Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

Singapore Media and online platforms Clear all filters

1case from 1 jurisdiction

€39,609Total of monetary amounts

€39,609Largest single case: a Singapore online marketplace

€39,609Median per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by authority

Personal Data Protection Commission (PDPC) €39,609 100 % · 1 case

What for?

by area of law

All areas of law

Data protection €39,609 100 % · 1 case

Who?

by company

Anonymised companies €39,609 100 % · 1 case

When?

per year, by date of decision

Trend
Period	Cases	Total
2023	1	€39,609
2024	0	–
2025	0	–
2026	0	–

1 case

Newest first Highest amounts

28 Dec 2023 a Singapore online marketplaceOnline marketplace: 58,000 SGD and directions after two data breaches SingaporeData breaches and data securityanonymised €39,609

At the online marketplace, a software bug in 2022 appended users' email addresses and names to chat messages sent to listing owners, and a faulty application programming interface allowed an attacker to scrape non-public user data; an individual then offered data of numerous marketplace users for sale on an online forum. On 28 December 2023 the Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a negligent breach of the Protection Obligation because pre-launch testing was too narrowly scoped and functional and technical specifications were inadequately documented. It imposed 58,000 SGD and directed the marketplace to review its testing procedures and documentation and close any gaps.

What organisations can take from it

Changes to platform features and interfaces need adequately scoped testing and proper documentation; otherwise data leaks arise from the organisation's own errors.

Relevance to training and awareness

Secure software changes through adequate testing and documentation

Authority / court: Personal Data Protection Commission (PDPC)
Area of law: Data protection · Data breaches and data security
Legal basis: Personal Data Protection Act 2012, s 24 (Protection Obligation); Geldbuße nach s 48J PDPA ([2023] SGPDPC 13)
Action: Fine
Status of proceedings: unknown
Sector: Media and online platforms
Culpability: negligent
Repeat case: no
Mitigating circumstances: Cooperation, prompt and effective remediation, no previous breaches and an early admission under the expedited procedure; the attacker was particularly sophisticated in evading the existing security measures.
Published: 22 Feb 2024

Original amount 58,000 SGD, converted at the ECB reference rate of 28 Dec 2023.

Sources

PDPC, Enforcement Decisions (Übersicht) (Entscheidung 2023) Enforcement database of an authority

Checked against the official source on 7 Oct 2026 · Company name anonymised since 28 Dec 2025 · Direct link

Report an error

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source (company names until they are anonymised).

Company names are anonymised two years after the decision in a case, in line with the practice of many supervisory authorities. The official sources remain linked.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Ready for training that actually lands?