In today’s digital economy, personal data has become on of the most valuable assets for organisations. Whether through customer information, employee records, supplier details or marketing databases, organisations routinely collect, use and store information as part of their operations.
With increasing public awareness of data privacy and the growing risk of cyber incidents, organisations must ensure that personal data is handled responsibly and in compliance with Singapore's Personal Data Protection Act (PDPA).
The Personal Data Protection Act (PDPA) is Singapore's primary legislation governing the collection, use, disclosure and protection of personal data by private-sector organisations.
Administered by the Personal Data Protection Commission (PDPC), the legislation seeks to strike a balance between an individual's right to protect their personal data and an organisation's legitimate need to use that information for business purposes.
The PDPA applies regardless of an organisation's size or industry. Personal data includes any information that can identify an individual, either on its own or when combined with other available information. This may include names, identification numbers, contact details, photographs, email addresses, employment records and other information commonly processed during the course of business.
While many organisations associate the PDPA primarily with privacy notices or obtaining consent, the legislation is considerably broader. It requires organisations to be accountable for the personal data they hold and to implement appropriate policies, processes and security measures throughout the data lifecycle.
One of the most common misconceptions is that PDPA compliance can be achieved simply by preparing a privacy policy or updating contractual documentation. In reality, compliance depends on how personal data is managed on a day-to-day basis.
Many data protection issues arise not because organisations intentionally disregard their obligations, but because internal processes have not kept pace with business growth. Customer information may be retained longer than necessary, former employees may continue to have access to internal systems, or personal data may be shared without adequate safeguards. Individually these issues may appear minor, but together they can expose an organisation to unnecessary regulatory and reputational risk.
Developing a strong data protection framework therefore requires more than documentation alone. Organisations should establish clear policies governing the collection, use, retention and disposal of personal data, ensure access is limited to authorised personnel, regularly train employees on their responsibilities and periodically review whether existing controls remain appropriate as the business evolves. Equally important is having a documented process for identifying, investigating and responding to potential data breaches should they occur.
Embedding these practices into everyday operations not only supports compliance with the PDPA but also strengthens overall governance and demonstrates accountability to customers, employees and regulators.
A key requirement under the PDPA is that every organisation must designate at least one individual to act as its Data Protection Officer (DPO). The DPO may be an existing employee, a member of senior management or an external service provider, but responsibility for compliance ultimately remains with the organisation itself.
The DPO serves as the central point of accountability for data protection matters. Depending on the organisation, the role typically includes developing and maintaining internal policies, advising management on compliance obligations, coordinating employee training, monitoring data protection risks, responding to enquiries relating to personal data and acting as the primary point of contact with the PDPC where necessary.
In the event of a data breach, the DPO plays a critical role in coordinating the organisation’s response and ensuring compliance with the PDPA. The DPO works closely with internal stakeholders to investigate the incident, contain further unauthorised access, assess the impact on affected individuals, and determine whether the breach meets the threshold for notification to the PDPC and affected parties.
The appointment of a DPO should not be regarded merely as a regulatory requirement. An effective DPO helps organisations establish practical governance procedures, identify potential compliance gaps before they become larger issues and promote a culture in which data protection is considered as part of everyday business decision-making.
For many SMEs, appointing a dedicated internal DPO is not always practical. Outsourcing the function allows organisations to access specialist expertise while ensuring the role receives the necessary attention and remains aligned with evolving regulatory expectations.
One of Singapore's most widely publicised PDPA enforcement cases involved RedMart, the online grocery platform owned by Lazada. The incident illustrates why data protection extends far beyond appointing a DPO or maintaining written policies.
In 2020, RedMart experienced a cybersecurity incident that resulted in the personal data of approximately 898,000 customers being compromised. The information exposed included customers' names, email addresses, telephone numbers, encrypted passwords and partial payment card details.
Following its investigation, the PDPC concluded that the breach resulted from weaknesses in the company's security arrangements. Attackers were able to obtain unauthorised access through compromised credentials and exploit vulnerabilities within RedMart's cloud infrastructure. The Commission found that the organisation had failed to implement reasonable security arrangements to protect personal data, as required under the Protection Obligation of the PDPA, and imposed a financial penalty of S$72,000.
The case demonstrates that to comply with the PDPA, organisations must continuously assess whether their technical and organisational safeguards remain appropriate in light of evolving risks. Strong access controls, secure system configurations, multi-factor authentication and regular vulnerability assessments all play an important role in protecting personal data. Employee awareness and cybersecurity training are equally important, as compromised user credentials are often the starting point for cyberattacks.
While no organisation can entirely eliminate the risk of cyber incidents, a robust data protection framework significantly improves an organisation's ability to respond effectively and demonstrate accountability when issues arise.
Data protection is no longer solely an IT or legal concern—it is an organisation-wide responsibility. Businesses that establish clear governance frameworks, regularly review their internal practices and embed data protection into their day-to-day operations are generally better positioned to manage risk while strengthening confidence among customers, employees and business partners.
Whether appointing an internal DPO or engaging an external provider, organisations should ensure that the role is adequately supported and integrated into their broader governance framework. A proactive approach not only helps meet the requirements of the PDPA but also contributes to more resilient and sustainable business operations.
Fidinam Singapore assists organisations with outsourced Data Protection Officer services, PDPA compliance reviews, policy drafting and ongoing advisory support. By helping businesses develop practical and proportionate compliance frameworks, we enable them to meet their regulatory obligations while supporting their long-term operational objectives.
For more information about our PDPA and DPO services, please contact us at info@fidinamgw.com or via the form below.