If your IT vendor, cloud provider or outsourced payroll firm is hacked and your customers’ or employees’ personal data leaks, your company is usually still answerable to the Personal Data Protection Commission (PDPC) and to the people affected. Under the Personal Data Protection Act 2012 (PDPA), outsourcing the processing does not outsource the responsibility. The vendor may also be in breach, and you may have a contract claim against it, but how much you recover depends on its liability cap, its insurance and how well you documented your oversight before the incident.
Who is responsible under the PDPA when a vendor is breached?
The PDPA separates the organisation that decides why and how personal data is used from the data intermediary that processes it on the organisation’s behalf. Your payroll bureau, CRM host, IT support company, cloud storage provider or mailing house is typically a data intermediary.
Three rules matter most:
- Your company keeps the full set of obligations. Section 4(3) of the PDPA says an organisation that uses a data intermediary has the same obligations as if it processed the personal data itself.
- The vendor has direct duties too. A data intermediary must make reasonable security arrangements (the protection obligation in section 24) and must not keep personal data longer than needed (the retention limitation obligation in section 25). It must also tell your company without undue delay if it has reason to believe a data breach has occurred.
- Your company handles notification. Once told, your company must assess whether the breach is notifiable. If it is, the PDPC must be notified as soon as practicable and no later than 3 calendar days after that assessment, and affected individuals must usually be told where significant harm is likely.
The PDPC asks whether the vendor protected the data and whether your company exercised reasonable oversight of it. Either, or both, can be found in breach. Financial penalties can reach S$1 million, or 10% of annual Singapore turnover for organisations with turnover above S$10 million.
What happened in real vendor breaches in Singapore?
Fullerton Healthcare and Agape (PDPC, 2023)
Fullerton Healthcare Group engaged Agape CP Holdings, a social enterprise providing outsourced call centre services, and shared customer data with it. Agape stored the data on an internet-facing online drive whose password protection had been disabled for an estimated 20 months. According to the PDPC’s published decision, the personal data of 156,900 Fullerton customers was affected, and data was offered for sale on the dark web.
The PDPC found both parties in breach of the protection obligation. It noted that Fullerton had carried out a high-level IT due diligence review before onboarding Agape and that its contract required PDPA compliance, but found Fullerton had not exercised reasonable oversight of how Agape actually stored and accessed the data. Fullerton had also given the vendor more personal data than the service needed. Fullerton was ordered to pay S$58,000 and Agape S$10,000, and both were directed to review their vendor processes.
The lesson for directors: a signed contract with a PDPA clause is a starting point, not a defence.
Times Software and its payroll clients (PDPC, 2020)
Times Software provided payroll software and services. Employee data belonging to its clients, including salary and bank account information, became publicly accessible from one of its file servers and was found through a search engine. The PDPC found Times in breach of both the protection and retention limitation obligations, partly because it had used live customer data for testing and kept it after the purpose ended. Times was ordered to pay S$20,000. Two organisations in the chain were given warnings, and two end clients were found not to be in breach. The decision shows that the PDPC examines each organisation’s own conduct and paperwork separately.
Singtel and the Accellion file-sharing system (2021)
In February 2021, Singtel announced that personal information of about 129,000 customers, including NRIC numbers, had been stolen through a breach of a third-party file-sharing system supplied by Accellion, as reported by Reuters and other outlets. Information belonging to 23 enterprises, including suppliers, partners and corporate customers, was also taken. The same legacy system was compromised at organisations worldwide. Even a large company with its own security team can be exposed through one ageing vendor tool, and it is the customer-facing company that handles the notifications and public questions.
Can your company claim its losses back from the vendor?
Possibly, but the PDPA does not decide that. Your recovery depends on the contract and the general law.
- Read the security and data protection clauses. Did the vendor promise specific controls, certifications, encryption or breach notification timelines? A clear breach of an express promise is the strongest basis for a claim. Our guide to breach of contract damages in Singapore explains what losses are recoverable.
- Check the liability cap and exclusions. Many IT and cloud contracts cap the vendor’s liability at the fees paid over a recent period, and exclude indirect loss, lost profits and data loss. A breach costing your company several hundred thousand dollars may meet a cap of one year’s subscription fees.
- Test whether the cap is enforceable. Where the vendor contracted on its written standard terms, the Unfair Contract Terms Act 1977 may require the cap or exclusion to be reasonable. Our article on whether an exclusion clause will survive the Unfair Contract Terms Act covers how the courts approach this.
- Look for an indemnity. A data protection indemnity, sometimes outside the general cap or subject to a higher super-cap, can cover regulatory investigation costs, notification costs and third-party claims. See our explainer on how indemnity clauses and caps work.
- Act within time. Contract and tort claims generally must be brought within 6 years under the Limitation Act 1959, and notice clauses in the contract may impose much shorter deadlines.
Do not assume a PDPC penalty imposed on your company can be passed to the vendor under an indemnity; that raises legal and public policy questions.
Who pays which cost after a vendor breach?
| Cost or exposure | Who usually bears it first | Possible recovery or cover |
|---|---|---|
| Forensic investigation of the vendor’s systems | Vendor, though your company may need its own adviser | Your own investigation costs may fall under your cyber policy’s incident response cover |
| Notifying customers or employees, call centre, credit monitoring | Your company, as the organisation responsible under the PDPA | Contract indemnity from the vendor; notification cost cover in many cyber policies |
| PDPC investigation and any penalty on your company | Your company | Defence costs may be covered by some cyber policies; penalties only where lawfully insurable and within the wording |
| Claims by individuals for loss caused by the breach | Your company and possibly the vendor | Privacy liability section of a cyber policy; contribution from the vendor |
| Lost revenue while the vendor’s service is down | Your company | Dependent or contingent business interruption cover, if included; contract service credits, usually small |
| Vendor’s own liability to you | Vendor | Vendor’s professional indemnity (technology errors and omissions) or cyber cover, up to its limits |
How do your insurance and the vendor’s insurance respond?
Your own cyber policy is designed to pay your company’s response costs and defend claims against you. Whether it responds to an incident on a vendor’s system depends on the wording. Many policies cover a breach of personal data in your care, custody or control, and some expressly extend this to data held by your service providers. Others limit the business interruption section to outages of your own network unless dependent business interruption is added, often with a lower sub-limit and a longer waiting period. Our sibling guide on cyber insurance for Singapore SMEs explains these sections in more detail.
The vendor’s professional indemnity or technology errors and omissions policy protects the vendor, not you. It may fund the vendor’s defence and any damages it is legally liable to pay you, but it will not pay more than the vendor’s contractual and legal liability. If the contract caps the vendor’s liability at a low figure, its insurance follows that cap.
Points that commonly catch companies out:
- Prompt notification. Policies usually require notice as soon as practicable. Delay can prejudice a claim.
- No admissions or settlements without consent. Agreeing compensation with customers or the vendor before speaking to your insurer can jeopardise cover.
- Waivers of subrogation. After paying you, your insurer may want to pursue the vendor. If your contract waived claims against the vendor, your insurer may have reduced rights and may reduce what it pays.
- Exclusions. Common exclusions include known prior incidents and failure to maintain stated security measures. Check your own wording.
Insurance never removes your company’s legal responsibility under the PDPA. It may help fund the response, within limits, deductibles and conditions.
What should you check before signing an IT or outsourcing contract?
The PDPC’s decisions reward organisations that can show what they did before an incident. This checklist helps:
- Map what personal data the vendor will receive, and send only what the service needs.
- Ask for evidence of security, such as recent assessments or recognised certifications, and record your review.
- Include clear data protection clauses: security standards, access controls, retention and deletion, sub-processors, audit rights and breach notice to you within a fixed number of hours.
- Negotiate the liability cap for data breaches separately from the general cap, and decide whether an indemnity is appropriate.
- Ask the vendor for its certificate of insurance showing professional indemnity or cyber cover, and diarise renewal.
- Review the vendor at least annually: who has access, where the data is stored, and whether old data has been deleted.
- Have your data protection officer keep the file. Our guide to the data protection officer’s role under the PDPA sets out what that person should own.
For payroll in particular, where salary, NRIC and bank details are involved, our article on PDPA obligations for HR and payroll data covers the employee-side issues.
Example: an outsourced marketing platform leaks a customer list
Example: A Singapore retailer with turnover of about S$6 million uses an overseas email marketing platform on the platform’s standard online terms. An attacker uses a stolen administrator password at the platform and downloads the customer lists of many clients, including 40,000 of the retailer’s customers’ names, mobile numbers and birthdays.
- The platform emails the retailer two days after discovering the incident. The retailer assesses that the breach is notifiable because of the number of individuals affected and notifies the PDPC within 3 calendar days of that assessment.
- The retailer notifies its cyber insurer the same day. The insurer appoints a breach coach and pays for customer notifications, subject to the deductible.
- The platform’s terms cap its liability at fees paid in the previous 12 months, roughly S$9,000, and exclude all data loss. The retailer’s lawyer considers whether that cap is reasonable under the Unfair Contract Terms Act.
- The PDPC asks the retailer what due diligence it did and whether it limited the data shared. The retailer had uploaded birthdays and purchase histories it did not need for email campaigns, which weakens its position.
The retailer’s real protection was its own cyber policy and documentation, not the vendor contract.
Frequently asked questions
Is a cloud provider always a data intermediary?
Usually, where it processes personal data on your behalf under your instructions. If the provider uses the data for its own purposes, it may be an organisation in its own right for those purposes. The analysis depends on the facts and the contract.
Should we wait for the vendor’s investigation before notifying the PDPC?
No. The 3-day period runs from your own assessment that the breach is notifiable, and you must carry out that assessment expeditiously. You can update the PDPC as the vendor’s findings come in. The response steps are covered in our guide to the first 72 hours after a ransomware attack.
Can individuals sue our company for a vendor’s breach?
The PDPA gives individuals who suffer loss or damage directly as a result of certain contraventions a right of private action in civil proceedings. Your company may then seek contribution or indemnity from the vendor, subject to the contract.
Does the vendor’s insurance protect our company?
Not directly. It protects the vendor against its own legal liability to you, up to its limits and the contract cap. Before signing, check whether your own cyber policy would fill any gap the cap leaves.
Official sources: Personal Data Protection Act 2012; PDPC decision on Fullerton Healthcare Group and Agape CP Holdings [2023] SGPDPC 5; PDPC decision on Times Software and others [2020] SGPDPC 18; PDPC Guide to Managing Data Intermediaries; PDPC Guide on Data Protection Clauses for Agreements; Unfair Contract Terms Act 1977.
Cyber or professional indemnity cover itself should be arranged through a licensed insurer or insurance broker, who can explain how a particular policy wording treats vendor incidents.
Need help with a data breach at your IT vendor?
If your company, or you as a director or shareholder, is dealing with a data breach at an IT vendor, cloud provider or outsourced service provider, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, for example if a claim is made against your company, you need to pursue the vendor or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles data protection and technology contract disputes. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.
The Raffles Corporate Services Editorial Team, Raffles Corporate Services