Who was sanctioned, and for what?

The management corporation of the Riverfront Residences condominium had not designated a data protection officer until March 2025, had no data protection policies of its own and had given its managing agent, which acted for it as a data intermediary, no instructions on handling personal data; in April 2025 an employee of the managing agent mistakenly sent the names, addresses and maintenance fee details of two owners to another owner. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found breaches of the Accountability Obligation and the Protection Obligation; by contrast, it found no breach in the circulation of a requisition for an extraordinary general meeting bearing the names and signatures of 303 owners, because strata management law prevailed. It directed the corporation to introduce, within 90 days, policies and procedures for the processing of data by the managing agent and to communicate them to it; the managing agent itself had given a voluntary undertaking.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Sections 11(3) und 12(a) PDPA 2012 (Accountability Obligation); Section 24 i. V. m. Section 4(3) PDPA (Protection Obligation bei Einsatz eines Data Intermediary)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Published

7 May 2026

Checked against the official source on 4 Oct 2026 · Direct link

The provider of cloud-based HR software received an extortion email in April 2024; an attacker had deleted databases on its AWS servers and likely exfiltrated data, and data allegedly taken was offered for sale on the dark web – data on 95,000 employees of its clients (including identity number, salary, bank account and religion) and on 24,765 emergency contacts and children was put at risk. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because, despite the HR data entrusted to it by clients, the provider had no web application firewall against existing SQL injection vulnerabilities, remote desktop access open to the internet without two-factor authentication, and vulnerability scans only every two years. It imposed 17,500 SGD, payable in twelve monthly instalments in view of the company's cash flow, and directed among other things a web application firewall, annual penetration tests, two-factor authentication and encryption of all personal data fields.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach; payment in instalments in view of cash flow, while a waiver was refused.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In August 2024 an attacker encrypted a network drive shared by SESAMi and its subsidiary Abecha holding payment data (including full credit card numbers and bank account details) of around 20,471 customers of the subsidiary's fuel fleet discount programme and of up to 18,837 individuals from registrations for SESAMi's B2B platform; exfiltration could not be established. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) classified SESAMi, which ran the network for the subsidiary without a written contract, as a data intermediary in that respect and found a negligent breach of the Protection Obligation by SESAMi (including outdated firewall and VPN firmware, no patch management and unenforced password and MFA rules), and likewise by Abecha, which as controller had taken no steps to ensure adequate security at SESAMi. SESAMi received 8,750 SGD and directions, while Abecha, as the controller, received directions only, including setting out roles and data protection duties within the group in writing.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 4(3) PDPA (Pflichten bei Einsatz eines Data Intermediary); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Cooperation, prompt and effective remediation, admission under the Expedited Decision Procedure; for Abecha also lower culpability owing to its limited autonomy as a wholly owned subsidiary, one of the reasons for not imposing a fine on it.

Published

26 Feb 2026

Original amount 8,750 SGD, converted at the ECB reference rate of 29 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

After a cyberattack on the travel agency became public in December 2023, data on 336,759 individuals in its booking system was affected, in some cases including full images of identity cards, passports and birth certificates; part of the data was exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found negligent breaches of the Accountability Obligation – a data protection officer appointed only in April 2024, and apart from the customer-facing privacy policy no internal policies, no complaints process and no information to staff – and of the Protection Obligation, because there were no contracts with the IT vendors covering security tasks, no security reviews and no multi-factor authentication, and the server was still running the unsupported Windows Server 2012. It imposed 47,000 SGD, rejected objections based on COVID-19 losses and comparable cases, and directed among other things policies, security clauses in vendor contracts and a penetration test by a provider licensed by the Cyber Security Agency (CSA).

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); Section 24 PDPA (Protection Obligation); Section 48J(1)(a) PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Mitigating circumstances

Voluntary early admission of the breaches (treated as significantly mitigating) and prompt, effective remediation.

Published

8 Jan 2026

Original amount 47,000 SGD, converted at the ECB reference rate of 31 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

When API configurations were manually transferred to a new middleware platform (September 2022 to March 2023), a single employee in sole charge omitted an app identifier, so token verification did not apply to the web page of the ArtScience Friends museum programme for at least six months; an attacker exploited this in October 2023 and retrieved data on 665,495 members of the Sands Rewards Lifestyle loyalty programme, which was then offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) held that the resort had negligently breached the Protection Obligation by relying on this one employee without independent checks or automation. It reduced the provisionally intended 450,000 SGD to 315,000 SGD after the company's representations; no directions were issued because remediation had already been carried out.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 Personal Data Protection Act 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Repeat case

no

Mitigating circumstances

Otherwise adequate security arrangements, containment on the day of discovery, admission under the Expedited Decision Procedure, cooperation and voluntary notification of all affected individuals.

Published

28 Oct 2025

Original amount 315,000 SGD, converted at the ECB reference rate of 28 Oct 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The SaaS provider operates a system for licensed moneylenders that is linked to the Moneylenders Credit Bureau and into which its clients enter data on loan applicants and borrowers; in June 2024 an attacker used a vulnerable web application to take over the SQL server's system administrator account, which was protected only by an easily guessed password, deleted databases and exfiltrated data on 190,589 individuals including credit report data, which was offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation (inadequate access control, no vulnerability assessments or penetration tests) and, given the company's role as a provider processing client data entrusted to it, considered a fine of 17,500 SGD appropriate; it rejected the request for a waiver or reduction. In addition, the company must obtain the Cyber Trust mark certification of the Cyber Security Agency of Singapore (CSA) for its new network within nine months.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

3 Jul 2025

Original amount 17,500 SGD, converted at the ECB reference rate of 3 Jul 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The jeweller applied a patch released in February 2022 for a known vulnerability (CVE-2022-24086) in the Magento platform of its online shop only in January 2023; through the gap an attacker extracted the customer database with data on 41,379 individuals and posted it on an online forum in May 2023. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a negligent breach of the Protection Obligation because the company relied entirely on its maintenance vendor for patching without directing or monitoring it, and rejected the argument that the vendor had been a data intermediary. Alongside 58,000 SGD (provisionally 64,000 SGD; the finding on credentials stored in plain text was dropped after representations) it directed an external security audit of access controls and the remediation of any gaps.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Mitigating circumstances

Prompt remediation once the incident was known, admission under the Expedited Decision Procedure and cooperation.

Published

8 Jan 2026

Original amount 58,000 SGD, converted at the ECB reference rate of 20 Jun 2025.

Checked against the official source on 4 Oct 2026 · Direct link

A person involved in a traffic accident next to the condominium requested access to the CCTV footage in April 2024; the security company could not save it for lack of administrator access, the system overwrote it after 17 days, and the management corporation then refused the request, citing other individuals' data and strata management law. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) held that a blanket refusal was not justified (other individuals could have been masked) but, as the footage no longer existed, made no finding on the access obligation, and found a negligent breach of the Accountability Obligation: no data protection officer, no data protection policy of its own (only the managing agent's) and no instructions to the managing agent and security company on handling access requests. It directed the corporation to introduce, within 60 days, policies and a procedure for access requests concerning CCTV footage and to pass them on to the managing agent and contractors.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); geprüft auch Sections 21 und 22A PDPA (Auskunft, Aufbewahrung bei Ablehnung)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

The management corporation appointed a data protection officer after the incident.

Published

7 Aug 2025

Checked against the official source on 4 Oct 2026 · Direct link

The provider of point-of-sale and CRM software for small and medium-sized enterprises reported two attacks in 2024 in which perpetrators used SQL injection, among other methods, to extract files with data on a total of 698,112 individuals, including health information (skin conditions and treatments) of 9,122 individuals; the data was likely posted on a hacking forum. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) stressed that the SaaS provider holds large volumes of data on behalf of its clients and found a breach of the Protection Obligation: publicly accessible servers, no network firewall, no security testing before releases, unsupported operating system and PHP versions, and credentials left unprotected in source code and configuration files. Alongside 17,500 SGD it directed a package of measures ranging from network segmentation and patch management to vulnerability assessments and penetration tests at least once a year.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 7 Apr 2025.

Checked against the official source on 4 Oct 2026 · Direct link

During a cloud migration in 2020 and a restructuring in 2022, the company failed to have data on employees, former employees, directors and shareholders deleted from a shared server belonging to the subsidiary; in September 2022 an attacker gained access to that server through the compromised account of one of the former subsidiary's vendors. Numerous individuals were put at risk, and data on some of them – in some cases images of identity documents, signatures, bank accounts and salaries – may have been exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) treated the failure to delete for more than two years, without clear instructions to or supervision of staff, as a negligent breach of the Protection Obligation and, in view of the duration, the type of data and deterrence, imposed 120,000 SGD; it accepted a voluntary undertaking from the former subsidiary.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

negligent

Mitigating circumstances

Prompt action once alerted to the incident, admission under the Expedited Decision Procedure and cooperation.

Published

2 Aug 2024

Original amount 120,000 SGD, converted at the ECB reference rate of 14 May 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 May 2026 · Direct link

Using a compromised user account, an attacker gained remote desktop access to servers of the payroll service provider between December 2022 and January 2023 and exfiltrated data; data on employees of one client, including name, identity number, bank account and salary, appeared on a leak site. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the sensitive data was stored on unsecured internal drives, staff had local administrator rights and there was no multi-factor authentication. Given the company's role as a payroll provider and the type of data, it considered a fine appropriate and set it at 4,000 SGD.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Employee data

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

22 Apr 2024

Original amount 4,000 SGD, converted at the ECB reference rate of 22 Apr 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 22 Apr 2026 · Direct link

At the online marketplace, a software bug in 2022 appended users' email addresses and names to chat messages sent to listing owners, and a faulty application programming interface allowed an attacker to scrape non-public user data; an individual then offered data of numerous marketplace users for sale on an online forum. On 28 December 2023 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a negligent breach of the Protection Obligation because pre-launch testing was too narrowly scoped and functional and technical specifications were inadequately documented. It imposed 58,000 SGD and directed the marketplace to review its testing procedures and documentation and close any gaps.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data Protection Act 2012, s 24 (Protection Obligation); Geldbuße nach s 48J PDPA ([2023] SGPDPC 13)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Culpability

negligent

Repeat case

no

Mitigating circumstances

Cooperation, prompt and effective remediation, no previous breaches and an early admission under the expedited procedure; the attacker was particularly sophisticated in evading the existing security measures.

Published

22 Feb 2024

Original amount 58,000 SGD, converted at the ECB reference rate of 28 Dec 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 28 Dec 2025 · Direct link

At the operator of an online language learning platform for children, an attacker used a brute force attack in April 2022 to guess the password of an administrator account, weak and unchanged for more than two years, and accessed data on numerous users worldwide, including students and teachers' salary and bank details. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found negligent breaches of the Protection Obligation owing to the lack of password rules and of the Accountability Obligation because no data protection officer had been designated since incorporation in 2016. It imposed 74,000 SGD and rejected the requested reduction to no more than 35,000 SGD; no directions were issued because remediation had been carried out.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 11(3) PDPA (Accountability Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Mitigating circumstances

No evidence of exfiltration or misuse, prompt remediation including notification of users, voluntary admission and cooperation.

Published

21 Mar 2024

Original amount 74,000 SGD, converted at the ECB reference rate of 24 Oct 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 24 Oct 2025 · Direct link

In June 2022 the leasing and hire-purchase provider discovered that ransomware had encrypted seven servers and six employee computers holding data of numerous individuals (customers, guarantors and employees), including identity, income and bank details. On 4 September 2023 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because a patch for the exploited vulnerability in its VPN device had been available for two years and nine months without being installed and administrator accounts had no multi-factor authentication, and imposed 82,000 SGD.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data Protection Act 2012, s 24 (Protection Obligation); s 48J PDPA ([2023] SGPDPC 9)

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Cooperation, prompt remediation and voluntary acceptance of responsibility under the expedited procedure.

Published

10 Nov 2023

Original amount 82,000 SGD, converted at the ECB reference rate of 4 Sep 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 4 Sep 2025 · Direct link

The healthcare provider had outsourced call centre and appointment booking services to a social enterprise, which copied customer data for its call centre agents onto an internet-facing file server whose password protection had been disabled for around 20 months; in 2021 data on numerous customers (including diagnosis codes and bank details) was accessed without authorisation and offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found shortcomings in security reviews and password management at the data intermediary, the social enterprise, and at the healthcare provider inadequate ongoing oversight of the service provider and unnecessary disclosure of sensitive financial and health data. It imposed 68,000 SGD on the two together and directed both to review contracts, data sharing and the scope of security reviews.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation) i. V. m. Sections 4(2) und 4(3) PDPA (Data Intermediary); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Both cooperated, admitted the breaches under the Expedited Decision Procedure and remedied promptly; in setting the amounts, the healthcare provider's turnover of around 50 times that of the social enterprise was taken into account.

Published

22 Jun 2023

Original amount 68,000 SGD, converted at the ECB reference rate of 23 Mar 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 23 Mar 2025 · Direct link

In 2020 an attacker took over the code-hosting account of an employee of the online grocery platform found a high-privilege access key in the source code and another in the cloud, and thereby reached a database holding data of numerous customers and sellers, which was then offered for sale on an online forum. On 28 October 2022 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the keys were manifestly inadequately secured and the database had no separate authentication, and imposed 72,000 SGD; it rejected objections to the amount.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data Protection Act 2012, s 24 (Protection Obligation); s 48J PDPA ([2022] SGPDPC 8)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Repeat case

no

Mitigating circumstances

Cooperation, partial redaction of stored credit card numbers, prompt effective remediation and the late but voluntary acceptance of the findings.

Published

19 Dec 2022

Original amount 72,000 SGD, converted at the ECB reference rate of 28 Oct 2022.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 28 Oct 2024 · Direct link

After two contractors of the platform operator's foreign parent company extracted customer data from its systems in 2020 – data on numerous individuals was affected, including customers of the online retailer – the Personal Data Protection Commission (PDPC, Singapore's data protection authority) examined the transfers from Singapore abroad. The online retailer, as controller, had not obtained contractual commitments securing a standard of protection comparable to the PDPA for data transferred via its data intermediary, and the Singapore platform entity lacked binding contracts or binding corporate rules for passing its own platform data to the foreign parent company within the group. The PDPC directed both to put in place processes to comply with the Transfer Limitation Obligation – the platform entity within 60 days, the online retailer as an SME within six months – and pointed to the ASEAN Model Contractual Clauses.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · International data transfers

Legal basis

Section 26(1) PDPA 2012 (Transfer Limitation Obligation) i. V. m. Regulations 9(1)(b) und 10(1) Personal Data Protection Regulations 2014; Section 4(3) PDPA; Section 48I PDPA (Directions)

Action

Order

Status of proceedings

unknown

Sector

Retail and e-commerce

Mitigating circumstances

According to the PDPC, both companies were highly cooperative.

Published

18 Nov 2022

Checked against the official source on 7 Oct 2026 · Company name anonymised since 6 Oct 2024 · Direct link