In this guide · 8 sections
- 01What is the maximum PDPA fine?
- 02Beyond fines: what else PDPC can order
- 03How PDPC decides the amount: harm and culpability
- 04What published decisions involving smaller firms show
- 05How to lower your risk of a PDPA fine
- 06If a breach happens: steps that count in your favour
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
The maximum PDPA financial penalty is S$1 million or 10% of annual turnover in Singapore (for organisations with Singapore turnover above S$10 million), whichever is higher. PDPC sets the actual amount by weighing harm and culpability, and has reduced penalties for small firms that could not pay.
What is the maximum PDPA fine?
Section 48J of the Personal Data Protection Act 2012 gives the PDPC power to impose financial penalties. PDPC's Advisory Guidelines on Enforcement of the Data Protection Provisions (revised 1 October 2022) summarise the limits:
| Type of breach | Maximum financial penalty |
|---|---|
| Data protection provisions (consent, purpose, access, protection, retention, transfer, breach notification), intentional or negligent | S$1 million, or 10% of annual turnover in Singapore if that turnover exceeds S$10 million, whichever is higher |
| Do Not Call: dictionary attacks and address-harvesting software (organisation) | S$1 million, or 5% of annual turnover in Singapore if that turnover exceeds S$20 million, whichever is higher |
| Other Do Not Call provisions | S$200,000 for an individual; S$1 million in other cases |
Turnover is taken from the organisation's most recent audited accounts available when the penalty is imposed. For a typical SME with Singapore turnover under S$10 million, the ceiling is therefore S$1 million. The ceiling is a maximum, not a starting point: PDPC calibrates each penalty on the facts, and has reduced penalties for very small businesses.
Beyond fines: what else PDPC can order
A financial penalty is only one outcome. Under section 48I, PDPC can direct an organisation to stop collecting, using or disclosing personal data in breach of the Act, destroy data collected in breach, provide access or correction, or fix its processes. Directions can be enforced through the District Court.
PDPC can also accept a voluntary undertaking instead of a full investigation. Its guidelines say this route is meant for organisations with good accountability practices and an effective remediation plan, and may include commitments such as improving cyber defences or running penetration tests. PDPC may not accept one where non-compliance is wilful or egregious, and may publish the undertaking.
Decisions and undertakings are usually published on PDPC's enforcement decisions page, with the organisation's name. For a small business, that publicity can cost more than the penalty.
How PDPC decides the amount: harm and culpability
PDPC's guidelines (paragraph 27.4) say it first assesses the incident on harm and culpability, then adjusts for other factors.
Factors that have reduced penalties
- Disclosure limited in scope or time
- Quick and effective remedial action
- Data protection policies and regular audits already in place
- Penalty would be a crushing burden on a very small business
Factors that have increased penalties
- Large number of people affected
- Sensitive data, such as medical or financial details
- Known weaknesses left unfixed for a long time
- Repeat incidents, or profiting from selling personal data
The section 48J factors also include whether the organisation gained a financial benefit, whether it complied with any earlier directions, and whether the penalty is proportionate and effective as a deterrent.
What published decisions involving smaller firms show
PDPC's enforcement guidelines illustrate each factor with past decisions. The examples below involve smaller organisations or SME-relevant facts. Each is described as PDPC summarises it; read the full decision for details.
| Decision | What PDPC noted |
|---|---|
| Option Gift Pte Ltd [2019] SGPDPC 10 | A coding error disclosed up to 426 people's logins, emails, addresses and mobile numbers; the number and type of data led to a lower penalty |
| Ninja Logistics Pte Ltd [2019] SGPDPC 39 | The organisation knew of the risk on its tracking page but did not fix it for more than 2 years; treated as aggravating |
| DS Human Resource Pte. Ltd. [2019] SGPDPC 16 | Penalty maintained despite SME digitalisation efforts: good data protection is expected from the start of digitalising |
| O2 Advertising Pte. Ltd. [2019] SGPDPC 32 | Penalty reduced after the business showed dire financial circumstances |
| Advance Home Tutors [2019] SGPDPC 35 | Penalty reduced to avoid a crushing burden on a small home business |
| Propnex Realty Pte Ltd [2017] SGPDPC 1 | A data protection policy known to staff and regular internal audits were considered in setting the penalty |
The pattern is consistent: PDPC looks at whether you had reasonable safeguards and acted quickly, not whether a breach happened at all. In its guidelines, a long-unchanged password and a vulnerability left open for years were both treated as aggravating in other decisions. More recent cases, including AI-related ones, are covered in our guide to lessons from PDPC's first AI-assisted data breach case.
How to lower your risk of a PDPA fine
The controls PDPC credits are mostly cheap for a small business. Work through these, oldest gaps first.
PDPA risk reduction checklist
Our PDPA checklist for small businesses explains each obligation, and our guide to appointing a Data Protection Officer covers the first step.
If a breach happens: steps that count in your favour
Contain it immediately
Lock the affected account, take the exposed page offline or revoke the shared link. Speed of remediation has been treated as mitigating.
Assess whether it is notifiable
A breach is notifiable if it is likely to cause significant harm or affects 500 or more people. Our breach notification guide walks through the test.
Notify PDPC within 3 calendar days if required
Once you have assessed it as notifiable, notify PDPC as soon as practicable and within 3 calendar days, and tell affected individuals where required.
Keep records of what you did and when
A written timeline shows PDPC how quickly and carefully you acted.
Fix the root cause
Close the gap, train staff and update your policy so the same thing cannot happen again.
Do it yourself or get help?
A small business can put the basics in place itself using PDPC's free guides. The common gap is documentation: a DPO, a policy, a data inventory and a breach plan that exist on paper and are actually used.
The PDPA Compliance Pack (S$690) prepares your privacy policy, data inventory, staff data protection policy, DPO notes and a breach response plan with notification checklist. A Security Health Check (S$290) reviews your email, website and workspace settings for the weaknesses that feature in PDPC decisions.
Frequently asked questions
For breaches of the data protection provisions, the PDPC can impose a financial penalty of up to S$1 million, or up to 10% of the organisation's annual turnover in Singapore where that turnover exceeds S$10 million, whichever is higher. The figures are set out in section 48J of the PDPA and PDPC's enforcement guidelines.
Yes. PDPC's published decisions include small companies and home businesses. PDPC calibrates each penalty on the facts and has reduced penalties where a small business showed it could not pay. It has also stated that SMEs are expected to adopt good data protection practices from the start of digitalising.
PDPC first assesses harm, such as the number of people affected, the type of data and how long the incident lasted, and culpability, meaning the organisation's conduct and overall compliance. It then adjusts for factors such as remedial action, previous breaches, financial benefit gained and the impact of the penalty on the business.
Notification is a legal duty for notifiable breaches, not a way to avoid a penalty, but prompt and effective action has been treated as a mitigating factor. PDPC may also accept a voluntary undertaking instead of investigating where an organisation has good accountability practices and a credible remediation plan.
For most Do Not Call breaches, PDPC can impose a financial penalty of up to S$200,000 on an individual and up to S$1 million in other cases. Using dictionary attacks or address-harvesting software can lead to a penalty of up to S$1 million or 5% of Singapore turnover above S$20 million, whichever is higher.