TraceTogether is designed for contact tracing. It is privacy-preserving by design. Both the App and Token do not capture GPS / geolocation data, and the data is stored in an encrypted format that makes it incomprehensible to unauthorised users. In addition, the Token does not have Internet or cellular connectivity. This means that no one can access your data remotely.
All public sector data protection rules will apply to TraceTogether data, including abiding by the recommendations of the Public Sector Data Security Review Committee. Under the Public Sector (Governance) Act, public officers who recklessly or knowingly disclose such data without authorisation or misuse the data may be liable to a penalty of $5,000 or imprisonment up to 2 years, or both.