Introduction to the PDPC and PDPA Breaches
The Personal Data Protection Commission (PDPC) in Singapore plays a vital role in enforcing the Personal Data Protection Act (PDPA), which ensures that all organisations abide by data protection rules and safeguard personal information. Recent PDPC decisions have highlighted several breaches, providing key insights into the most common data protection issues Singapore businesses face. This not only serves to hold organisations accountable but also provide valuable insight for companies on how to best comply with the PDPA.
Most Common Types of PDPA Breaches
- Unauthorised access to personal data is the most frequent type of PDPA breach, often stemming from poor security practices. Organisations may fail to implement strong access controls or provide inadequate training for employees handling sensitive data.
Most recently, on 29 November 2024, the HMI Institution of Science faced a financial penalty for failing to secure personal data of former students. Keppel telecommunications & Transportation also received a S$120,000 fine for inadequate protection of personal data belonging to employees, ex-employees and shareholders, on 2 August 2024. - Improper data handling in development environments has also recently made up a significant number of breaches. This could have been caused by usage of live data in non-secure environments, increasing risk of unintentional data leaks. For example, on 28 August 2024, the Consumers’ Association of Singapore was fined S$20,000 for mishandling personal data and failing to implement necessary internal policies.
- Insufficient data minimization, which refers to collecting and retaining more personal data than necessary, has increased the number of breaches.
- Recently, companies have often failed to prompt identify, contain, and report data breaches. Notably, Tok Leng Leng t/a Top Mobile Gallery was fined S$7,000 for unauthorized access to customers’ personal data for SIM registrations on 4 July 2024, demonstrating this.
- Lack of employee awareness due to insufficient training can result in accidental breaches. Recently, The Academy of Medicine Singapore was fined for failing to protect the personal data of its members.
What Should Companies Do to Prevent PDPA Breaches?
Given the recurring nature of these violations, companies must take proactive steps to avoid data breaches and ensure compliance within the PDPA.
- Organisations should implement comprehensive data protection policies that cover data collection, usage, storage, and disposal of data. These policies should clearly align with the PDPA.
- Companies must conduct regular risk assessments to identify vulnerabilities in data protection processes, allowing businesses to address potential issues before they lead to a breach.
- Also, establishing strong access controls like enforcing strong password policies and requiring multi-factor authentication will enhance data security.
- Encryption of sensitive data ensures that even if data is intercepted or accessed without authorisation, it remains unreadable.
- Provide regular employee training.
- Develop a data breach response plan to include steps for identifying, containing and mitigating the breach.
Conclusion
Overall, the most common breaches involve unauthorized access, improper data handling, insufficient data minimization, and poor responses to breaches. By implementing the aforementioned measures, companies can mitigate the risk of data breaches and ensure compliance with the PDPA.
How Our Panel of Lawyers Can Assist
- Compliance advisory on legal obligations under the PDPA and help on ensuring data protection practices are in line with current regulations.
- Risk Assessment and Audits to identify vulnerabilities in your data protection processes and recommend solutions.
- Offering tailored training to educate your employees on best practices for data protection and breach prevention.
