Five decisions at five unrelated companies, and one consistent standard. Every figure here is taken from the published decision, with the case number so you can check it yourself.
Read individually, these decisions look like five unrelated incidents at five unrelated companies: an integrated resort, a travel agency, a jeweller, an HR software provider and a point-of-sale vendor.
Read together, they are unusually consistent. The Commission is describing a standard of ongoing operational diligence, and measuring organisations against it.
Every figure below comes from the published decision itself. Case numbers are given so you can verify each one.
This is compliance research, not legal advice. Sitetals is an independent scanner, not a law firm and not affiliated with the Personal Data Protection Commission.
Whether a specific obligation applies to your organisation is a question of fact and law. For a decision that carries risk, take advice from a Singapore-qualified practitioner.
| Organisation | Citation and case | Date | Penalty | Individuals | Findings |
|---|---|---|---|---|---|
| Marina Bay Sands Pte. Ltd. | [2025] SGPDPC 6 DP-2310-C1622 | 28 Oct 2025 | S$315,000 | 665,495 | s.24 Migration misconfiguration, no verification |
| Air Sino-Euro Associates Travel Pte. Ltd. | [2025] SGPDPC 5 DP-2312-C1857 | 31 Oct 2025 | S$47,000 | 336,759 | s.24 s.11(3) No DPO, unsupported OS, no MFA |
| Goldheart Jewelry Pte. Ltd. | [2025] SGPDPC 4 DP-2305-C1061 | 20 Jun 2025 | S$58,000 | 41,379 | s.24 Known CVE unpatched 11 months |
| Singapore Data Hub Pte Ltd | [2025] SGPDPC 2 DP-2406-C2514 | 7 Apr 2025 | S$17,500 | 698,112 | s.24 Functional testing only, no security testing |
| People Central Pte. Ltd. | [2025] SGPDPCS 4 DP-2405-C2330 | — | S$17,500 | 119,765 | s.24 SQL injection, no WAF, 2-year scan interval |
| Total | — | — | S$455,000 | 1,861,510 | — |
What happened. Between September 2022 and March 2023 the organisation migrated to a new middleware platform. The migration required replicating existing API configurations onto the new platform, and this was done manually.
One employee compiled the inventory of APIs and their calling application IDs that was then used to configure the token verification policy.
The inventory omitted the external ArtScienceMuseum calling application ID. As a result the token verification policy never applied to the ArtScience Friends webpage.
Member IDs were in a guessable numeric format, so a request bearing a valid access token could be altered to read another member's record.
The data of 665,495 loyalty programme members was exfiltrated and offered for sale on the dark web.
What the Commission found. The vulnerability existed for at least six months, from March to October 2023. The criticism was structural: it was unreasonable to place the burden on one employee at a single point, with nothing in place to detect the resulting error.
Remedial action recorded. The decision records that the organisation contained the incident within one day of discovery, enabled the token verification policy for the affected webpage, penetration-tested that fix, revalidated the policy across its APIs, and voluntarily notified all affected individuals.
In view of the remedial actions already taken, the Commission issued no further directions.
What it means for your site. If any part of your infrastructure was configured by hand during a migration and checked by the same person who configured it, this is your pattern.
The remedy is not more care. It is a second pair of eyes and a test that would fail if the control were absent.
What happened. A cyberattack led to the exfiltration of personal data belonging to 336,759 individuals. The data included full images of identification documents — NRIC, passport and birth certificates — for at least a hundred individuals, which the Commission noted raises the risk of identity theft.
What the Commission found. Two obligations, not one. Under the Protection Obligation: a server running Windows Server 2012, an unsupported operating system; no multi-factor authentication; and no contractual clauses requiring the IT vendor to conduct regular security reviews.
Under the Accountability Obligation: no individual had been designated under section 11(3) until 15 April 2024, after the incident, and there were no internal data protection policies.
The organisation sought a reduction on financial-hardship grounds and argued the penalty was disproportionate compared with a S$17,500 penalty in another case.
Neither argument succeeded; the Commission noted that penalties are set on the facts of each case.
The directions are worth reading as a checklist: implement data protection policies including a password policy; put cybersecurity clauses into vendor contracts covering regular security reviews, infrastructure maintenance, patch management and monitoring; and engage a CSA-licensed provider for vulnerability assessment and penetration testing, including MFA for administrative and user accounts.
Remedial action recorded. The decision records that the organisation disabled Remote Desktop Protocol access for all servers, hardened its firewall rules, upgraded its desktop operating systems, changed all account passwords and implemented multi-factor authentication for its administrative accounts.
The Commission treated the prompt and effective remedial action as a factor reducing the penalty.
It is easy to read this as a fine for failing to appoint a DPO. It was not. The S$47,000 was imposed for the Accountability and Protection breaches together, on facts including the exfiltration of data belonging to 336,759 individuals.
What makes the Accountability finding notable is that it stood on its own and required no technical forensics to establish.
What happened. The organisation's Magento e-commerce website was compromised through CVE-2022-24086, a known vulnerability for which a patch had been available since February 2022.
It remained unapplied for roughly eleven months. The personal data of 41,379 individuals was disclosed, and some was published on an online forum.
What the Commission found. The finding that stands in the final decision is inadequate patch management. The preliminary decision had also found a failure to implement reasonable access controls in respect of plaintext credentials stored on the website's server; on representations the Commission made its own enquiries of the vendor, was satisfied that reasonable access controls restricted access to those files, and accepted the organisation's position on that point, so it forms no part of the final decision.
The platform was vendor-managed, and the organisation remained responsible for ensuring patches were requested and applied.
On the penalty figure. The Commission's starting point was S$64,000. The organisation made representations, some of which were accepted — including an argument about plaintext credentials in Magento configuration files, where the Commission was satisfied that reasonable access controls restricted access to those files and that there was no conclusive evidence the credentials had been exploited.
The penalty imposed was S$58,000. Both figures appear in the decision; only S$58,000 is the penalty.
Remedial action recorded. The decision records that the organisation applied the outstanding Magento security patches and upgrades and reset all administrator passwords with access controls implemented, and that the Commission treated its prompt post-incident action to mitigate the effects and prevent recurrence as a factor reducing the penalty.
What it means for your site. “The vendor handles updates” is not a compliance position unless you can show you asked, they answered, and you verified.
Write down who checks, how often, and where the record lives.
What happened. A provider of point-of-sale and CRM software to SMEs. Files were exfiltrated from its servers affecting 698,112 individuals, including approximately 689,000 whose NRIC number was involved, and a further 9,122 whose health information was affected.
The data was later posted on a web-hacking forum.
What the Commission found. The organisation carried out internal acceptance testing designed to check whether the application functioned. It did not conduct security testing of the web application code before launch or as part of periodic review, and did not run basic network vulnerability scans.
Acceptance testing that checks whether an application functions is not security testing. Functional testing was held not to substitute for testing whether the application can be abused. Two different questions, two different exercises.
Remedial action recorded. The decision records that after the incidents the organisation implemented a web application firewall with rules against SQL injection, added two-factor authentication for back-office access, restricted administrator access to whitelisted addresses, patched the vulnerable application code, shut down unused applications and performed a penetration test.
What it means for your site. If your release process asks “does it work?” and never asks “can this be abused?”, you have the gap the Commission identified in that decision.
For a small operator that does not mean a formal programme; it means one added question at review, and periodic external testing.
What happened. A cloud HR SaaS provider running on AWS. A threat actor deleted databases and put at risk the personal data of 95,000 employees of the organisation's clients — including NRIC numbers, salary, bank account numbers, nationality, marital status and religion — along with a further 24,765 individuals: 18,125 emergency contacts and 6,640 children of those employees.
What the Commission found. SQL injection vulnerabilities in the web application, with multiple attempts observed, and no web application firewall to limit exposure.
Weak access controls: Remote Desktop Protocol open to the internet without two-factor authentication, and inbound traffic permitted from all IP addresses in the cloud environment.
Insufficient security testing: vulnerability scanning only every two years, and no network vulnerability assessments at the time of the incident.
Citing the CIS Critical Security Controls, the Commission stated that internal and external penetration tests should be conducted at least annually and vulnerability assessments quarterly, and encouraged organisations to assess the need and frequency of penetration testing as part of periodic security review.
The organisation sought a waiver on financial grounds; the penalty stood, but it was permitted to pay in twelve monthly instalments.
Remedial action recorded. The decision records that the organisation disabled Remote Desktop Protocol access in favour of a VPN, closed and secured network ports, carried out web application vulnerability assessment and penetration testing and rectified every vulnerability identified, strengthened privileged account management, enabled logging and monitoring, and updated its password requirements — with two-factor authentication for remote access, field-level encryption and quarterly vulnerability scans recorded as in progress.
What it means for your site. Two years between scans was the interval the Commission found unreasonable. Annual penetration testing is the reference point in this decision.
And an administrative interface reachable from the open internet without a second factor is the kind of finding that is written down in plain terms.
In every case the organisation knew the control mattered. Goldheart knew about patching; the patch existed. People Central ran vulnerability scans; the interval was two years.
Singapore Data Hub tested; the testing asked the wrong question. Marina Bay Sands had a token verification policy; it simply did not cover one page for six months.
None of these are failures of understanding. They are failures of frequency and verification — which is good news, because frequency is cheaper to fix than capability.
Goldheart delegated to a platform vendor. Air Sino-Euro used an IT vendor with no security-review obligation in the contract. Marina Bay Sands delegated a critical configuration step to one employee. In each case the organisation remained accountable.
Section 11(6) makes the principle explicit for designation — naming an individual does not relieve the organisation of its obligations — and the decisions apply the same reasoning to outsourcing.
Delegating the work is normal. Delegating the responsibility is not possible.
The Marina Bay Sands facts are the clearest illustration: a control existed, was correctly designed, and did not apply where it was needed, and nothing detected that for half a year.
A control you have never tested in its failing state is a control you are assuming, not one you have.
The four points below are our reading of these five decisions, not a statement of Commission policy. Each records an argument that was made and not accepted in the decision named.
The Commission has said in these decisions that each case is decided on its own facts and circumstances, so none of this predicts the outcome of any other case.
Under section 48J(3) of the PDPA, and regulation 10A of the Personal Data Protection (Enforcement) Regulations 2021, the maximum financial penalty is 10% of annual turnover in Singapore where that turnover exceeds S$10 million, and S$1 million in any other case.
For most Singapore SMEs the ceiling is S$1 million. The five penalties here ranged from S$17,500 to S$315,000 — well below either ceiling, and set on the facts.
The findings in these decisions are mostly internal — patching, testing, access control — and no scanner can see them.
What Sitetals can check is the outer layer: whether a privacy policy is reachable, whether a data protection contact is published, whether trackers fire before consent, and whether the site is served over HTTPS.
Run a free PDPA scanFree scan. Full PDF report with the PDPA references and a fix list from S$68.
Of the decisions covered here, Marina Bay Sands at S$315,000 ([2025] SGPDPC 6, 28 October 2025) is the largest. It concerned a misconfiguration during a middleware migration that exposed the records of 665,495 loyalty programme members for at least six months.
In the People Central decision the Commission cited the CIS Critical Security Controls, under which internal and external penetration tests should be conducted at least annually and vulnerability assessments quarterly, and encouraged organisations to assess the need and frequency of penetration testing as part of periodic security review. Vulnerability scanning at a two-year interval, with no network vulnerability assessments, was found insufficient.
You can rely on them to do the work. You cannot rely on them to hold the obligation. Goldheart's platform was vendor-managed and the organisation was still found in breach for an unapplied patch. Air Sino-Euro was directed to add security-review clauses to vendor contracts. Document who checks and what evidence they keep.
Not on the evidence of these decisions. Two organisations made financial-hardship representations; neither penalty was reduced. One was allowed to pay in twelve monthly instalments. Treat hardship as a payment-schedule argument.
The Commission publishes its decisions at pdpc.gov.sg. Each is identified by a neutral citation such as [2025] SGPDPC 6 and a case number such as DP-2310-C1622, both of which are listed in the table above.
Each decision is described as published by the Commission and, where the decision states one, as at the decision date given above. Decisions are occasionally corrected or superseded after publication and we do not track subsequent amendments. If any figure or characterisation on this page does not match the current published decision, write to hello@sitetals.com and we will correct it.