Data & Privacy

Your Company's data protection officer (DPO) oversees that personal data is processed in accordance with data protection regulations. This includes personal information about your employees, customers, suppliers, and anybody else with whom you do business.

Yes. A Company can be penalized merely for failing to designate a data protection officer and implement safeguards to secure the data of its employees and customers. All Singapore businesses, irrespective of their size, require a Data Protection Officer (DPO). The designated DPO should have the necessary skills and knowledge to ensure that the business remains compliant with the PDPA regulation and create a procedure for receiving and responding to complaints about the PDPA's application.

A DPO might be anyone in your organization. You can even designate a team of employees to serve as the company's DPO. Your DPO does not require and or have to be a Singaporean or a permanent resident, but they must be reachable anytime a member of the public contacts them. If you lack manpower, you might outsource it to a third-party service provider.

There is no time limit set upon Singapore businesses for registering or nominating DPO. PDPC, on the other hand, highly advises organizations to register their DPO as early as possible so that they may be kept up to date on important personal data protection developments in Singapore. ‌‌‌‌

Companies that fail to meet their responsibilities under the PDPA may incur a financial penalty of up to S$1 million. PDPC has previously imposed financial fines on a number of high-profile corporations, including Singtel, SPH Magazines, and Royal Caribbean Cruises, for breaching the PDPA. So far, the typical range of financial penalties has been from high four-figure sums to low five-figure sums.
Up to this point, many of these monetary fines have been imposed in response to cybersecurity breaches that resulted in unauthorized access to and exposure of people's personal data.