PDPA fines and PDPC decisions: what they tell an SME
We read every enforcement decision the Personal Data Protection Commission (PDPC) has published, from April 2016 to September 2026, and classified each one by outcome, penalty, cause and sector. Here is what the record shows, and what it means for a small business.
How PDPC cases end
A financial penalty is the most common single outcome, but most decisions end another way: a warning, directions, a voluntary undertaking, or a finding of no breach.
Source: PDPC enforcement decisions, read 12 October 2026.
What the penalties look like
Half of all published penalties were S$11,000 or less. Only 4 reached S$100,000, and one, a 2019 healthcare case, reached the S$1 million maximum.
- S$11,000median penalty
- S$30,00075th percentile
- S$60,00090th percentile
- 4at S$100,000 or more
152 decisions record a financial penalty; 151 publish the amount. Percentiles are nearest-rank.
Source: PDPC enforcement decisions, read 12 October 2026.
The shift to voluntary undertakings
In 2024–2026, 89 of 115 published decisions (77%) were voluntary undertakings: the organisation commits to a fix plan, and the PDPC publishes it. Before 2020 there were none.
Voluntary undertakings Other outcomes
Source: PDPC enforcement decisions, read 12 October 2026.
The most common causes
Many decisions show more than one cause. 83% cite the duty to protect personal data with reasonable security arrangements.
Source: PDPC enforcement decisions, read 12 October 2026.
Sectors with the most decisions
Retail and technology firms lead the record, but every sector appears in it. Sectors are named here; organisations are not.
Source: PDPC enforcement decisions, read 12 October 2026.
What this means for a 20-person business
- The likely penalty is far below the maximum: the median is S$11,000. But the decision carries your organisation’s name for good.
- Ransomware or malware sits behind 23% of decisions. Patched systems and backups you can restore matter most.
- 15% of decisions found no Data Protection Officer, policies or training: the cheapest gaps to close.
- A vendor’s lapse shows up in 13% of decisions. Your contracts and your checks on vendors still count.
- Since 2024, most cases end in a voluntary undertaking. A credible fix plan, ready fast, is your best answer to the PDPC.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)