SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
of harm or risk posed to individuals, rather than being applied mechanically at the statutory maximum. Criminal Offences Section 51 (1) of the PDPA provides for specific crimi - nal offences for persons, including requesting access to, or correction of, another individual’s personal data without authority. Under Section 51 (3) of the PDPA, criminal offences for both persons and organisations include: • evading access/correction requests; • obstructing enforcement; or • providing false information to the Commission, an inspector or an authorised officer. Offenders are liable to fines and/or imprisonment. Further, Part 9B of the PDPA introduces specific offences targeting egregious mishandling of personal data at the individual level. These provisions make it a criminal offence for an individual to knowingly or recklessly: • disclose personal data without authorisation; • use personal data to obtain a wrongful gain or cause harm or loss to another person; or • re-identify anonymised information without author- ity. Individuals convicted of such offences may be subject to fines of up to SGD5,000, imprisonment for up to two years, or both. 1.9 Enforcement Trends Most enforcement actions taken by the PDPC con - tinue to arise from inadequate data security practices, with breaches of the Protection Obligation forming the largest share of decisions issued in the past 24 months. On 28 October 2025, the PDPC levied a financial pen - alty of SGD315,000 against Marina Bay Sands Pte Ltd (MBS) in Re Marina Bay Sands Pte Ltd [2025] SGP - DPC 6. This represents the second-largest single fine imposed since the PDPA took effect, and the high - est penalty issued following the 2021 PDPA amend - ments, which raised the maximum financial penalty
from SGD1 million to up to 10% of an organisation’s annual turnover in Singapore (subject to a minimum of SGD1 million). In October 2023, the personal data of approximately 665,000 MBS patrons was unlawfully accessed and exfiltrated, with the compromised information later offered for sale on the dark web. The breach arose from deficiencies during a major software migration in March 2023, where critical security configurations were compiled by a single employee without adequate oversight or verification. The PDPC found that MBS failed to implement reasonable security measures and appropriate post-migration controls, constituting a negligent breach of the protection obligation, par - ticularly given MBS’s scale and available resources. This decision is significant for articulating a struc - tured penalty framework, confirming that, while the enhanced maximum fines introduced in 2021 provide the PDPC with greater headroom, penalties remain proportionate and fact-specific. The PDPC has also emphasised accountability, looking closely at whether organisations had reasonable governance measures, risk assessments and security practices in place prior to an incident. The decision highlights that organisations must imple - ment robust, layered governance and verification con - trols, particularly for high-risk activities such as large- scale system migrations, rather than relying solely on individual employees. It also signals the PDPC’s increasing focus on deterrence under the enhanced penalty framework, with significant fines possible even where the data involved is not highly sensitive, underscoring the need to prioritise security by design and proactive compliance.
2. Privacy Litigation 2.1 Privacy Litigation Overview
In Singapore, the bulk of data protection enforcement occurs through regulatory measures by the PDPC rather than civil proceedings in the courts. Under Section 48O(1) of the PDPA, a person who suf - fers loss or damage directly arising from a contraven -
420 CHAMBERS.COM
Powered by FlippingBook