TRW & Co · Online safety and content
Doxxing and AI-Generated Intimate Images: New Offences and Remedies in Singapore
Doxxing law in Singapore makes it an offence to publish someone's personal details to harass or threaten them, and since 17 August 2026 producing intimate images without consent, including AI-generated ones, is also a crime. Victims can combine a police report, a fast takedown through the Online Safety Commission, a court protection order and a claim for damages.
Key pointThe strongest response uses several remedies in sequence: preserve evidence, report to the police, seek takedown through the Online Safety Commission, then use a protection order and damages claim against a known harasser.
At a glance
Commencement date
The second phase of the Criminal Law (Miscellaneous Amendments) Act 2025, covering AI-generated intimate images and doxxing of public servants, took effect on 17 August 2026.
AI images covered
Intimate images now include wholly synthetic material, and producing an intimate image of a person without consent is a new offence, whether or not it is shared.
Public servant doxxing
Prosecutors no longer need to prove harassment, alarm or distress where the offender intended to harass, and doxxing with a falsehood is a new offence.
Fast takedown route
Victims of doxxing and intimate image abuse can report directly to the Online Safety Commission, which can direct platforms and posters to disable access.
Court protection
The Protection from Harassment Court can grant protection orders, expedited orders and damages, but applicants must serve orders and enforce breaches themselves.
Swipe or scroll →
The short answer: doxxing law in Singapore after 17 August 2026
Doxxing law in Singapore makes it an offence to publish someone's identity information, such as a home address, phone number or workplace, with intent to harass, threaten or facilitate violence against them. Sharing, threatening to share or producing intimate images of a person without consent is also a crime, and since 17 August 2026 the law expressly covers images generated entirely by artificial intelligence.
For victims, the law is only useful if it leads to action. There are now four practical routes, which can be used together: a police report, a report to the Online Safety Commission for fast takedown, a protection order from the Protection from Harassment Court, and a civil claim for damages.
This article is written for victims, their families and the organisations that support them. It explains what changed, which remedy fits which situation and what to do in the first hours. It does not discuss how such material is made.
What changed on 17 August 2026
The Criminal Law (Miscellaneous Amendments) Act 2025 was passed in November 2025 and is being brought into force in phases. According to the Ministry of Home Affairs' commencement announcement, the second phase took effect on 17 August 2026. The changes most relevant to victims of online abuse are summarised below.
| Area | What changed | Why it matters to victims |
|---|---|---|
| Definition of intimate image | Now covers synthetic material generated to depict a person without altering an original image or recording | Victims of AI-generated fakes no longer face an argument that no real image was involved |
| New production offence | Producing an intimate image of a person without consent, including AI-generated images, is an offence | Liability starts at creation, not only when the material is shared or threatened |
| Child abuse material | Expressly includes computer-generated material, without proof that a real child's image was used | Removes a technical defence in the most serious cases |
| Doxxing of public servants | Prosecution need not prove harassment, alarm or distress where the offender intended to harass | Protects officers and public service workers targeted for doing their jobs |
| Doxxing with a falsehood | New offence of doxxing a public servant together with a knowingly false statement | Addresses campaigns that pair personal details with fabricated allegations |
| Large-scale circulation | Higher penalties for circulating obscene material to ten or more people, and for running online groups or channels set up to facilitate it | Group and channel administrators now face direct criminal exposure |
MHA states that the new production offence carries up to two years' imprisonment, a fine or both, with mandatory imprisonment where the person depicted is below 14. The new offence of doxxing a public servant with a falsehood carries up to three years' imprisonment, a fine of up to S$10,000, or both.
For doxxing law in Singapore, these changes sit on top of the Online Safety (Relief and Accountability) Act 2025, which created the Online Safety Commission from 29 June 2026. Our separate guide on the Online Safety (Relief and Accountability) Act explains the Commission's procedure in detail; this article focuses on how the criminal changes and the other remedies fit together.
How doxxing law in Singapore works
The core doxxing offences are in the Protection from Harassment Act 2014 (POHA). They target publishing identity information of a person, or a related person, with intent to cause harassment, alarm or distress, or with intent to cause, or knowing it is likely to cause, fear or provocation of violence. Identity information is broad: it can include a photograph, address, workplace, school, contact details or a combination that makes the person locatable.
Doxxing law in Singapore therefore turns on intent and effect, not on whether the information was secret. An address that is technically discoverable can still be doxxed if it is published to an audience in a way intended to frighten or harass.
The 17 August 2026 changes add special protection for public servants and public service workers. Under the amended section 6 of POHA, the prosecution no longer needs to prove that the officer actually suffered harassment, alarm or distress, provided the offender intended to harass. A separate new offence in the Miscellaneous Offences (Public Order and Nuisance) Act covers doxxing a public servant together with a falsehood, where the offender acts to deter the officer from their duty or in retaliation for it.
Civil liability under POHA
POHA is not only a criminal statute. A victim can apply to the Protection from Harassment Court for orders and, in suitable cases, claim damages from the harasser. These civil remedies do not depend on the police deciding to prosecute, which makes them important where the offender is known but enforcement action is slow. Where false allegations accompany the doxxing, our pages on defamation in Singapore and how to sue for defamation explain the reputational claims that may also be available.
Intimate images and AI-generated material
The Penal Code has, since 2019, contained a group of offences dealing with voyeurism, distributing or threatening to distribute intimate images, and possessing or gaining access to such images. MHA's materials place these in sections 377BA to 377BO of the Penal Code. Before August 2026, the definition of an intimate image covered images created by altering existing images or recordings.
The amended definition now also captures entirely synthetic material. In practical terms, a victim whose likeness has been used in a fabricated intimate image can report it on the same footing as a real image. The victim does not need to prove that any original photograph existed or was altered.
The new production offence matters because many victims first learn of the material when it is shown to them as a threat, or when a friend reports seeing it in a group. Liability attaches to the person who produced it without consent, as well as to anyone who distributes it or threatens to.
Do not forward, download into shared folders or repost intimate material to prove what happened, even to friends or colleagues trying to help. Preserve the evidence privately, with URLs, account names and timestamps, and give it only to the police, the Online Safety Commission, your lawyer or the platform's reporting tool.
Your remedies compared
Victims often ask which route under doxxing law in Singapore to choose. In serious cases the answer is usually more than one, used in a deliberate order.
| Route | Best for | What it can achieve | Points to note |
|---|---|---|---|
| Police report | Threats, intimate images, child abuse material, persistent doxxing | Investigation, arrest and prosecution; seizure of devices | Does not by itself remove content quickly; you may still need a takedown route |
| Online Safety Commission | Fast removal of doxxing and intimate image content online | Directions to posters, administrators or platforms to disable access or restrict accounts | Free; for intimate image abuse and doxxing, victims can go directly to the Commission |
| Protection from Harassment Court | A known harasser who keeps targeting you | Protection order or expedited protection order; damages; orders against falsehoods | Orders take effect once served, and the applicant must enforce if they are breached |
| Civil claim | Recovering compensation or restraining further publication | Damages and injunctions under POHA, the new online safety torts or other causes of action | Cost and time; evidence must be preserved from the start |
| Platform reporting | Immediate removal where the platform acts quickly | Content removal and account action under the platform's rules | Keep a record of the report and response for later escalation |
What victims should do first under doxxing law in Singapore
The first day often decides how much of the harm can be contained. A calm, ordered response helps.
- Make yourself safe. If your address or movements have been exposed and you fear for your safety, call the police immediately. Tell family members or housemates who may also be affected.
- Preserve the evidence. Take full-page screenshots showing the content, the account name, the URL, the date and the time. Note group names and member counts. Do not engage with the poster.
- Report to the police. Make a police report for threats, intimate images, child abuse material or doxxing. Give the officer the evidence list and any information about who may be responsible.
- Seek fast takedown. Report the content to the Online Safety Commission and, where useful, to the platform. The Commission can direct platforms and posters to disable access to content.
- Consider a protection order. If the harasser is known, consider applying to the Protection from Harassment Court. The Courts' filing guide explains the process, and an expedited order is available where urgent intervention is needed.
- Look after your wellbeing. Victim-support and counselling organisations can help with reporting and emotional support. Community partners can also help you file a report with the Commission.
- Take legal advice on compensation. Once the immediate harm is contained, consider whether a civil claim, including for damages, is worthwhile and against whom.
The Courts' guidance on outcomes in protection from harassment cases notes that a protection order can require the harasser to stop the conduct and remove harassing publications. Damages claims can be brought through simplified proceedings for smaller claims. Applicants must serve the order, and they must start enforcement themselves if it is breached.
What employers, schools and community administrators should do
Organisations are often the first port of call. An employee is doxxed by a former partner; a student finds a fabricated image of herself in a class chat; a customer-service officer's home address is posted after a dispute. Doxxing law in Singapore does not impose a general duty on employers to investigate, but workplace safety, harassment policies and data protection obligations all point towards a structured response.
Employers should treat the matter as a safety and wellbeing issue first, offer practical support such as security measures and leave, and avoid circulating the material internally. Our guidance on workplace investigations covers how to investigate where a colleague is suspected.
Administrators of community groups, alumni chats and fan channels should be aware that the 17 August 2026 changes create new offences for setting up or managing online locations intended to facilitate large-scale circulation of obscene material. A clear moderation policy, prompt removal and a record of action taken are sensible protections.
If the doxxed information came from your organisation's own systems, such as a leaked customer or staff database, the incident may also be a personal data breach. Our page on data breach response explains notification duties and containment.
Illustrative scenario: a staff member targeted after a complaint
This scenario is illustrative only and does not describe any real matter. A frontline employee at a retail chain handles a heated complaint. That evening, an online post shares her name, a photograph from her social media and the estate where she lives, alongside an untrue claim that she insulted the customer. A day later, a fabricated intimate image bearing her face circulates in a group chat.
Her employer's HR team arranges for her to work from another site and pays for a taxi home. She preserves screenshots and makes a police report covering both the doxxing and the fabricated image. Because doxxing and intimate image abuse can go straight to the Online Safety Commission, she reports there the same day, seeking removal of both.
Once the poster is identified, she considers a protection order to stop further posts and a claim for damages. Her employer reviews whether any staff data was leaked from its systems and updates its policy on handling customer escalations. Each route addresses a different part of the harm; none of them depends on the others succeeding.
Risks and common mistakes
Confronting the poster or posting a public reply
It is natural to want to correct the record. But public replies can amplify the content, draw more attention to the personal details and sometimes provoke escalation. They can also complicate later proceedings if the exchange becomes heated. Let the reporting routes and, where appropriate, your lawyer handle contact with the poster.
Waiting too long to preserve evidence
Posters often delete material once they realise a complaint has been made, and platforms may remove content without notifying the victim. Without screenshots that show the URL, account and time, it can be difficult to prove what was published, by whom and to how many people. Capture evidence before reporting, and keep it secure.
Assuming a fake image is not covered
Before August 2026, some victims were told that a wholly fabricated image might fall outside the intimate image offences. The amended definition now covers synthetic material, and producing it without consent is a separate offence. Victims should report AI-generated material in the same way as real images.
Relying on one remedy only
A police investigation may take time, and a conviction does not by itself remove content from every platform. A takedown may stop the spread but does not compensate the victim. Combining routes, in a deliberate order, usually gives the best protection.
Cross-border angle and next steps
Applying doxxing law in Singapore is harder when the abuse involves platforms, posters or servers outside Singapore. The Online Safety Commission's directions can be addressed to platforms serving Singapore users, and failing to comply is an offence. Where the poster is abroad, criminal enforcement may depend on cooperation with foreign authorities.
TRW & Co's network spans Bangladesh, the UK, the UAE and China, which helps where a harasser, a platform contact or evidence sits in one of those jurisdictions. For criminal exposure arising from online conduct, our white-collar and criminal law team can advise; our online safety and content regulation team advises platforms, administrators and victims. Where Singapore court or tribunal representation is required, we work alongside Singapore-qualified counsel.
If you or your organisation needs advice on doxxing law in Singapore, please contact us in confidence. In an emergency, always contact the police first.
Frequently asked questions
01Is doxxing illegal in Singapore?
Yes. The Protection from Harassment Act 2014 makes it an offence to publish a person's identity information, such as an address, phone number, workplace or photograph, with intent to cause harassment, alarm or distress, or with intent to cause or facilitate violence. Victims can also apply to the Protection from Harassment Court for a protection order and damages. Since 29 June 2026, doxxing can also be reported to the Online Safety Commission for fast removal of the content.
02Is it a crime to create a deepfake intimate image of someone in Singapore?
Yes. From 17 August 2026, the Penal Code definition of an intimate image covers synthetic material generated to depict a person, and producing an intimate image of a person without consent is a new offence. MHA has stated that it carries up to two years' imprisonment, a fine or both, with mandatory imprisonment where the person depicted is below 14. Distributing or threatening to distribute such images is a separate offence.
03How do I get doxxing or intimate images taken down quickly?
Preserve the evidence first, then report to the Online Safety Commission through its website. For doxxing and intimate image abuse, victims can report directly without first going to the platform. The Commission can direct the poster, a group administrator or the platform to disable access or restrict accounts. You can also use the platform's own reporting tools and make a police report at the same time.
04What is a protection order and how does it help?
A protection order is a court order from the Protection from Harassment Court requiring the harasser to stop specified conduct, such as harassing you or publishing material about you, and it can require removal of harassing publications. Where urgent intervention is needed, the court can grant an expedited protection order with the same effect on a temporary basis. Orders take effect once served, and breaches can be enforced.
05Can I claim compensation from the person who doxxed me?
Possibly. The Protection from Harassment Court can order a harasser to pay damages, and smaller claims can be brought through simplified proceedings. The Online Safety (Relief and Accountability) Act 2025 also created statutory torts for specified online harms, including doxxing and intimate image abuse. Whether a claim is worthwhile depends on the evidence, the harm suffered and whether the defendant can be identified and pay.
06What should an employer do if an employee is doxxed?
Treat it first as a safety and wellbeing matter: offer practical support, adjust working arrangements if needed and avoid circulating the material internally. Encourage and support the employee to preserve evidence, report to the police and use the Online Safety Commission. If the information came from the organisation's systems, assess whether there has been a personal data breach. If a colleague is suspected, run a fair workplace investigation.
Sources and official materials
- MHA: Commencement of the Criminal Law (Miscellaneous Amendments) Act 2025 (phase 2) — Changes in force from 17 August 2026 and penalties
- MHA: First Reading of the Criminal Law (Miscellaneous Amendments) Bill — Policy rationale for the intimate image and doxxing changes
- Protection from Harassment Act 2014 — Doxxing offences, protection orders and civil remedies
- Singapore Courts: Outcomes in protection from harassment cases — Protection orders, expedited orders, damages and enforcement
- Singapore Courts: How to file and serve protection from harassment applications — Filing process in the Protection from Harassment Court
- Ministry of Law: The Online Safety Commission begins operations on 29 June 2026 — Commission reporting routes and first-phase harms
- Online Safety Commission — Official reporting portal
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
