Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Personal Data Protection Commission (PDPC) €90,424 100 % · 3 cases
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies €51,227 57 % · 2 cases
- Goldheart Jewelry Pte. Ltd. €39,197 43 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 2 | €51,227 |
| 2023 | 0 | – |
| 2024 | 0 | – |
| 2025 | 1 | €39,197 |
| 2026 | 0 | – |
3 cases
20 Jun 2025 Goldheart Jewelry Pte. Ltd.Goldheart Jewelry: 58,000 SGD over security patch applied eleven months late €39,197
The jeweller applied a patch released in February 2022 for a known vulnerability (CVE-2022-24086) in the Magento platform of its online shop only in January 2023; through the gap an attacker extracted the customer database with data on 41,379 individuals and posted it on an online forum in May 2023. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a negligent breach of the Protection Obligation because the company relied entirely on its maintenance vendor for patching without directing or monitoring it, and rejected the argument that the vendor had been a data intermediary. Alongside 58,000 SGD (provisionally 64,000 SGD; the finding on credentials stored in plain text was dropped after representations) it directed an external security audit of access controls and the remediation of any gaps.
A company that outsources the maintenance of its web shop remains responsible for patching and must assign responsibilities and monitor implementation.
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Culpability
- negligent
- Mitigating circumstances
- Prompt remediation once the incident was known, admission under the Expedited Decision Procedure and cooperation.
- Published
- 8 Jan 2026
Original amount 58,000 SGD, converted at the ECB reference rate of 20 Jun 2025.
- PDPC – Enforcement Decisions: Breach of the Protection Obligation by Goldheart Jewelry Pte Ltd (veröffentlicht 08.01.2026) Enforcement database of an authority
- PDPC – Decision [2025] SGPDPC 4, Goldheart Jewelry Pte. Ltd., Case No. DP-2305-C1061 (20.06.2025), PDF Decision of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
28 Oct 2022 a Singapore online grocery retailerOnline grocer: 72,000 SGD because access keys in source code exposed customer data €51,227
In 2020 an attacker took over the code-hosting account of an employee of the online grocery platform found a high-privilege access key in the source code and another in the cloud, and thereby reached a database holding data of numerous customers and sellers, which was then offered for sale on an online forum. On 28 October 2022 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the keys were manifestly inadequately secured and the database had no separate authentication, and imposed 72,000 SGD; it rejected objections to the amount.
Access keys belong in a secured key vault rather than in source code, and sensitive databases need their own access barrier.
Secure management of access keys instead of storing them in source code
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Data Protection Act 2012, s 24 (Protection Obligation); s 48J PDPA ([2022] SGPDPC 8)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Repeat case
- no
- Mitigating circumstances
- Cooperation, partial redaction of stored credit card numbers, prompt effective remediation and the late but voluntary acceptance of the findings.
- Published
- 19 Dec 2022
Original amount 72,000 SGD, converted at the ECB reference rate of 28 Oct 2022.
- PDPC, Enforcement Decisions (Übersicht) (Entscheidung 2022) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Company name anonymised since 28 Oct 2024 · Direct link
Report an error
6 Oct 2022 the Singapore entity of an e-commerce platform group and a Singaporean online retailerE-commerce platform and online retailer in Singapore: directions over unsecured data transfers Order
After two contractors of the platform operator's foreign parent company extracted customer data from its systems in 2020 – data on numerous individuals was affected, including customers of the online retailer – the Personal Data Protection Commission (PDPC, Singapore's data protection authority) examined the transfers from Singapore abroad. The online retailer, as controller, had not obtained contractual commitments securing a standard of protection comparable to the PDPA for data transferred via its data intermediary, and the Singapore platform entity lacked binding contracts or binding corporate rules for passing its own platform data to the foreign parent company within the group. The PDPC directed both to put in place processes to comply with the Transfer Limitation Obligation – the platform entity within 60 days, the online retailer as an SME within six months – and pointed to the ASEAN Model Contractual Clauses.
Anyone transferring data abroad through a service provider or within a group must secure a comparable standard of protection themselves, by contract or binding corporate rules.
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · International data transfers
- Legal basis
- Section 26(1) PDPA 2012 (Transfer Limitation Obligation) i. V. m. Regulations 9(1)(b) und 10(1) Personal Data Protection Regulations 2014; Section 4(3) PDPA; Section 48I PDPA (Directions)
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Mitigating circumstances
- According to the PDPC, both companies were highly cooperative.
- Published
- 18 Nov 2022
- PDPC, Enforcement Decisions (Übersicht) (Entscheidung 2022) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Company name anonymised since 6 Oct 2024 · Direct link