Customer Sues Your Company Over a Data Breach: The PDPA Right of Private Action in Singapore

Short answer: Under section 48O of the Personal Data Protection Act 2012, a person who suffers loss or damage directly because a company breached certain PDPA obligations can sue it for damages, an injunction or a declaration. Emotional distress can count as loss; a mere loss of control over the data does not. A breach alone is not enough.

Most companies treat a data breach as a regulatory problem for the Personal Data Protection Commission (PDPC). But the people whose data was mishandled have their own route to court. This guide explains the PDPA right of private action from the side of the company being sued: what a claimant must prove, what the courts said in Reed v Bellingham and Piper v Singapore Kindness Movement, how a claim runs, how it interacts with a PDPC decision, and what the company secretary prepares while a solicitor handles the case.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

What is the PDPA right of private action?

The PDPA right of private action is a statutory right for a person harmed by certain PDPA breaches to sue the organisation responsible in the civil courts. It sits alongside, and is separate from, the PDPC’s own enforcement powers.

The PDPC can give directions and impose financial penalties, but it does not compensate the people affected. Section 48O lets an individual seek a remedy personally. The courts treat it as a statutory tort, a cause of action created by the Act itself.

A single incident can therefore produce two tracks: a regulatory track, covered in our guide to a PDPC investigation and its penalties and appeals, and a civil track brought by the individuals affected. This article deals with the civil track.

What is the legal basis, and which breaches does section 48O cover?

The legal basis is section 48O of the PDPA, inserted by section 23 of the Personal Data Protection (Amendment) Act 2020 with effect from 1 February 2021. It covers the main data protection obligations, but not every provision of the Act.

Section 48O(1) applies to “a person who suffers loss or damage directly as a result of a contravention” by an organisation of Part 4, 5, 6, 6A or 6B, or by a person of certain Do Not Call and address-harvesting provisions.

Two limits are worth noting. First, Part 3 (the general rules on protection of and accountability for personal data, including the duty in section 11 to designate a data protection officer) is not on the list, so failing to appoint a DPO does not by itself found a section 48O claim, although the PDPC can act on it. Second, Parts 3 to 6A generally do not apply to business contact information, such as a work email address or job title provided for business purposes (s 4(5)).

Where a company uses a data intermediary such as an IT or payroll vendor, it has the same obligations as if it processed the data itself (s 4(3)); our guide to liability when an IT vendor is hacked explains that position.

Who can sue the company, and what must they prove?

Any person who suffers loss or damage directly as a result of a covered contravention can sue. The claimant must prove both the contravention and actionable loss caused directly by it; a technical breach with no real harm will fail.

In Reed, Michael v Bellingham, Alex (Attorney-General, intervener) [2022] 2 SLR 1156, a former employee of a fund manager used an investor’s personal data to market a rival firm’s fund. Deciding the case under the former section 32, which used the same wording, the Court of Appeal held that:

• emotional distress can be “loss or damage” for the right of private action (at [107]);
• loss of control over personal data is not, because every contravention involves some loss of control and the loss or damage requirement would otherwise be meaningless (at [108] to [110]);
• there must be a strict causal link: the loss must be suffered “directly as a result of” the contravention (at [93]);
• trivial annoyance and the negative emotions that are part of the ordinary ups and downs of life are not actionable (at [93] and [116]); and
• whether a claimant suffered emotional distress is judged on that claimant’s own experience, using non-exhaustive factors (at [114] and [115]).

The factors are the nature of the personal data (financial data is likely to be sensitive), the nature of the breach (one-off, repeated or continuing), the defendant’s conduct, the risk of future breaches, and the actual impact on the claimant. An accidental breach by a single typographical error is unlikely to cause actionable distress. In Reed, the defendant’s refusal to undertake not to misuse the data again weighed heavily, and the injunction and order to destroy the data were restored.

The High Court applied these principles to section 48O in Piper, Martin v Singapore Kindness Movement [2025] SGHC 173 (unreported). The organisation had passed a complainant’s name and email address to the person he had complained about. Hoo Sheau Peng J found breaches of sections 13 and 18(a), but held that the claimant had not proved actionable emotional distress caused directly by the disclosure: the data was relatively non-sensitive, and his distress flowed mainly from other events. The appeal was dismissed.

An employee acting in the course of employment is not subject to the obligations (s 4(1)(b)), but the Court of Appeal treated this as a defence the employee must prove (Reed at [42] to [45]). Claims over staff mistakes at work are therefore usually directed at the company, while a former employee acting on his own account can be sued personally, as in Reed.

How does a PDPA claim against a company proceed?

Most claims begin with a letter of demand and can be resolved or narrowed before trial. If not, the claimant files in the State Courts or the High Court, and the case follows the Rules of Court 2021. The steps below assume the company is represented by a Singapore Advocate and Solicitor.

1. Letter of demand. The individual or his lawyer alleges a PDPA breach and asks for compensation, an undertaking or both. Do not reply without advice.
2. Escalation and preservation. Tell the data protection officer (DPO) and directors the same day, and preserve logs, emails, access records and the incident file.
3. Insurance. Notify any cyber or professional indemnity insurer before admitting liability or making an offer.
4. Board decision. The directors resolve to engage solicitors, set settlement authority and name the officer who gives instructions.
5. Assessment and response. The solicitor assesses the contravention, the claimant’s proof of loss and whether a PDPC decision is pending. Where the claimant mainly wants assurance, a carefully worded undertaking may resolve the dispute early.
6. Court proceedings. If a claim is filed, the company responds within the time set by the Rules of Court 2021, and the case moves through case conferences, document production and, if not settled, trial.
7. Outcome. The court dismisses the claim or grants damages, an injunction, a declaration or other relief, with costs usually following the result.

Separately, if the incident is a notifiable data breach, the company must notify the PDPC as soon as practicable and no later than 3 calendar days after assessing it as notifiable (s 26D(1)); see our guide to mandatory data breach notification.

How does a PDPC investigation affect the lawsuit?

The two routes are independent: a person can complain to the PDPC, sue, or both. But where the PDPC has made a decision on the contravention, a court claim must wait until that decision is final.

Under section 48O(2), an action “may not be brought in respect of that contravention until after the decision has become final as a result of there being no further right of appeal”. The Court of Appeal called the equivalent old rule “a procedural safeguard against parallel proceedings” (Reed at [83]), and noted that the complainant has no control over whether or how the PDPC acts (at [84]).

A published PDPC decision can help a claimant on the contravention, though he or she must still prove loss directly caused by it. A large incident means many potential claimants: in Ezynetic Pte Ltd [2025] SGPDPCS 2, ransomware led to the exfiltration of 190,589 individuals’ personal data, and the PDPC imposed a S$17,500 penalty for breaching section 24. Our article on what a data breach really costs a Singapore company covers PDPC penalties in more detail.

What documents will the company need?

The defence usually turns on the company’s records: what data it held, its security and consent arrangements, and how it responded.

Our guide to the data protection officer’s role under the PDPA sets out which of these records the DPO should keep up to date before any claim arrives.

Which court hears the claim, and what can it cost?

The forum depends mainly on the value of the claim. Many individual privacy claims are modest in value and are heard in the State Courts; Reed itself began as a District Court originating summons.

Costs can exceed the damages in dispute. In Reed, the Court of Appeal ordered the losing defendant to pay costs of S$25,000 all-inclusive for the appeal, S$10,000 for the High Court appeal below and S$4,000 for the District Court proceedings, plus disbursements (at [135]). We do not quote solicitors’ fees. Ask your solicitor early about the costs risk on both sides, and use our free compliance tools to keep court dates alongside the company’s other deadlines.

What does the company secretary prepare, and what does the solicitor file?

The company secretary or corporate service provider (CSP) keeps the company’s authorisations and compliance records in order; a Singapore Advocate and Solicitor advises on liability, corresponds with the claimant, files the court documents and appears in court. Court proceedings are conducted by a Singapore Advocate and Solicitor, never by a CSP.

Raffles Corporate Services does not give legal advice or act in court; a law firm from our panel handles any proceedings. A section 48O claim is not lodged with ACRA. If the company settles, the settlement payment and any related provision are recorded in its accounts in the usual way.

What are the common mistakes companies make?

Most come from treating a privacy complaint as a customer service issue rather than a potential claim.

• Being evasive or refusing, without advice, any assurance about future use of the data, as the defendant did in Reed.
• Admitting liability or offering compensation before notifying the insurer.
• Assuming a PDPC warning or penalty ends the matter.
• Assuming the claim must fail because there is no financial loss; proven emotional distress can be enough.
• Deleting logs or emails after the complaint arrives.

If your company has received a demand over a data breach and has no lawyer yet, speak to a lawyer before replying. The full text of the 2020 amendment that created section 48O is on Singapore Statutes Online, and the judgments in Reed v Bellingham and Piper v Singapore Kindness Movement are published on eLitigation.

Frequently asked questions

Can a customer sue our company just because their data was leaked?

Not on the leak alone. The customer must prove that the company contravened a covered PDPA obligation and that he or she suffered loss or damage, such as financial loss or proven emotional distress, directly as a result. Loss of control over the data by itself is not enough.

Is section 48O the same as the old section 32?

It replaced section 32 from 1 February 2021 and keeps the same core test of loss or damage suffered directly as a result of a contravention. The courts have applied the Court of Appeal’s reasoning on section 32 in Reed to section 48O, as in Piper.

Does a PDPC penalty mean we will lose a lawsuit?

No. A PDPC finding may help a claimant show a contravention, but the claimant must still prove his or her own loss caused directly by it. While a PDPC decision on the same contravention is open to appeal, a court claim cannot be brought.

Can our company secretary or DPO defend the claim in court?

No. Where the company is represented, a Singapore Advocate and Solicitor runs the case. The company secretary and DPO prepare the records, resolutions and policies the solicitor relies on.

Last reviewed: 10 November 2026. The Editorial Team, Raffles Corporate Services.