Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,030 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Personal Data Protection Commission (PDPC) – 0 % · 2 cases
What for?
by topicWho?
by companyWhen?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q4 2023 | 0 | – |
| Q1 2024 | 0 | – |
| Q2 2024 | 0 | – |
| Q3 2024 | 0 | – |
| Q4 2024 | 0 | – |
| Q1 2025 | 0 | – |
| Q2 2025 | 1 | – |
| Q3 2025 | 0 | – |
| Q4 2025 | 0 | – |
| Q1 2026 | 0 | – |
| Q2 2026 | 1 | – |
| Q3 2026 | 0 | – |
| Q4 2026 | 0 | – |
2 cases
1 Apr 2026 The Management Corporation – Strata Title Plan No. 4869 (Riverfront Residences)MCST 4869: directions over lack of data protection instructions to managing agent Order
The management corporation of the Riverfront Residences condominium had not designated a data protection officer until March 2025, had no data protection policies of its own and had given its managing agent, which acted for it as a data intermediary, no instructions on handling personal data; in April 2025 an employee of the managing agent mistakenly sent the names, addresses and maintenance fee details of two owners to another owner. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found breaches of the Accountability Obligation and the Protection Obligation; by contrast, it found no breach in the circulation of a requisition for an extraordinary general meeting bearing the names and signatures of 303 owners, because strata management law prevailed. It directed the corporation to introduce, within 90 days, policies and procedures for the processing of data by the managing agent and to communicate them to it; the managing agent itself had given a voluntary undertaking.
Anyone who outsources management to a service provider remains responsible and needs their own data protection officer, their own policies and specific instructions to the provider.
Check recipients before sending, protect sensitive attachments and give service providers clear instructions
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data processors
- Legal basis
- Sections 11(3) und 12(a) PDPA 2012 (Accountability Obligation); Section 24 i. V. m. Section 4(3) PDPA (Protection Obligation bei Einsatz eines Data Intermediary)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- Published
- 7 May 2026
- PDPC – Enforcement Decisions: Breach of the Accountability and Protection Obligations by MCST 4869 (veröffentlicht 07.05.2026) Enforcement database of an authority
- PDPC – Decision [2026] SGPDPC 1, The Management Corporation – Strata Title Plan No. 4869, Case No. DP-2503-C3469 (01.04.2026), PDF Decision of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
19 May 2025 The Management Corporation – Strata Title Plan No. 4599 (The Scotts Tower)MCST 4599: directions after refused access request for CCTV footage Order
A person involved in a traffic accident next to the condominium requested access to the CCTV footage in April 2024; the security company could not save it for lack of administrator access, the system overwrote it after 17 days, and the management corporation then refused the request, citing other individuals' data and strata management law. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) held that a blanket refusal was not justified (other individuals could have been masked) but, as the footage no longer existed, made no finding on the access obligation, and found a negligent breach of the Accountability Obligation: no data protection officer, no data protection policy of its own (only the managing agent's) and no instructions to the managing agent and security company on handling access requests. It directed the corporation to introduce, within 60 days, policies and a procedure for access requests concerning CCTV footage and to pass them on to the managing agent and contractors.
Access requests for CCTV footage need a set procedure that secures the footage before it is automatically overwritten and masks other individuals instead of refusing outright.
Recognise access requests, secure the relevant data immediately and respond in time
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); geprüft auch Sections 21 und 22A PDPA (Auskunft, Aufbewahrung bei Ablehnung)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- Culpability
- negligent
- Mitigating circumstances
- The management corporation appointed a data protection officer after the incident.
- Published
- 7 Aug 2025
- PDPC – Enforcement Decisions: Breach of the Accountability Obligation by MCST 4599 (veröffentlicht 07.08.2025) Enforcement database of an authority
- PDPC – Decision 2025 SGPDPC 3, The Management Corporation – Strata Title Plan No. 4599, Case No. DP-2405-C2318 (19.05.2025), PDF Decision of an authority
Checked against the official source on 4 Oct 2026 · Direct link