Is Doxxing Illegal in Singapore? POHA, Penalties and How to Get Content Removed

Is Doxxing Illegal in Singapore? POHA, Penalties and How to Get Content Removed

The Short Answer: Yes, Since 2020

Is doxxing illegal in Singapore? Yes. Amendments to the Protection from Harassment Act (POHA) that came into force on 1 January 2020 made doxxing a specific offence. Publishing someone’s personal information — their identity, contact details, address, workplace, photos, or family information — can be criminal when it is done to harass, alarm or distress them, or to make them fear violence, or to facilitate violence against them.

Before 2020, victims had to stretch general harassment provisions around information-sharing cases. The amendments closed that gap explicitly, and Singapore courts have since dealt with cases arising from road disputes, neighbour conflicts, relationship breakdowns, and online vigilante campaigns — the classic contexts where someone posts “this is the person, here’s where they live” to a large audience.

What Counts as Doxxing Under POHA

The offence turns on two elements: publishing identity information about a person, and the intent or knowledge behind publishing it. Identity information is broad — name, photos, NRIC number, contact details, home address, employment details, vehicle registration, and information about family members all qualify. The publication element covers social media posts, forum threads, group chats with meaningful reach, and websites alike.

Three intent tiers matter legally:

• Publishing to harass, alarm or distress the victim
• Publishing to cause the victim to fear unlawful violence
• Publishing to facilitate unlawful violence against the victim

Context supplies the intent: posting someone’s workplace alongside “everyone go tell his boss what he did” or their address under “someone should teach her a lesson” is precisely what the provisions target. Merely mentioning a public figure’s published role, or sharing information already lawfully public in a neutral context, generally is not doxxing — though the line can be finer than people assume, and republishing (sharing someone else’s doxxing post) can itself be an offence.

Penalties and Protection Orders

Doxxing offences carry fines up to $5,000, imprisonment up to 6 months (12 months for the violence-related tiers), or both. Repeat offenders face enhanced penalties.

Separately from prosecution, victims can apply for a Protection Order through the Protection from Harassment Court — a specialist court with simplified, expedited procedures. Protection orders can require the harasser to stop publishing, require content to be taken down, and in urgent cases an Expedited Protection Order can be granted quickly. For victims, this civil route is often more practically useful than the criminal one: it directly targets getting the content down and the behaviour stopped.

What to Do If You’ve Been Doxxed (First 24 Hours)

1. Preserve evidence before anything else. Screenshot the posts with URLs, usernames, timestamps, and visible share counts. Takedowns remove the content — which is what you want — but they also remove the evidence, so capture first. Screen-record scrolling through comment threads for context.
2. Do not engage the poster. Replies escalate, get screenshotted, and feed the thread’s visibility.
3. Lock down what’s exposed. If your address or schedule is public, consider immediate practical safety steps. Tighten privacy settings on your own accounts, which are usually being mined for more material.
4. Report to the platform under the right policy — every major platform prohibits doxxing (details in the next section).
5. Consider a police report, particularly where there is any violence angle. Your preserved evidence makes this straightforward.

Getting Doxxing Content Removed From Platforms

Every major platform bans sharing personal information to harass — Facebook and Instagram under Meta’s privacy-violation and bullying policies, TikTok under its harassment and privacy guidelines, X under its private-information policy, Reddit under sitewide Rule 3, and HardwareZone under its terms of service. Doxxing removals are among the higher-success categories on all of them when reported under the correct policy — the common failure is reporting doxxing as generic “harassment” and getting an automated rejection while the specific privacy-violation channel would have acted.

The practical difficulty is footprint: doxxing spreads through shares, screenshots, and repost accounts, so removing the original post alone rarely ends the exposure. A systematic sweep — original, shares, screenshots on other platforms, and any forum threads — is what actually restores privacy. That mapping-and-removal work is the core of our personal information removal service, and for platform-specific situations see our Facebook & Instagram, TikTok, and forum post removal services.

Removing Your Personal Information From Google

Even after the source posts come down, cached copies and slow-to-update pages can keep your information findable. Google’s personal-information removal policies let you request removal of search results exposing your contact details, identification numbers, and content posted as doxxing — independently of whether the source site cooperates. Combined with source-level removal, this closes the loop: the information is neither hosted nor findable. We cover the full process in our companion guide on removing personal information from Google.

Doxxing and Businesses: When Staff Get Targeted

An increasingly common pattern in Singapore: a customer conflict gets filmed, the video goes viral, and internet vigilantes identify and dox the staff member involved — name, home address, family photos. Employers are not bystanders here. The affected employee needs the company’s support with evidence preservation, platform reporting, and often a police report; the company needs parallel crisis management because the same virality is usually hitting its reviews and social accounts simultaneously.

Businesses should also be careful on the other side of the line: publicly posting CCTV stills or personal details of a suspected shoplifter, bad customer, or scammer can itself amount to doxxing under POHA. Route evidence to the police rather than to your Facebook page.

Frequently Asked Questions

Is sharing someone’s photo alone considered doxxing in Singapore?

A photo is identity information, so publishing it with intent to harass — for example, in a “shame this person” post — can qualify. Context decides: the same photo shared neutrally would generally not be an offence.

Can I be liable for sharing a doxxing post someone else created?

Yes. Republishing identity information with the requisite intent or knowledge can itself be an offence — “I only shared it” is not a defence. This is worth remembering before joining any online vigilante pile-on.

Does it matter if the information was already publicly available?

Less than people assume. The offence concerns the use and intent of the publication, not only the secrecy of the information — compiling and publishing publicly-findable details in a harassing context can still qualify.

How fast can doxxing content be removed?

Platform removals for well-documented doxxing reports typically complete within 2 to 10 days, with urgent safety cases moving faster. Full-footprint cleanups including forums, screenshots, and Google’s index usually take 3 to 6 weeks.