Big firms could face data breach fines of up to 10% of turnover from Oct 1

COMPANIES can be fined more heavily for data breaches from Oct 1 this year, following changes to Singapore's data protection laws that were passed in Parliament in November 2020.

Under the amendments to the Personal Data Protection Act (PDPA), the maximum financial penalty for data breaches will be raised to S$1 million or 10 per cent of local annual turnover for organisations whose turnover exceeds S$10 million, whichever is higher.

Currently, the maximum a company can be fined for a data breach is S$1 million.

The implementation of the new penalties was delayed due to economic uncertainties during the pandemic, but businesses now have sufficient lead time, Minister for Communications and Information Josephine Teo said in Parliament on Friday (Mar 4).

"Organisations must continue to take ownership and be held accountable, especially those that hold sizeable volumes of data," she said.

Singapore has also introduced rules that require organisations to report a data breach if it is likely to result in significant harm to affected individuals or is likely to affect 500 or more individuals.

A NEWSLETTER FOR YOU

Monday, 3.30 pm

Garage

The hottest news on all things startup and tech to kickstart your week.

Sign Up

This comes as cybersecurity risks mount amid rapid digitalisation. Last November, hospitality platform RedDoorz was found to have compromised the security of 5.9 million customer records in the largest data breach incident since the PDPA came into force.

Ransomware has also been on the rise in Singapore, affecting companies such as Tokio Marine Singapore and private eye clinic Eye & Retina Surgeons. The Cyber Security Agency of Singapore received reports of 68 such cases in the first half of 2021, already more than double the 31 cases in the first half of 2020.

Separately, to encourage small and medium enterprises to increase their standards of cybersecurity, the government will launch a Cyber Trustmark, Cyber Essentials Mark and Data Protection Essentials Programme.

"Obtaining trust marks will give businesses and their customers the confidence that certain cybersecurity and data protection standards have been met," said Minister-of-State for Communications and Information Tan Kiat How.

READ MORE: 

• Penalties for data breaches should hit firms harder in the pocket