Singapore PDPA penalties and fines

For an intentional or negligent contravention of the PDPA Data Protection Provisions, PDPC guidance states that the Commission may require an organisation to pay a financial penalty of up to S$1 million or 10% of the organisation's annual turnover in Singapore, whichever is higher, where the organisation's annual turnover in Singapore exceeds S$10 million. The turnover-linked cap took effect on 1 October 2022.

For intentional or negligent contraventions of the DNC Provisions involving dictionary attacks or address-harvesting software, PDPC guidance states that an individual may face a financial penalty of up to S$200,000, while an organisation may face up to S$1 million or 5% of annual turnover in Singapore, whichever is higher, where annual turnover in Singapore exceeds S$20 million. For other DNC contraventions, the guidance states up to S$200,000 for an individual and up to S$1 million in other cases.

The Enforcement Guidelines explain that the Commission may give directions it thinks fit to secure compliance, and may direct an organisation to stop collecting, using, or disclosing personal data in contravention of the PDPA; destroy personal data collected in contravention of the PDPA; or comply with a direction issued after a review.

The same guidance describes directions as tools to remedy the contravention, prevent or reduce harm or further harm to affected individuals, and rectify organisational processes. A non-compliant direction can be registered in the District Court, where the registered direction or written notice has the same force and effect as a District Court order for enforcement purposes.

PDPC materials explain that, under certain circumstances, the PDPC may accept a written voluntary undertaking from an organisation. The request should be made soon after the incident is known, either on commencement of investigations or in the early stages of investigations. The undertaking takes effect when the organisation returns the executed undertaking to PDPC, and execution does not amount to an admission of breach.

The active enforcement guide says the undertaking is intended to allow implementation of a remediation plan within a specified time. It also states that the request must be accompanied by a remediation plan and that PDPC will not give additional time to produce the plan. Acceptance remains within PDPC's discretion.

Before imposing a financial penalty, PDPC gives the organisation or person a written notice. A preliminary decision accompanying the notice typically sets out the preliminary findings, supporting evidence, reasons, and proposed action. The recipient has 14 days to make written representations with the documents or information needed to support its response.

PDPC may extend that period if exceptional circumstances in the particular case warrant an extension. After considering timely representations, it issues the final decision. If it imposes a financial penalty, the notice specifies a payment period that the enforcement guidelines say will be no earlier than 28 days after issue.

An eligible aggrieved organisation or person may apply to PDPC for reconsideration within 28 days of issuance or appeal an eligible decision or direction within 28 days. A reconsideration application or appeal generally does not suspend the contested decision, except for a financial penalty, unless the Commission or appeal committee decides otherwise. The precise route, standing, fee, and filing requirements depend on the decision and should be checked against the Act and Enforcement Regulations.

The breach notification guide states that organisations must assess whether a breach is notifiable. A breach can be notifiable because it is likely to result in significant harm to affected individuals or because it is of significant scale. The Notification of Data Breaches Regulations prescribe 500 affected individuals as the significant-scale threshold.

Where notification to the Commission is not made within three calendar days after determining that a breach is notifiable, the breach guide says the organisation must specify reasons for late notification and include supporting evidence. It also says those reasons go to the gravity of the contravention of the Data Breach Notification Obligation and consequently the nature and severity of any penalties.

The enforcement guidance points teams toward harm, culpability, mitigation, past compliance, direction compliance, and accountable measures. That makes evidence of governance, tested breach handling, vendor management, access controls, security reviews, and prompt remediation directly relevant to penalty-risk discussions.

PDPC's Data Protection Management Programme guide frames accountability as adapting legal requirements into policies and practices, using monitoring mechanisms and controls, and building organisational responsibility through training and awareness. For penalty readiness, those controls should be mapped to the PDPA obligation, the system or process, the owner, and the evidence record.