Penalties for data breaches should hit firms harder in the pocket

THE recent data breaches at Lazada and Eatigo, as well as privacy lapses at other tech firms in Singapore, affirm the need for stiffer financial penalties and regulation by the authorities.

Singapore's amended data protection law, passed in Parliament on Monday, gives the Personal Data Protection Commission (PDPC) the power to impose harsher fines and to hold organisations accountable. This will bring the city-state up to speed with other jurisdictions.

Under the key changes to the bill, a company that infringes the Personal Data Protection Act (PDPA) can be fined up to 10 per cent of its annual turnover in Singapore or S$1 million, whichever is higher. The current cap for financial penalties is S$1 million.