A Singapore director is not personally liable just because the company suffers a cyberattack. Exposure arises when the board fails to take reasonable care over a risk it knew, or should have known, could seriously harm the company. Directors must use reasonable diligence under section 157 of the Companies Act 1967, and the company, a liquidator or, with court leave, a shareholder can pursue a director who did not. Regulators usually penalise the company, but some laws reach individual officers. The practical protection is a board that asks the right questions, minutes its decisions and checks both D&O and cyber insurance.
Can a director be personally liable when the company is hacked?
The company is a separate legal person. When its systems are breached, the primary legal consequences fall on the company: regulatory penalties, claims by customers and contract partners, and the cost of recovery. Directors are not insurers of the company’s IT, and a board is entitled to rely on competent managers and outside specialists.
Personal exposure comes from the way the board handled the risk. Section 157(1) requires a director to act honestly and use reasonable diligence in discharging the duties of office. The courts judge diligence objectively: what a reasonable director in that position would have done. A director who never asked whether the company had backups, ignored repeated warnings from the IT team, or approved a cost cut that removed basic protections may struggle to show reasonable diligence if the company later suffers a serious loss. A breach of section 157 is also an offence, and its penalties were revised in 2026. For the full list of statutory duties, see a Singapore director’s statutory duties.
Delegation is allowed, but it does not end the director’s role. The board should know who is responsible for cybersecurity, receive reports, and act on them.
Which laws put cyber risk on the board’s agenda?
| Law or guidance | What it requires | Who is exposed |
|---|---|---|
| Companies Act 1967, section 157 | Directors must act honestly and use reasonable diligence | Individual directors, to the company; also a criminal offence |
| Personal Data Protection Act 2012 (PDPA) | Make reasonable security arrangements for personal data; designate a data protection officer; have data protection policies; notify the PDPC of notifiable breaches no later than 3 calendar days after assessing that a breach is notifiable | Mainly the organisation: financial penalty of up to 10% of annual Singapore turnover where turnover exceeds S$10 million, otherwise up to S$1 million |
| Cybersecurity Act 2018 | Duties for owners of critical information infrastructure and other regulated entities, expanded by amendments that partly took effect on 31 October 2025 | The regulated entity, and under section 36 an officer who consented, connived, or knew or ought reasonably to have known of an offence and did not take all reasonable steps to prevent it |
| Sector rules, such as MAS technology risk requirements | Board and senior management oversight of technology risk for regulated financial institutions | The licensed entity and, through supervisory action, its management |
For most private SMEs, the PDPA is the law most likely to apply after an incident. The penalty falls on the company, but a large penalty, remediation bill and loss of customers can push a company towards insolvency. At that point the directors’ conduct is examined closely, including whether they considered creditors’ interests as the company’s finances deteriorated.
Who could bring a claim against the directors?
- The company itself. A new board or a new controlling shareholder may decide the former directors’ failures caused the loss and sue in the company’s name.
- A liquidator. If the company is wound up, the liquidator reviews the directors’ conduct and may pursue claims for breach of duty to recover money for creditors.
- Shareholders. A shareholder can apply to court for leave to bring a derivative action in the company’s name under section 216A, or claim oppression under section 216 if the affairs of the company are conducted in a way that is unfairly prejudicial to them.
- Regulators. Where a law provides for officer liability, such as section 36 of the Cybersecurity Act 2018 for regulated entities, an individual officer can be prosecuted.
Customers whose data is leaked will usually claim against the company rather than the directors. A claim may name both, however, and each will need to consider separate defences. Our guide to a claim naming both the company and its director explains why.
What should the board actually do, and minute?
Good governance is the best defence to a diligence claim, because it creates evidence that the directors engaged with the risk. A practical cycle for an SME board:
- Name an owner. Assign responsibility for cybersecurity to a named executive or outsourced provider, and confirm who the company’s data protection officer is.
- Know the crown jewels. Ask which systems and data the business cannot operate without, and which personal data it holds.
- Use a recognised baseline. The Cyber Security Agency of Singapore (CSA) publishes toolkits for enterprise leaders and SME owners, and runs the Cyber Essentials and Cyber Trust certification marks. Ask management to report against one of them.
- Approve an incident response plan. It should name who decides on containment, who calls the insurer, police and PDPC, and who speaks to customers.
- Test it. Ask for evidence that backups can be restored and that the plan has been rehearsed.
- Review key vendors. Ask which outside providers hold the company’s data and what their contracts say about security and liability.
- Review insurance annually. Check D&O and cyber cover together, including exclusions, limits and notification conditions.
- Minute it. Record what was reported, the questions asked, the decisions made and the reasons, including any decision not to spend on a control.
Checklist for board minutes on cyber risk:
- Date of the last cyber risk report and who presented it.
- Main risks identified and the agreed actions, owners and deadlines.
- Status of actions from the previous report.
- Any incidents or near misses, and how they were handled.
- Insurance renewal position and any material exclusions.
- Budget decisions and the reasons for them.
Does D&O insurance or cyber insurance protect the director?
They do different jobs, and directors often assume one covers what only the other does.
| Question | D&O insurance | Cyber insurance |
|---|---|---|
| Who is protected? | Directors and officers personally, and the company when it indemnifies them | Mainly the company |
| What triggers it? | A claim alleging a wrongful act by a director or officer, such as breach of duty | A cyber or data incident, and claims or investigations arising from it |
| Typical cover | Defence costs, settlements and damages; often costs of regulatory investigations | Incident response, forensics, data restoration, notification, business interruption, privacy liability |
| Common limits | Some policies exclude or restrict cyber-related claims; dishonesty and fraud exclusions; insured-versus-insured exclusions | Sub-limits, waiting periods, exclusions for known prior incidents or failure to maintain stated controls |
The company’s ability to protect its directors directly is limited. Under section 172, a provision by which the company indemnifies an officer against liability for negligence, default, breach of duty or breach of trust in relation to the company is generally void, subject to sections 172A and 172B. Section 172A allows the company to buy insurance for its officers against such liability. Our guide to directors’ indemnity and section 172 sets out what is permitted, and our D&O insurance guide covers policy structure. For the company’s own cover, see our sibling guide to cyber insurance for Singapore SMEs. Neither policy will certainly pay: cover depends on the wording, the facts and compliance with conditions such as prompt notification.
Example: The three directors of a Singapore online retailer receive a report that customer passwords are stored without encryption. They minute the risk, approve a budget for a fix within three months and ask for monthly updates. Before the fix is complete, a breach exposes customer records. The PDPC investigates the company. Later, a minority shareholder alleges the directors were careless. The minutes show the board identified the risk, acted promptly and monitored progress, which supports their defence. The company notifies its cyber insurer for the incident costs, and the directors notify the D&O insurer of the shareholder’s allegation as soon as it is made.
What happened in real cases?
SingHealth and IHiS: Singapore’s largest data breach (2018 to 2019)
In 2018 attackers gained access to SingHealth’s patient database, taking the personal particulars of about 1.5 million patients. A Committee of Inquiry reported in January 2019. In its published decision that month, the PDPC imposed financial penalties of S$750,000 on Integrated Health Information Systems (IHiS), which ran the system, and S$250,000 on SingHealth as owner, at the time the largest it had imposed. As reported by Yahoo News Singapore and Mothership in January 2019, IHiS also dismissed two employees, demoted another, and imposed financial penalties on five senior management staff, including its chief executive, for collective leadership responsibility. These were internal disciplinary measures rather than court findings, but they show that accountability after a breach can reach leadership, not only technical staff.
ASIC v RI Advice Group (Australia, 2022)
In ASIC v RI Advice Group Pty Ltd [2022] FCA 496, the Federal Court of Australia declared that a financial services licensee had breached its licence obligations by failing to have adequate cybersecurity risk management for its network of advisers, after a series of incidents between 2014 and 2020. By consent, it was ordered to engage an independent cybersecurity expert at its own cost and to pay A$750,000 towards the regulator’s costs. The case was against the company, but it is often cited as showing that a court will treat cyber risk management as a core part of running a regulated business, which is how Singapore boards should approach it too.
Frequently asked questions
Can a non-executive director rely entirely on management for cybersecurity?
A non-executive director may rely on competent management, but should still ask for regular reports, question gaps and follow up on actions. Reliance without any inquiry is harder to defend.
Will the PDPC fine the directors personally?
PDPC financial penalties for breaches of the data protection obligations are imposed on the organisation. Directors’ personal risk usually comes from claims for breach of duty or, in regulated sectors, specific officer provisions.
Can the company pay a director’s legal costs after a cyber incident?
It depends on the claim and the outcome. Section 172 restricts indemnities for liability to the company itself, which is why D&O insurance matters. Check the constitution, any deed of indemnity and the policy.
Does the Cybersecurity Act apply to my SME?
Usually not directly. It applies to owners of designated critical information infrastructure, cybersecurity service providers that need a licence, and other entities the Act specifically brings in. Your customers’ contracts may still require you to follow similar standards.
What should a director do if a breach has just happened?
Make sure the incident response plan is activated, the insurer is notified, the PDPA breach assessment starts at once, and board decisions are minuted. See our sibling guide on the first 72 hours after a ransomware attack.
Official sources: Companies Act 1967; Personal Data Protection Act 2012; Cybersecurity Act 2018; CSA cybersecurity toolkits; CSA announcement on the Cybersecurity (Amendment) Act commencement; Personal Data Protection Commission.
Insurance cover itself should be arranged through a licensed insurer or insurance broker.
Need help with directors’ duties after a cyber incident?
If your company, or you as a director or shareholder, is dealing with a cyber incident, a data breach investigation or allegations that the board failed to manage cyber risk, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines, including board minutes and resolutions. Where your matter needs a lawyer, for example if a claim is made against your company or its directors, or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles directors’ duties, data protection and cybersecurity matters. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.
Willie Tan, Raffles Corporate Services