PDPA and cyber security for clinics and healthcare providers
We work across sectors. Here is what matters most in yours.
The 3 most recent PDPC decisions in your sector
2025-07-03 · Voluntary undertaking
An outsourced developer left a server port open to a database with no password.
Lesson: Check what your vendors set up, and put a password on every database.
Read the PDPC decision of 3 July 2025, on pdpc.gov.sg (opens in a new tab)2023-06-22 · Financial penalty and directions, S$68,000
Clients’ and patients’ data was publicly reachable; handling and access controls were weak.
Lesson: Review who can reach patient data, and audit your vendor’s security too.
Read the PDPC decision of 22 June 2023, on pdpc.gov.sg (opens in a new tab)2023-05-11 · Voluntary undertaking
A misconfigured cloud storage bucket made patient data, including lab results, public.
Lesson: Check every cloud storage bucket for public access.
Read the PDPC decision of 11 May 2023, on pdpc.gov.sg (opens in a new tab)
Source: PDPC Case Library, read 12 October 2026.What PDPC decisions show
Where organisations like yours are most often exposed
The gap areas our free check asks about most for your sector.
- HIA CS/DS Essentials not yet in placeThe Health Information Act requires healthcare providers to put MOH's cyber and data security measures in place, in phases. The work takes time to do well.How we help: HIA CS/DS Essentials
- Not ready to notify MOH within 2 hoursA reportable incident must reach MOH within hours. You need to be ready before it happens.How we help: HIA CS/DS Essentials
- Vendors handle your data without checksYour vendors' mistakes become your problem: you stay responsible for the data they handle.How we help: PDPA implementation, turnkey
- CCTV notices and footage requests not handled to PDPACCTV footage is personal data. Missing notices and loose access are common findings.How we help: Policies, notices and consent
Certificates that most often fit your sector
From every answer path of our “Which certification fits?” questions for your sector. Side by side, as choices.
In our clients’ words
“Our consultant demonstrated excellent mastery of the Data Protection Trustmark certification process, making the journey a rewarding experience.”
Common questions
What are the PDPA rules for healthcare organisations?
The same obligations as any organisation, applied to sensitive data: consent and notices, access requests, security, retention, vendor control and breach notification to the Personal Data Protection Commission (PDPC). The Health Information Act adds health-specific cyber and data security rules.
Can clinics use WhatsApp with patients?
Yes, with care. Tell patients what you use WhatsApp for, keep clinical details to what is needed, use a business account the clinic controls, and remove data from staff phones when they leave.
Do clinics need a data protection officer?
Yes. Every clinic must appoint a data protection officer (DPO) and publish the contact. Some practices name us as their DPO, so the doctors can focus on patients.
Should our clinic get DPTM certified?
Certification is your choice. The Data Protection Trustmark (DPTM) gives patients, insurers and corporate clients independent proof that you handle personal data well. One of our medical centre clients has been certified since 2023.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)