PDPA compliance Singapore: follow the law, keep hackers out
Data protection and cyber security for anyone who keeps customer, patient, resident or staff details.
Most PDPC cases start with something small. We find it first.
PDPA or cyber: you choose. No email needed.
Clients include
- AMC Asia
- De Dental
- Medicare Associates
The PDPA applies to every organisation that keeps personal data
- S$11,000the median PDPC financial penalty in published decisionsThe maximum is S$1 million, or 10% of Singapore turnover. One decision has reached it.PDPC decisions, read 12 October 2026.
- 3 daysto tell the PDPC once a breach is notifiablePDPC breach guide
- 82%of PDPC enforcement cases in 2023–2024 began with a cyber incidentPDPC, Apr 2025
- Published by nameevery PDPC decision names the organisationPDPC decisions, read 12 October 2026.
No published cases yet in this sector; here is the closest: the 3 most recent cases overall.
2026-09-21 · Voluntary undertaking
Stolen service-account credentials gave attackers file-server access over VPN to staff data.
Lesson: Protect service accounts as strongly as staff logins.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)2026-09-21 · Voluntary undertaking
Attackers used a critical firewall flaw to create administrator accounts and reach files on students and staff.
Lesson: Apply firewall firmware fixes promptly.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)2026-09-21 · Voluntary undertaking
A staff member’s AI-written email script showed every recipient’s address to all the others.
Lesson: Test any code that touches personal data before it goes live.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)
Source: PDPC Case Library, read 12 October 2026.What PDPC decisions show See everything for
Get new PDPC decisions in your sector by email. Monthly. One click to stop.
The Gold Standard, defined
- Certified lead in every disciplineEach discipline is led by a holder of its own professional credential.
- Assessor-ready evidenceEvery deliverable maps to the clause the assessor tests.See a sample
- Built on each standard, and on how it is enforcedClause by clause from each standard, and from real enforcement.See the analysis
- We stay after the certificateA named DPO, monthly support and an annual review.
In our clients’ words
“Their review of the resident forms alone demonstrated the value of the engagement, as several forms were collecting personal data without being fully aligned with PDPA requirements.”
“We greatly appreciate how they minimised our anxiety by explaining the DPTM process, the timeline, and the many other dependencies to get the job done better and faster.”
“Within three months, we had the requested policy and other templates in place.”
Common questions
Does the PDPA apply to my organisation?
Almost certainly. The PDPA applies to any organisation that collects, uses or discloses personal data in Singapore, whatever its size or sector: a clinic, a condominium’s management corporation, a tuition centre, a salon or an online shop. Public agencies are the main exception.
Is a DPO mandatory in Singapore?
Yes. The PDPA requires every organisation to appoint at least one DPO and to make the DPO’s business contact available. Having no DPO was part of a S$47,000 Personal Data Protection Commission (PDPC) penalty on a travel agency, published in January 2026.
Do small businesses need cyber security?
Yes. Most attacks are automated and look for any weak password or unpatched system, whatever the size of the business. The Personal Data Protection Act (PDPA) also requires reasonable security, and the Personal Data Protection Commission (PDPC) enforces that rule.
Do you certify us?
No. We prepare you. An independent assessment body audits you and decides on certification, so the certificate means something.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)