely, the act is an offence.

The POHA doxxing offence in Singapore covers two main scenarios. The first is publishing identity information with the intent to cause harassment, alarm, or distress. The second is publishing identity information with the intent to cause, or knowing it is likely to cause, fear of violence or provocation of violence. Both are criminal offences.

Intent Is the Deciding Factor

The law does not punish someone who accidentally shares a friend's phone number. The prosecution must prove that the person who published the information had a specific intent. Context matters. A post that says 'this person scammed me' and includes their home address and workplace is likely to be seen as intended to cause harassment or distress, not as a public service announcement.

Publication Element

Publication under POHA is broad. It includes posting on social media, sharing in a WhatsApp group, uploading to a website, or sending via email. The material does not need to reach a large audience. Sharing it with one person can still count as publication if the intent is present.

Enhanced Penalties for Targeting Public Servants

Section 6 of POHA provides for enhanced penalties when the victim is a public servant or a public service worker. The maximum punishment for any offence under Sections 3, 4, 5, or 7 can be increased by up to twice the usual maximum. This reflects the higher level of harm considered to result from targeting those in public roles.

The penalties for a first POHA Section 3 offence against a non-protected person are a fine of up to SGD 5,000, imprisonment of up to six months, or both. For a repeat offence, the maximum fine rises to SGD 10,000 and imprisonment to up to 12 months. These are the baseline penalties for the basic doxxing offence.

If the doxxing involves causing fear of violence or provocation of violence under Section 5, the penalties are higher. The court also has the power to order the removal of the identity information from publication under Section 12(2A) of POHA, which is a specific civil remedy for doxxing cases.

The Penal Code also contains a related offence under Section 377BA, which covers distributing intimate images without consent. This carries a maximum imprisonment of up to five years, along with a fine and possible caning. While this is a separate offence, it can overlap with doxxing when the published material includes intimate images.

Offence	Maximum Fine (First Offence)	Maximum Imprisonment (First Offence)	Maximum Fine (Repeat Offence)	Maximum Imprisonment (Repeat Offence)
Section 3(1)(c) – Doxxing with intent to cause harassment, alarm or distress	SGD 5,000	6 months	SGD 10,000	12 months
Section 5 – Doxxing causing fear of violence or provocation of violence	SGD 5,000	6 months	SGD 10,000	12 months
Section 6 – Offence against public servant (enhanced)	Up to 2x maximum under Section 3 or 5	Up to 2x maximum under Section 3 or 5	Up to 2x maximum under Section 3 or 5	Up to 2x maximum under Section 3 or 5

Reporting doxxing to the Singapore Police Force is the formal legal route. Make a report at any Neighbourhood Police Centre or via the e-services on the SPF website. The police will assess whether the publication meets the threshold of a criminal offence under POHA.

Step 1: Preserve the Evidence

Before you report, collect everything. Take screenshots that show the post, the URL, the app name, the date, and the time. If the material is in a private group, capture the group name and the sender's profile. Do not edit or crop the images in a way that removes the timestamp or URL. The police and the court need to see the publication element as it appeared.

Step 2: File the Police Report

Go to your nearest Neighbourhood Police Centre or file a report online through the SPF e-services portal. Provide all the evidence you have saved. The police will give you a report number. Keep it. If the police decide to investigate, they will gather evidence and may refer the case to the Attorney-General's Chambers for prosecution.

Step 3: Seek a Protection Order from the Court

Separately from the criminal process, apply to the Protection from Harassment Court for a protection order or an expedited protection order under Sections 11 to 13 of POHA. An expedited protection order can be obtained quickly if there is a serious risk of harm. The court can order the person who published the data to stop and can also order the removal of the material. This is a civil remedy, so you do not need a criminal conviction to get it.

The Protection from Harassment Court can also award monetary compensation for the harm caused by the doxxing. This is not a replacement for criminal prosecution, but it can provide financial redress for the impact on your life.

Reporting doxxing to the police is the legal route, but it is not the only route. Report the material directly to the service where it was published. Facebook, Instagram, TikTok, WhatsApp, Telegram, and Xiaohongshu all have community guidelines that prohibit the publication of personal data. Reporting the post under these policies can lead to its removal faster than a police investigation.

How to Report to a Service

Most services have a reporting function inside the app or website. Look for the report option on the specific post, message, or profile. Select the reason that matches your case: 'harassment' or 'privacy violation'. Provide a brief explanation and include the URL. Some services let you upload the screenshots you have saved. The service will review the report and decide whether to remove the material under its terms of service.

IMDA Online Safety Code Obligations

Designated social media services in Singapore are subject to the IMDA Online Safety Code. This code requires them to have systems in place to respond to harmful material, including doxxing. If the service is designated under this code, it must act on reports of such material. This creates an obligation that goes beyond general community guidelines. If the service does not remove the post after a report, escalate the matter to the IMDA.

Why Service Reporting Matters

Service reporting is faster than the legal process. A police report can take weeks or months to result in a prosecution. A service report can lead to removal within hours or days. Removal by the service does not replace a police report. The post may disappear, but the person who published it may still face criminal charges. Use both routes in parallel.

POHA provides two distinct legal paths for victims of doxxing. Understanding the difference helps you choose the right approach.

Criminal Prosecution Under Section 3 and Section 5

Section 3(1)(c) covers publishing identity information with intent to cause harassment, alarm, or distress. This is the most commonly used doxxing provision. Section 5 covers publishing identity information that causes or is likely to cause fear of violence or provocation of violence. This is a higher threshold and carries a more serious implication. Both are criminal offences that can be prosecuted by the state.

The police will investigate and, if there is sufficient evidence, refer the case to the Attorney-General's Chambers for prosecution. You do not need to hire a private lawyer for the criminal case. The state prosecutes on your behalf.

Civil Recourse Through the Protection from Harassment Court

Separate from criminal prosecution, you can seek civil remedies under Sections 11 to 13 of POHA. The Protection from Harassment Court can issue a protection order that prohibits the person from continuing to publish your information. It can also issue an expedited protection order if there is an urgent risk of harm. Under Section 12(2A), the court can order the removal of identity information from publication. This directly addresses the ongoing harm of the material being visible.

The civil route requires you to apply to the court yourself, though you can engage a lawyer to assist. The standard of proof is lower than in a criminal case, the balance of probabilities rather than beyond reasonable doubt, which can make it easier to obtain an order.