PDPA and cyber security for professional firms
We work across sectors. Here is what matters most in yours.
The 3 most recent PDPC decisions in your sector
2026-04-09 · Voluntary undertaking
Ransomware attackers stole employee data and posted a sample online.
Lesson: Plan for data theft, not just encrypted files.
Read the PDPC decision of 9 April 2026, on pdpc.gov.sg (opens in a new tab)2025-08-07 · Voluntary undertaking
One phished mailbox exposed clients’ identity and financial documents kept in email.
Lesson: Keep as little personal data in email as you can.
Read the PDPC decision of 7 August 2025, on pdpc.gov.sg (opens in a new tab)2024-11-29 · Voluntary undertaking
Ransomware hit servers running an operating system that no longer received security updates.
Lesson: Replace systems that no longer get security updates.
Read the PDPC decision of 29 November 2024, on pdpc.gov.sg (opens in a new tab)
Source: PDPC Case Library, read 12 October 2026.What PDPC decisions show
Where organisations like yours are most often exposed
The gap areas our free check asks about most for your sector.
- NRIC numbers or copies collected without needCollecting NRIC numbers without need adds risk you do not have to carry.How we help: Policies, notices and consent
- Website or app never security-testedWebsite and app flaws are one of the most common causes of PDPC decisions.How we help: Cyber health check
- Software and devices not patched on timeAttackers target known flaws that were never fixed.How we help: Network hardening
- Leadership not briefed on data and cyber riskLeaders are expected to understand data and cyber risk, not just delegate it.How we help: Board briefing
Certificates that most often fit your sector
From every answer path of our “Which certification fits?” questions for your sector. Side by side, as choices.
In our clients’ words
“PDPA Compliance was steady and reliable throughout. The work was structured, the support was responsive, and we always had the sense that the engagement was being handled smoothly.”
Common questions
How do we stop invoice and bank-detail fraud?
Turn on two-factor login for email, add a call-back rule for any change in bank details, and set up email sender checks. Train staff to pause on urgent payment requests.
What if a client asks for proof of data protection?
Show a clear policy, a named data protection officer, trained staff and, if needed, a certificate such as the Data Protection Trustmark (DPTM) or ISO/IEC 27001. We help you prepare all four.
Does the PDPA apply to client files?
Yes. The PDPA covers personal data in client files, payroll and case records, and the Personal Data Protection Commission (PDPC) enforces the Act. Some professions add their own confidentiality rules on top.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)