Five Personal Data Protection Commission decisions in 2025 imposed S$455,000 in penalties over incidents affecting 1.86 million people. None of them involved an exotic attack. Here is what they found, and what we see on Singapore websites today.
This is compliance research, not legal advice. Sitetals is an independent scanner, not a law firm and not affiliated with the Personal Data Protection Commission.
Whether a specific obligation applies to your organisation is a question of fact and law. For a decision that carries risk, take advice from a Singapore-qualified practitioner.
Between 17 and 27 August 2026 we completed compliance scans of 10,298 Singapore-associated websites. Each site is counted once, using its most recent completed scan.
The sample was assembled from public web indexes: the CommonCrawl Singapore host index (5,610 sites), Majestic (711), certificate transparency logs (540), the SGX API (375) and a Singapore business-listing set (332), with 27 unattributed.
That composition matters. It is a convenience sample weighted toward domains large enough to appear in a public index. It is not a random or representative sample of Singapore businesses, and nothing here should be read as "X% of Singapore companies". It is a large, dated, reproducible read of what Singapore websites currently expose.
Share of all scanned sites showing each finding. A site can appear in more than one row.
Denominator is all 10,298 sites with a completed scan, not only those with findings. Sites that did not resolve, were unreachable, or were behind bot protection are excluded rather than counted as clean. Sample drawn from public web indexes and therefore weighted toward indexed domains; not a representative sample of Singapore businesses. Figures are a snapshot of our scan database taken on 27 August 2026; scanning is continuous, so the same query run later returns a larger sample. “No data protection contact discoverable on the site” means exactly that: regulation 1A of the Personal Data Protection Regulations 2021 also accepts publication on the organisation’s ACRA BizFile record, which a website scan cannot see.
The 41.2% with no published data protection contact is the one that is trivially checkable from outside. Section 11(5) of the PDPA requires an organisation to make available to the public the business contact information of at least one designated individual, and regulation 1A of the Personal Data Protection Regulations 2021 names two accepted routes: the organisation's ACRA record on BizFile, or a readily accessible part of its official website.
One honest caveat on our own number. Because BizFile is an accepted route, an organisation that has filed its designated individual with ACRA satisfies section 11(5) even with nothing on its website — and our scanner reads websites, not BizFile. So 41.2% means no data protection contact was discoverable on the site, not that those organisations are in breach. More on both routes here.
The 23.8% with no discoverable privacy policy is the more serious one. Section 20 requires that individuals be informed of the purposes for collection on or before collection. A published policy is the ordinary way a website discharges that. Where there is no policy at all and the site collects personal data — a contact form, a newsletter box, a checkout — there is a real question about how notification is being given.
Every figure below was taken from the published decision itself, not from a secondary summary. Citations and case numbers are given so you can check them.
| Organisation | Citation | Decision date | Penalty | Individuals | Obligation |
|---|---|---|---|---|---|
| Marina Bay Sands Pte. Ltd. | [2025] SGPDPC 6 DP-2310-C1622 | 28 Oct 2025 | S$315,000 | 665,495 | Protection, s.24 |
| Air Sino-Euro Associates Travel Pte. Ltd. | [2025] SGPDPC 5 DP-2312-C1857 | 31 Oct 2025 | S$47,000 | 336,759 | Accountability s.11(3) and Protection s.24 |
| Singapore Data Hub Pte Ltd | [2025] SGPDPC 2 DP-2406-C2514 | 7 Apr 2025 | S$17,500 | 698,112 | Protection, s.24 |
| Goldheart Jewelry Pte. Ltd. | [2025] SGPDPC 4 DP-2305-C1061 | 20 Jun 2025 | S$58,000 | 41,379 | Protection, s.24 |
| People Central Pte. Ltd. | [2025] SGPDPCS 4 DP-2405-C2330 | — | S$17,500 | 119,765 | Protection, s.24 |
| Total | — | — | S$455,000 | 1,861,510 | — |
Between September 2022 and March 2023 the organisation migrated to a new middleware platform. The migration involved replicating the existing API configurations onto the new platform, and the organisation chose to do that replication manually. One employee was tasked with compiling an inventory of every API and its calling application ID. That inventory was then used to configure the token verification policy on the new platform.
The employee omitted one entry: the external ArtScienceMuseum calling application ID. Because the inventory drove the configuration, the token verification policy never applied to that one page. The result was a classic insecure direct object reference — member IDs were sequential numbers, so anyone with a valid access token could change the number in the request and read another member's record. The gap was open for at least six months, from March to October 2023, and the data of 665,495 loyalty programme members was exfiltrated and offered for sale.
The Commission's criticism was not that an employee made a mistake. It was that the organisation placed the burden on one employee at a single point with no process to catch the error, and that it was unreasonable to rely on that alone.
A cyberattack led to the exfiltration of personal data belonging to 336,759 individuals, including full images of NRIC, passport and birth certificate documents for at least a hundred of them. Investigations found the server running Windows Server 2012, no contractual requirement for the IT vendor to conduct regular security reviews, and no multi-factor authentication.
The Accountability finding is the part website operators should read twice. The organisation had not designated anyone under section 11(3) until 15 April 2024 — after the incident. That is a standalone breach, independent of the technical failures.
It is worth being precise about causation here, because it is frequently misreported: the S$47,000 was imposed for the Accountability and Protection breaches together, on facts that included a large exfiltration. It is not a "S$47,000 fine for not having a DPO". The absence of a designated individual was one finding among several, and it is the one that would have been visible from outside the organisation.
The organisation ran a Magento e-commerce platform managed by a vendor. CVE-2022-24086 was published, and a patch was available, in February 2022. It was still unapplied when the vulnerability was exploited roughly eleven months later, disclosing the personal data of 41,379 individuals, some of which was published online.
The Commission's starting point was S$64,000. After the organisation's representations — including a successful argument about plaintext credentials in Magento configuration files, which the Commission accepted — the penalty imposed was S$58,000. Both numbers appear in the decision; only S$58,000 is the penalty.
The directions are as instructive as the penalty: engage a third-party vendor for a targeted security audit within 60 days, rectify what it finds, and report back.
A cloud HR platform running on AWS. A threat actor deleted databases and put the personal data of 95,000 employees of the organisation's clients at risk, along with a further 24,765 emergency contacts and children — 18,125 emergency contacts and 6,640 children, whose data included names, dates of birth and contact numbers.
The findings were unglamorous and specific: SQL injection vulnerabilities in the web application with multiple observed attempts and no web application firewall; Remote Desktop Protocol open to the internet without two-factor authentication; inbound traffic permitted from every IP address in the cloud environment; and vulnerability scanning performed only once every two years, with no network vulnerability assessments at the time of the incident.
The decision cites the CIS Critical Security Controls, under which internal and external penetration tests should be conducted at least annually and vulnerability assessments quarterly, and records the Commission's encouragement that organisations assess the need and frequency of penetration testing as part of a periodic security review.
If you take one operational cadence away from this report, take that one.
A point-of-sale and CRM vendor to small and medium enterprises. Files were exfiltrated affecting 698,112 individuals, including approximately 689,000 whose NRIC number was involved and a further group whose medical information was affected.
The finding that generalises: the organisation carried out internal acceptance testing that checked whether the application functioned. Functional testing was held not to be a substitute for security testing. If your release checklist asks "does it work?" and never asks "can it be abused?", this decision is about you.
The problem was the interval: eleven months to apply a known patch, two years between vulnerability scans, six months with a misconfiguration undetected. Compliance failed at the frequency, not at the concept.
Goldheart used a vendor. Air Sino-Euro used an IT vendor with no security-review clause. Marina Bay Sands used one employee. In each case the organisation remained accountable. Section 11(6) of the PDPA is explicit that designating an individual does not relieve the organisation of its obligations, and the decisions apply the same logic to outsourcing.
Two of the five organisations argued they could not afford the penalty. Neither had the penalty reduced on that basis. People Central was allowed to pay S$17,500 in twelve monthly instalments. That is the shape of the concession available: how you pay, not whether you owe.
Most of what the Commission penalised is invisible from outside. We cannot see your patch cadence, your VAPT reports, your firewall rules or your vendor contracts, and any scanner claiming otherwise is overselling. What we can see is a different layer: the one a customer, a complainant or the Commission can look at without asking anyone's permission.
The decisions say nothing about what any of these five organisations published on its own website, and we make no claim about that.
The relationship is correlative, not causal, and we are not going to dress it up as more than that. Air Sino-Euro's Accountability finding was that no individual had been designated under section 11(3) until after the incident — a designation failure, not a publication failure, and one no scanner could have seen.
The two duties sit side by side: section 11(3) is the duty to designate someone, section 11(5) the duty to make that person's business contact information available. Only the second is visible from outside, and it has been in force since 2 July 2014. A site that still shows nothing is worth a question, even though the missing contact is not itself proof of anything.
Sitetals fetches your homepage and the legal pages linked from it, exactly as any visitor or complainant could, and reads the HTML it is served without executing it. It reports what is visible from outside. It has no access to your servers, your contracts or your internal processes.
| Question | Visible to the scan? | Why |
|---|---|---|
| Is a privacy policy published and reachable? | Yes | Detected from homepage and footer links. |
| Is a data protection contact discoverable on the site? | Yes | Detected in the footer, homepage and linked legal pages. A contact filed only on the ACRA BizFile record is not visible to us. |
| Is tracker code served with no consent mechanism present? | Yes | Read from the page as it is served to us, before any interaction. We do not execute the page, so we report the code that was delivered, not a network request we watched fire. |
| Is the site served over HTTPS? | Yes | Observed at fetch time. |
| Is the policy adequate for your actual processing? | No | That depends on what you collect and why. A scan cannot read your business. |
| Was consent validly obtained and recorded? | No | Consent records are internal. |
| Is your patching, VAPT or access control reasonable? | No | Internal processes are not website-visible. |
| Are your vendor contracts adequate? | No | Contracts are not published. |
A finding is a prompt to look, not a determination that the PDPA has been contravened. Only the Commission can make that determination.
This is the most commonly mangled fact in Singapore compliance writing, so here it is from the statute. Section 48J(3), mirrored by regulation 10A of the Personal Data Protection (Enforcement) Regulations 2021, sets two maximums:
| Annual turnover in Singapore | Maximum financial penalty |
|---|---|
| Exceeds S$10 million | 10% of annual turnover in Singapore |
| S$10 million or below | S$1 million |
The Marina Bay Sands decision calls these the High Turnover Class and the Low Turnover Class. Any organisation whose annual turnover in Singapore is S$10 million or below sits in the Low Turnover Class, where the ceiling is S$1 million. Quoting only the 10% figure to a small operator overstates their exposure, and we would rather be useful than alarming. Note also that these are maximums: the five penalties here ranged from S$17,500 to S$315,000.
“A financial penalty imposed on an organisation … must not exceed the maximum amount to be prescribed, which in no case may be more than the following: (a) … by an organisation whose annual turnover in Singapore exceeds $10 million — 10% of the annual turnover in Singapore of the organisation; (b) in any other case — $1 million.”
None of this constitutes legal advice and none of it is specific to your organisation. It is the housekeeping the five decisions above keep returning to, in the order we would do it.
Sitetals checks the same externally visible signals discussed above: whether a privacy policy is reachable, whether a data protection contact is published, whether trackers fire before a consent choice, and whether the site is served over HTTPS. No sign-up, no card.
Run a free PDPA scanFree scan. A full PDF report with the PDPA references and a remediation checklist starts at S$68.
Yes, if you collect, use or disclose personal data in Singapore. The Act attaches to the activity, not to where the organisation is incorporated. An overseas e-commerce store selling to Singapore customers and collecting their names, addresses and payment details is within scope.
Yes. Section 11(3) requires every organisation to designate one or more individuals responsible for ensuring compliance, with no small-business exemption. It can be an existing employee doing it alongside another role, and the responsibility can be delegated under section 11(4). Section 11(5) then requires the business contact information of at least one of those individuals to be publicly available.
Section 26D(1) requires notification as soon as practicable and no later than three calendar days after the day you assess the breach to be notifiable. The clock runs from your assessment, not from the breach itself — but section 26C(2) requires that assessment to be made in a reasonable and expeditious manner, so you cannot extend the deadline by delaying it.
S$1 million for an organisation whose annual turnover in Singapore is S$10 million or below, and 10% of annual Singapore turnover above that threshold. The five decisions covered here ranged from S$17,500 to S$315,000.
The Act never mentions cookies. Section 13 requires consent before personal data is collected, used or disclosed, unless consent is deemed under sections 15 to 15A or an exception in the First Schedule applies — so some cookies need no banner at all, and the PDPC's Advisory Guidelines on the PDPA for Selected Topics (revised May 2024) apply deemed consent to cookies in some cases. Analytics, advertising and remarketing tags are the ones that need a real choice, and the First Schedule's legitimate-interests exception is expressly unavailable for direct marketing. A consent mechanism that blocks those tags until a choice is made is the practical way to comply; a banner that does not block anything is not. The longer answer is here.
Enforcement figures were read from the published decisions. Statutory references were checked against the consolidated Personal Data Protection Act 2012 on Singapore Statutes Online, in the version in force from 5 December 2025.
Scan figures are from our own production database and are stated with the denominator so they can be judged: one row per website, its most recent completed scan, over a window in which a single version of each check was in force throughout.
The sample definition, discovery-source composition, per-check counts and scanner limits are recorded in our dated aggregate record for this report, and every figure here traces to it. We name no scanned organisation and publish no site-level result.
If you believe a figure here is wrong, tell us and we will check it and correct it: hello@sitetals.com. We intend to refresh this report after each significant enforcement batch, and at least twice a year.