Is Doxxing Illegal in Singapore? The Three POHA Offences — and the Line Where Lawful Investigation Becomes One

2026-07-18 · Philip Choo · AI9OS

Two people type the same name into the same search engine and find the same residential address. One is a licensed investigator preparing a service-of-process report for a law firm; the other posts it under a viral video, inviting strangers to pay a visit. One is practising a regulated profession; the other is committing an offence — up to six months' imprisonment on the harassment route, twelve where the post invites violence.

Is doxxing illegal in Singapore? Yes. Since 1 January 2020, publishing a person's identity information to harass them or to expose them to violence has been a criminal offence under the Protection from Harassment Act (POHA), via amendments passed on 7 May 2019. Three routes lead into the offence — s 3(1)(c), s 5(1A)(a) and s 5(1A)(b) — carrying up to a $5,000 fine and six months' imprisonment on the harassment route, twelve months on the violence routes.

The harder question is where the line sits, because Parliament did not criminalise finding the information — it criminalised what happens next. The same act of discovery is a profession on one side of the line and an offence on the other; everything turns on publication, intent and course of conduct.

What counts as doxxing — three offences, one wide definition

Doxxing under Singapore law means publishing "identity information" with a prohibited intention, knowledge or effect. Section 2 POHA defines identity information as anything that, alone or with other information, identifies or purports to identify an individual — expressly including name, residential address, email, telephone number, date of birth, NRIC or passport number, signature or password; any photograph or video; and family, employment or education details. The casual defence but it was only a photo fails on the text — a photograph qualifies, so does a workplace, and harmless fragments become identity information the moment they assemble into a person.

Route 1 — publication to harass (s 3(1)(c)). Publishing a target's or a related person's identity information, intending to cause harassment, alarm or distress, and causing it — to the target or anyone else. Up to $5,000, six months, or both. The statutory illustration is doxxing in miniature: X posts an ex-partner's photographs and mobile number so strangers can contact her; strangers proposition her; X is guilty although she never saw the posts.

Route 2 — publication to endanger (s 5(1A)(a)). Publishing identity information intending the victim to fear unlawful violence against themselves or another person, or to facilitate such violence. Up to $5,000, twelve months, or both.

Route 3 — publication likely to endanger (s 5(1A)(b)). The same act, done knowing or having reasonable cause to believe those effects are likely — foreseeability convicts. Same penalties.

Maximums double for repeat offenders (s 8), and rise to twice the maximum where the victim is vulnerable or an intimate partner, present or former (ss 8A–8B). The statute's counter-illustration — reckless-driving footage posted to warn other road users is no offence — draws the line through the mind, not the mouse.

If you have been doxxed — the remedies, in filing order

Your name, block and unit number and a photograph of your front door, posted to a Telegram group of several thousand strangers — by evening, the phone calls have started. Since 1 June 2021, a dedicated Protection from Harassment Court (Part 3A POHA) runs a simplified track built for unrepresented applicants. Capture, then report — never the reverse.

1. Preserve first. Full-page screenshots with URL, account, date, time and audience context — takedown is a remedy and an evidence-destruction event at the same time.

2. Do not counter-publish. Posting your harasser's name, photograph or workplace to shame them is also publishing identity information; a victim can commit the s 3(1)(c) offence as readily as an aggressor.

3. Report. A police report grounds the criminal limbs — s 3(1)(c) for harassment, s 5(1A) where the publication threatens or facilitates violence.

4. Apply for a Protection Order. Under s 12 a court may grant a PO, on the balance of probabilities, against a respondent who contravened ss 3 to 7 and is likely to repeat it — applications are targeted for disposal in about four weeks. Where risk is immediate, an Expedited Protection Order (s 13) is heard within a target of 48 to 72 hours — 24 where violence is involved — and holds until the PO hearing. Orders extend to related persons; breach is itself an offence.

5. Claim. Section 11 gives civil damages, filed online through the Community Justice and Tribunals System's simplified track — one claimant, up to five respondents, within two years, $20,000 or less. Where falsehoods travel with the leak, Part 3 of POHA adds stop-publication, correction and disabling orders, including interim versions.

Unlawful stalking — when the gathering itself is the offence

The doxxing limbs criminalise publication; s 7 criminalises the pattern of collection. Unlawful stalking needs three elements (s 7(2)): a course of conduct involving acts associated with stalking; harassment, alarm or distress actually caused; and intention or imputed knowledge that it was likely. Up to $5,000, twelve months, or both (s 7(6)).

Section 7(3)'s examples deserve a slow read in this industry: following the victim or a related person; communications to or about the victim; loitering near their residence or workplace; and keeping them under surveillance. Surveillance — the investigator's ordinary working method — is a listed act; what separates lawful fieldwork from the offence is harm and mental state, inside a course of conduct.

And "course of conduct" is thinner than it sounds: a single protracted occasion qualifies (s 7(10)). In Lee Shing Chan v Public Prosecutor [2020] SGHC 41, following the victim for about three hours on one afternoon sufficed — convictions upheld. Three hours is a short shift.

The investigator's line — where the method becomes the offence

Lawful open-source investigation and criminal doxxing can begin with identical keystrokes; three variables separate them.

Publication is the trigger. The doxxing limbs punish those who "publish". Compiling identity information into a case file for a defined lawful purpose is governed by different law — the PDPA's collection rules, including the investigations exception in Part 3 of the First Schedule, and the obligations of licensed work. Push the same compilation to an audience — a Telegram group, a comment thread, a name-and-shame page — and the analysis changes statutes. In October 2021, the creator of a Telegram group compiling men's details from dating apps into a spreadsheet deleted it and apologised after lawyers pointed to possible POHA liability.

Intent and knowledge do the convicting. Route 1 needs intent to harass; Route 3 only reasonable cause to believe violence is likely — I meant no harm is no answer under s 5(1A)(b) when the context was already inflamed.

Persistence catches the collection. Even without publication, fieldwork that becomes protracted, felt and distressing can satisfy s 7 — surveillance is on the statutory list, and Lee Shing Chan says one long afternoon is enough. An investigation designed to need a statutory defence has already failed its own risk assessment.

Collection is rarely the offence; publication and persistence are. Scope, not skill, keeps open-source work lawful.

Making the line machine-visible

On our platform the line is enforced in software. Every case opens with a declared lawful purpose and a named legal basis before a single query runs; identity information is tagged at capture. There is no publish surface — nothing on the platform can post, share or broadcast a finding, so the act all three doxxing offences criminalise is structurally unavailable. Disclosure runs through a human adjudication step, Gate 9, which asks what the statute asks: who receives this, for what purpose, and what could they foreseeably do with it. Methods that involve repeated contact with, proximity to, or communications about a subject are flagged for the same adjudication before they run, not after.

The design mirrors POHA itself: the Act punishes publication, intent and persistence, not knowledge — so the platform logs collection, gates disclosure and timestamps both. If the offence is what happened after discovery, the record of it is the practitioner's first line of defence.

Parliament's 2019 answer was precise — it criminalised the weaponisation of identity, not its discovery, and a precise line is a line software can hold.

The searcher and the stalker use the same engine. The statute never asks what you found — it asks what you did next.

General information for practitioners, not legal advice. AI9OS is an open-source-intelligence technology platform; investigation services are conducted solely by licensed agencies under Singapore's Private Security Industry Act.