PDPC Investigation Into Your Company: The Process, Financial Penalties and Appeals

Short answer: The PDPC can investigate a company after a complaint, a breach notification or on its own motion under section 50 of the PDPA. It can compel documents, accept a voluntary undertaking, issue directions and impose a penalty of up to S$1 million, or 10% of Singapore turnover above S$10 million. Decisions can be reconsidered or appealed within 28 days.

A PDPC investigation is the formal inquiry the Personal Data Protection Commission (PDPC) runs to decide whether an organisation has breached the Personal Data Protection Act 2012 (PDPA). For most companies it starts with a letter or email from the PDPC asking for documents about a complaint or a data breach. What the company does in the first few weeks shapes the route, the duration and whether a penalty follows. This guide covers the process, the PDPC’s powers, the penalty caps and the routes of challenge.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

What is a PDPC investigation and what triggers one?

A PDPC investigation is a statutory inquiry under section 50 of the PDPA into whether an organisation is complying with the Act, including any voluntary undertaking it has given. The PDPC may start one “upon complaint or of its own motion”.

Cases usually start in one of three ways:

• A complaint, for example about personal data disclosed without consent or a refused access request.
• A breach notification made by the company itself under Part 6A of the PDPA. The notification duty is covered in our guide to mandatory data breach notification under the PDPA.
• The PDPC’s own motion, for example after a media report or a referral.

Not every complaint becomes a full investigation. The PDPC’s Guide on Active Enforcement (revised 1 October 2022) says it will first try to facilitate a resolution between the complainant and the organisation, and section 48G lets it refer a complaint to mediation. Section 50(3) allows it to suspend, discontinue or refuse an investigation, for example where the parties have settled or the complaint is frivolous. High-impact incidents, such as those affecting many individuals or involving data likely to cause significant harm, go straight to full investigation.

What powers does the PDPC have during a PDPC investigation?

The PDPC and its inspectors can compel documents, information and attendance, examine people orally, and enter premises. These powers are set out in the Ninth Schedule to the PDPA.

Ignoring these powers is a separate problem. Under section 51(3), it is an offence to obstruct the PDPC, to neglect or refuse without reasonable excuse to provide information or documents, or to give information the organisation knows or ought to know is false or misleading. A company faces a fine of up to S$100,000 for obstruction or false information (section 51(5)), and up to S$10,000 for failing to provide information or attend (section 51(6)).

How does a PDPC investigation unfold, step by step?

Most cases move from intake to fact-gathering, a choice of route, a preliminary decision, representations and a final decision.

1. Intake and triage. The PDPC checks whether personal data is involved, then facilitates or mediates, refers the matter to another regulator, or passes it to its investigations team.
2. Fact-gathering. The company receives notices to produce documents and information. Interviews, written statements and site visits may follow.
3. Choice of route. Early on, the company may ask for a voluntary undertaking or the expedited decision procedure (see below).
4. Preliminary decision. Where a breach is found, the PDPC issues a preliminary decision setting out proposed directions and any proposed penalty. Where a penalty is proposed, at least 14 days must be allowed for representations (section 48K(2)).
5. Representations. The company may respond in writing with supporting documents; extensions need exceptional circumstances (section 48K(3)).
6. Final decision. The PDPC serves its decision. A direction or penalty takes effect only when the notice is served (section 48K(7)). Any penalty must be payable on a date at least 28 days after the notice is issued (section 48K(8)), and the PDPC may allow more time or instalments (section 48K(9)).
7. Publication. The PDPC may publish the direction, penalty notice or a summary on its website (regulation 18, Enforcement Regulations); past outcomes appear on its enforcement decisions page.

Possible outcomes are: suspension or discontinuation (sometimes with an advisory notice, which is not a breach finding), a voluntary undertaking, or a breach finding with a warning, directions, a financial penalty, or directions and a penalty.

Voluntary undertaking or expedited decision: which route fits?

A voluntary undertaking suits a company with good accountability practices and a ready remediation plan, and it is not an admission of breach. The expedited decision procedure suits a company prepared to admit liability early in exchange for a faster decision. Both must be requested in writing soon after the incident is known.

The same chart shows discontinuations closing within about 3 months and full investigations taking about 6 to 18 months. Acceptance of either route is at the PDPC’s discretion.

What directions and financial penalties can the PDPC impose?

The PDPC can direct a company to fix its non-compliance under section 48I, and can impose a financial penalty under section 48J where the breach was intentional or negligent. The PDPC’s stated policy is to consider first whether directions alone are effective.

Directions may require the company to stop collecting, using or disclosing personal data in breach of the Act, or to destroy data collected in breach (section 48I(2)).

The penalty caps are:

Annual turnover in Singapore is taken from the organisation’s most recent audited accounts available when the penalty is imposed (section 48J(5A)).

Section 48J(6) lists the factors the PDPC must weigh, including the gravity and duration of the breach, the type of data affected, any financial benefit, the timeliness of mitigation, existing compliance measures, previous breaches, proportionality and the impact of the penalty on the business.

If a company ignores a direction or does not pay, the PDPC can register the direction or penalty notice in a District Court, after which it is enforceable as a court order regardless of the amount (section 48M).

How do you challenge a PDPC decision: reconsideration, Appeal Committee and High Court?

There are three levels: a reconsideration by the PDPC itself, an appeal to a Data Protection Appeal Committee, and a further appeal to the General Division of the High Court on a point of law or the amount of a penalty. Each has a 28-day deadline.

• Reconsideration and appeal do not run in parallel. If a reconsideration application is made, any appeal on the same decision is deemed withdrawn (section 48Q(3)). The reconsideration decision can then be appealed (section 48Q(1)(c)).
• Penalties are suspended; directions usually are not. A reconsideration or appeal against a financial penalty suspends it. A challenge to a direction does not suspend the direction unless the PDPC or Appeal Committee decides otherwise (sections 48N(3) and 48Q(4)).
• Grounds must be stated up front. An appellant cannot rely on a ground not in the Notice of Appeal without permission to amend (regulation 3(3), Appeal Regulations).
• Representation. Before an Appeal Committee, a party may be represented by an advocate and solicitor with a practising certificate, or by another person the Committee allows (regulation 19). Any appeal to the High Court is court litigation and is conducted by a Singapore Advocate and Solicitor.

Can affected individuals sue the company separately?

Yes. Section 48O gives a person who suffers loss or damage directly as a result of certain PDPA breaches a right to bring civil proceedings in court. The court may grant an injunction, a declaration, damages or other relief.

The right covers breaches of Parts 4, 5, 6, 6A and 6B of the Act, which include the rules on consent and purpose, access and correction, care of personal data and breach notification, as well as certain Do Not Call provisions. Where the PDPC has made a decision on the same contravention, the claimant must wait until that decision is final with no further right of appeal (section 48O(2)). Anyone facing or considering such a claim should speak to a lawyer.

What should the company and its DPO prepare?

Prepare a complete, accurate record of the incident and your data protection framework before the PDPC asks for it. The Data Protection Officer (DPO), the individual designated under section 11(3) of the PDPA, is usually the PDPC’s point of contact and coordinates the response. See our guide to the Data Protection Officer role.

A Data Protection Management Programme built before an incident makes most of this available on short notice. For misdirected emails, see our note on assessing a wrong-attachment data breach.

The company secretary or corporate service provider prepares board resolutions authorising the response, undertaking or appeal, keeps minutes and registers in order, keeps the audited accounts current and maintains the investigation file (section 50(4)). Admissions, representations, the Notice of Appeal and any High Court appeal are matters for a Singapore Advocate and Solicitor. Raffles Corporate Services’ DPO packages are listed on our packages page, from S$1,800 a year for DPO Essentials, which includes acting as the point of contact for PDPC formal correspondence. Our free tools track other compliance deadlines.

What are the common mistakes in a PDPC investigation?

Most avoidable harm comes from slow or incomplete responses.

• Missing the deadline in a notice to produce, or answering selectively. Refusing without reasonable excuse can be an offence under section 51(3)(ba).
• Asking for a voluntary undertaking without a finished remediation plan. The PDPC’s guide says no extra time will be given to prepare one.
• Choosing the expedited procedure without accepting that it requires a formal admission of liability and ends in a published decision.
• Letting the 28-day window lapse, or filing a reconsideration and assuming an appeal is still pending on the same decision.
• Assuming an appeal pauses a direction. Only penalties are automatically suspended.
• Deleting or altering records after the PDPC is involved. Records must be kept for one year after the investigation ends.

Frequently asked questions

Does a PDPC investigation mean my company will be fined?

No. Cases can be discontinued, mediated, or closed with an advisory notice, a warning or directions only. A financial penalty under section 48J requires an intentional or negligent breach, and the PDPC first considers whether directions alone would be effective.

Is the 10% turnover cap based on worldwide revenue?

No. Section 48J(3)(a) refers to annual turnover in Singapore, and only where it exceeds S$10 million. It is taken from the most recent audited accounts available when the penalty is imposed. For any other organisation the cap is S$1 million.

Will the PDPC publish my company’s name?

It may. The Enforcement Regulations allow the PDPC to publish directions, penalty notices and voluntary undertakings, or summaries of them. The PDPC’s guide says final decisions and undertakings are published, with confidential details redacted at its discretion.

Does the investigation stop if the complainant sues us?

It may. Section 50(3)(c) allows the PDPC to suspend, discontinue or refuse to conduct an investigation where a party has commenced legal proceedings about the alleged contravention. This is a discretion, not an automatic stop.

Last reviewed: 28 October 2026. The Editorial Team, Raffles Corporate Services.