In Singapore, both the rights of publicity and privacy are neither recognised under the common law nor statute. However, the Personal Data Protection Act 2012 (PDPA) offers protection against unauthorised use and disclosure of “personal data” in certain circumstances, which in turn confers incidental personality rights in the form of a right of private action for breaches of the PDPA. Generally, data protection legislation are not intended or designed to protect against unauthorised commercial exploitation of personal data: (i) on or in products, merchandise or goods; or (ii) for purposes of advertising or selling, or soliciting purchases of, products, merchandise, goods or services. An individual’s whose personal data – i.e. name, image or any “data” that identifies him or her – has been commercially appropriated in advertising or merchandising will often have to seek recourse under right of publicity or passing off laws. This paper discusses the ambit of the PDPA and concludes that even though the right of publicity is not recognised in Singapore, the tort of passing off – and possibly even an action in defamation in exceptional circumstances – can offer robust protection for the commercial exploitation of one’s identity in advertising and selling.