On 2 November 2020, the Personal Data Protection (Amendment) Bill was passed in Parliament and set into motion the introduction of several key changes to the Personal Data Protection Act (“PDPA”). Coming into effect on 1 February 2021, some of the amendments to the PDPA included the increase of the cap for financial penalties for data protection breaches. In particular, the new Section 48J was introduced which stated that the financial penalty cap for data protection breaches for organisations was S$1 million.

Notwithstanding the increased maximum financial penalties under the PDPA following the 2021 amendments, it was intended thereafter for there to be further enhanced penalties. This, however, was delayed as a result of the uncertainties in the wake of the COVID-19 pandemic.

However, during the Committee of Supply 2022 debate on 4 March 2022, the Minister for Communications and Information, Ms. Josephine Teo, announced that the enhanced penalties under the PDPA will take effect from 1 October 2022. Accordingly, the table below sets out the changes:

		Financial Penalty Cap
No.	Contravention	Prior to 1 October 2022	On or after 1 October 2022
(a)	Contravention of Part 3, 4, 5, 6, 6A or 6B of the PDPA	S$1 million	(1)      up to 10% of an organization’s annual turnover in Singapore; or (2)      S$1 million, whichever is higher
(b)	Contravention of Part 9 of the PDPA	For individual: S$200,000 For organisation: S$1 million
(c)	Contravention of Section 48B(1) of the PDPA	For individual: S$200,000 For organisation: S$1 million	For individual: S$200,000 For organisation: (1)      up to 5% of an organization’s annual turnover in Singapore; or (2)      S$1 million, whichever is higher

 

This article seeks to briefly introduce the recent amendments to the Personal Data Protection Act in Singapore in a summarized and engaging manner and should not be construed as legal advice in any form or manner. For more information on this matter, please feel free to contact Ms Jennifer Chih and Ms Maria Chang.