Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Personal Data Protection Commission (PDPC) €47,111 100 % · 1 case
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies €47,111 100 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | €47,111 |
| 2024 | 0 | – |
| 2025 | 0 | – |
| 2026 | 0 | – |
1 case
23 Mar 2023 a Singaporean healthcare provider and a call centre social enterpriseHealthcare provider and call centre: 68,000 SGD after data leak at service provider €47,111
The healthcare provider had outsourced call centre and appointment booking services to a social enterprise, which copied customer data for its call centre agents onto an internet-facing file server whose password protection had been disabled for around 20 months; in 2021 data on numerous customers (including diagnosis codes and bank details) was accessed without authorisation and offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found shortcomings in security reviews and password management at the data intermediary, the social enterprise, and at the healthcare provider inadequate ongoing oversight of the service provider and unnecessary disclosure of sensitive financial and health data. It imposed 68,000 SGD on the two together and directed both to review contracts, data sharing and the scope of security reviews.
Controllers must not only secure matters contractually but continuously check how their provider stores data and grants access, and give it only the data it really needs.
No shared passwords; share only necessary data with service providers
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data processors
- Legal basis
- Section 24 PDPA 2012 (Protection Obligation) i. V. m. Sections 4(2) und 4(3) PDPA (Data Intermediary); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Healthcare
- Mitigating circumstances
- Both cooperated, admitted the breaches under the Expedited Decision Procedure and remedied promptly; in setting the amounts, the healthcare provider's turnover of around 50 times that of the social enterprise was taken into account.
- Published
- 22 Jun 2023
Original amount 68,000 SGD, converted at the ECB reference rate of 23 Mar 2023.
- PDPC, Enforcement Decisions (Übersicht) (Entscheidung 2023) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Company name anonymised since 23 Mar 2025 · Direct link