A data breach can cost a Singapore company far more than the PDPC’s financial penalty. The Personal Data Protection Commission can impose up to S$1 million, or up to 10% of annual Singapore turnover where that turnover exceeds S$10 million. Published penalties have ranged from a few thousand dollars to S$750,000, with Marina Bay Sands fined S$315,000 in 2025. On top of any penalty sit forensic and legal bills, downtime, notifying customers, claims by individuals and business partners, and lost trust. Cyber insurance can pay many of these costs, but generally not a penalty that the law does not allow to be insured.
How much can the PDPC fine a company?
For breaches of the data protection obligations on or after 1 October 2022, section 48J of the Personal Data Protection Act 2012 (PDPA), read with the Personal Data Protection (Enforcement) Regulations 2021, sets the maximum financial penalty at:
- S$1 million for most organisations; or
- 10% of annual turnover in Singapore for organisations whose Singapore turnover exceeds S$10 million, measured from the most recent audited accounts when the penalty is imposed.
The cap is a ceiling, not a starting point. In its 2025 Marina Bay Sands decision, the PDPC described a five-step method: assess culpability and harm, set a starting figure, adjust for aggravating and mitigating factors, consider the impact of the penalty on the organisation’s ability to continue its usual activities, and make a final adjustment. The PDPC also confirmed that it takes Singapore turnover into account so that the penalty works as a deterrent, which means larger businesses should expect larger penalties for comparable failings. How investigations run, and how to seek reconsideration or appeal, is covered in our guide to a PDPC investigation into your company. This article looks at what the money actually adds up to.
What have real PDPC decisions cost companies?
The table summarises published PDPC decisions involving security breaches. Amounts are the final financial penalties stated by the PDPC or reported by mainstream media.
| Organisation and year of decision | What happened | Individuals affected | Financial penalty |
|---|---|---|---|
| Integrated Health Information Systems (IHiS) and SingHealth, 2019 | Advanced persistent threat attack on SingHealth’s patient database in 2018 | About 1.5 million patients (dispensed medicine data of about 160,000) | S$750,000 (IHiS) and S$250,000 (SingHealth) |
| Genki Sushi, 2019 | Ransomware on a payroll and attendance server | About 360 employees | S$16,000 |
| Commeasure (operator of RedDoorz), 2021 | A cloud access key left in an old mobile app was used to reach a customer database | About 5.9 million customer records | S$74,000 |
| CH Offshore, 2024 | Ransomware through VPN accounts; unpatched firewall and no multi-factor authentication | 5,906 people, including health and financial data of 1,425 seamen | S$18,000 (reduced from a proposed S$27,000) |
| Ezynetic, 2025 | Ransomware and exfiltration from a moneylending software system; weak administrator password | 190,589 people, data offered on the dark web | S$17,500 plus a direction to obtain Cyber Trust certification |
| Marina Bay Sands, 2025 | An API security setting was omitted during a software migration and not caught for six months | 665,495 loyalty members, data offered on the dark web | S$315,000 |
Two points stand out. First, the number of people affected does not decide the penalty on its own: Commeasure’s breach was far larger than CH Offshore’s, yet the penalties are much closer than the numbers suggest, reflecting the sensitivity of data, the nature of the failings and, since 2022, the higher cap and turnover. Second, the more recent decisions are being set against the higher post-2022 cap. In CH Offshore, the PDPC declined to compare its penalty with older cases decided before the cap was raised.
What do these cases teach about how penalties are set?
- Using a vendor does not move the responsibility. In announcing the SingHealth penalty, the PDPC said that organisations which delegate work to vendors must still take ultimate responsibility for the personal data they collect. SingHealth was penalised as the owner of the system even though IHiS ran it. Our article on who is liable when an IT vendor is hacked covers this in more depth.
- Being attacked by skilled hackers is not a defence. The PDPC recognised that SingHealth and IHiS faced a sophisticated, persistent attacker, and still imposed what were then its highest penalties.
- Spending heavily after the breach does not earn a discount. Ezynetic asked for a waiver or reduction because of its remediation spending, operational disruption and continuing losses. The PDPC refused, saying remediation is part of the protection obligation itself and that the losses were part of dealing with the aftermath. The invoices the company produced did not show that a S$17,500 penalty would affect its ability to continue in business.
- Admitting liability and notifying people helps. Voluntary admission of liability, cooperation and prompt remediation were mitigating factors in every case above. In Marina Bay Sands, the PDPC gave additional weight to the company notifying all affected individuals voluntarily, even though it said it was not legally required to.
- Basic controls carry the weight. Unpatched firewalls, missing multi-factor authentication, weak administrator passwords and an unchecked manual process all featured in the findings. These are the same controls cyber insurers ask about.
Is the PDPC penalty the biggest cost of a breach?
Often it is not. For small and medium-sized companies, the penalties in the table are frequently smaller than the combined cost of everything else. The categories below are the ones business owners should budget for. We do not quote figures, because they vary enormously with the size of the incident and the firms engaged.
| Cost | What drives it | Typically covered by cyber insurance? |
|---|---|---|
| Forensic investigation | Number of systems, whether data was exfiltrated, cooperation of IT vendors | Usually, subject to panel firm and consent conditions |
| Legal advice on notification and the PDPC process | Complexity, number of jurisdictions, regulator questions | Usually, including regulatory defence costs |
| System rebuild and data restoration | Quality of backups, age of systems | Often, but upgrades (betterment) may be excluded |
| Lost profit during downtime | How long the business cannot trade | If business interruption cover is bought, after a waiting period |
| Notifying individuals, call centres, monitoring services | Number of people, data types | Usually |
| PDPC financial penalty | Culpability, harm, turnover | Only where insurable by law; do not assume it is |
| Claims by individuals | Distress or financial loss shown | Usually, under privacy liability |
| Claims by business customers under contracts | Indemnities, liability caps, security warranties | Sometimes; contractual liability beyond legal liability may be excluded |
| Management time, lost customers, reputation | Publicity and customer trust | Rarely, beyond public relations costs |
What a cyber policy typically includes, and what it excludes, is explained in our guide to cyber insurance for Singapore SMEs.
Can affected individuals sue the company as well?
Yes. Section 48O of the PDPA gives a person who suffers loss or damage directly as a result of a contravention of certain PDPA obligations a right to sue in the civil courts. In Reed, Michael v Bellingham, Alex [2022] SGCA 60, the Court of Appeal held that emotional distress can amount to “loss or damage” for this purpose, while a mere loss of control over personal data does not. That widens the range of people who can bring a claim after a breach, although each claimant still has to prove their own loss.
Business customers and partners usually claim under contract instead. Data processing agreements, IT outsourcing contracts and supply contracts often contain security warranties, notice deadlines and indemnities. A letter of demand from a customer after a breach should be handled with care; our guide on responding to a lawyer’s letter of demand explains the first steps, and any insurer must normally be told before you respond or admit anything.
Example: what a mid-sized breach adds up to
Example: A Singapore tuition centre group with S$6 million turnover stores 12,000 student and parent records in a booking system. An attacker uses a former contractor’s account, which was never disabled, to download the database, and posts a sample online.
The group’s costs come from several directions at once. It pays a forensic firm, a lawyer to advise on notification, and its vendor to rebuild the booking system. It notifies the PDPC within 3 calendar days of determining the breach is notifiable, following the PDPA breach notification rules, emails every affected family and sets up a hotline. Enrolments drop for the next term. The PDPC investigates and finds the protection obligation breached because there was no process to remove leavers’ access; the group’s turnover is below S$10 million, so the cap is S$1 million, and its cooperation and admission are mitigating. Two parents file claims alleging distress. If the group had a cyber policy, most of the response costs, the defence of the parents’ claims and part of the lost income could be claimed, subject to the policy’s terms, deductible and limits. The penalty itself and the long-term loss of goodwill would most likely stay with the group.
Are directors personally exposed?
PDPC financial penalties are imposed on the organisation. Directors are still expected to oversee how the company manages risk, including cyber risk, and shareholders or a liquidator may look at the board’s conduct after a serious loss. Our article on directors’ cyber risk and personal liability explains the duties, and why directors and officers’ insurance and cyber insurance answer different questions.
Frequently asked questions
Will we still be penalised if the hackers were highly sophisticated?
Possibly. The question is whether the company had reasonable security arrangements. The PDPC penalised IHiS and SingHealth despite recognising that the attacker was skilled and persistent.
Does spending a lot on recovery reduce the penalty?
Not by itself. In Ezynetic, the PDPC treated remediation as part of the company’s existing obligation. Prompt remediation can still count in your favour as part of overall cooperation, as it did for Marina Bay Sands.
Does notifying affected people voluntarily help?
It can. The PDPC gave extra mitigating weight in Marina Bay Sands because all affected individuals were told, even though notification to them was not legally required in that case.
Can a cyber policy pay the PDPC penalty?
Policies usually cover penalties only “where insurable by law”, and whether a PDPA penalty can lawfully be indemnified is a legal question. Budget for the penalty yourself and treat any recovery as a bonus.
Can an individual sue us even if the PDPC has not penalised us?
Yes. A complaint to the PDPC and a private action under section 48O are separate routes. However, where the PDPC has already made a decision on the contravention, a court claim generally cannot be brought until that decision has become final, after any appeal. Take legal advice on timing if you receive a claim.
Official sources: PDPC decision, Marina Bay Sands [2025] SGPDPC 6; PDPC media release on IHiS and SingHealth; PDPC decision, Ezynetic [2025] SGPDPCS 2; PDPC decision, CH Offshore [2024] SGPDPC 2; PDPC Advisory Guidelines on Enforcement; Personal Data Protection Act 2012.
Cyber insurance itself should be arranged through a licensed insurer or insurance broker.
Need help with a data breach investigation or claim?
If your company, or you as a director or shareholder, is dealing with a data breach, a PDPC investigation or a claim from an individual or customer whose data was exposed, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, for example if a claim is made against your company or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles data protection and regulatory matters. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.
The Raffles Corporate Services Editorial Team, Raffles Corporate Services