As a mobile app and website development company, a common question that potential clients in Singapore ask us is in relation to the Personal Data Protection Act (PDPA).

If they build a mobile app or website that collects Personal Data of their clients, how can they “ensure” that they are in compliance with the PDPA?

To get more precise guidance on what companies should do to adhere to the PDPA, it is useful to go through actual decisions made by the Personal Data Protection Council. Helpfully, they are provided here .

What follows is a summary of recent PDPA decisions and some observations we draw from them, which could be useful for our clients as well as ourselves!

A gigantic disclaimer here is that we are not lawyers, and therefore the following is simply our interpretation and cannot be considered authoritative.

Summary Table of Recent Decisions

Date Summary of Case Penalty / Clause
06 Jul 2017 Breach of Protection Obligation by Orchard Turn Developments Financial penalty of S$15,000 / Section 24 of the PDPA
29 Jun 2017 Breach of Protection Obligation by Eagle Eye Security Management Services Warning was issued to Eagle Eye Security Management Services and MCST 3696 of Prive EC / Section 24 of the PDPA
20 Jun 2017 Breach of Protection Obligation by DataPost Financial penalty of $3,000 was imposed on DataPost, as a data intermediary / Section 24 of the PDPA
20 Jun 2017 Breach of Protection Obligation by Hazel Florist & Gifts Warning was issued to Hazel Florist & Gifts / Section 24 of the PDPA
12 Jun 2017 No Breach of Consent and Notification Obligations by MCST and Managing Agents of Condominiums No Breach

Overall Statistics

There have been 34 decisions provided by the PDPC with the earliest case in 16 July 2014.

Out of the 34 decisions, for 2 cases, the PDPC determined that there was no breach of the PDPA. Warnings were issued for 13 cases and Directions issued for 4 other cases. Fines ranging from S$500/- to S$50,000/- were imposed for the remaining cases.

The highest financial penalty imposed so far has been S$50,000/- on K-Box Entertainment group in April 2016. Note, however, that Section 29 of the PDPA empowers the PDPC to impose fines of up to S$1 million.

Observation 1: Breaches are mostly based on Section 24 of the PDPA

Section 24 of the PDPA states “24.  An organisation shall protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.

This suggests that we should focus in our PDPA efforts to make “reasonable security arrangements”. The obvious question is “what constitutes ‘reasonable security arrangements’?”. No system is un-hackable.  So what does the PDPC consider “reasonable security arrangements”? The cases above give us some guidance.

Observation 2: Password Protection Policies are Crucial

In the most recent decision with regard to Orchard Turn Developments, the PDPC stated:

“22. The Commission also identified other issues concerning the security of the members’ personal data. Foremost of them is the absence of policies or practices to safeguard the admin account passwords(Emphasis added)

An in-house password policy to, amongst others,

  • Limit admin account password access; and
  • Regularly change admin account passwords

seems like something the PDPC looks out for first and foremost as part of “reasonable security arrangements”.

In this case, the cause of the PDPA breach was a direct result of a perpetrator using a valid admin account password. No amount of server-side security can prevent such breaches.

Observation 3: Limit Copies of Sensitive Personal Data

In this case, the commission also noted

14. As described above in paragraphs 4 to 5, the Organisation did not purge the personal data from the EDM server that were being transferred every day from the LMS server to the EDM server. After the emails had been sent out, the personal data of the subscribers were not deleted from the EDM server. The effect of this practice was that some of the personal data of the Organisation’s members could be found in two different places – the LMS server and EDM server.” (Emphasis added)

The Commission regarded this as a practice which increased the risk of PDPA breaches. Understanding in which server(s) personal data is stored is therefore important for any system administrator, and taking efforts to reduce the number of copies is considered a positive step to reduce the risk of PDPA breaches.

Observation 4: Vulnerability Assessments are Regarded a Positive Step

In the same case, the commission noted

Second, the Organisation did not conduct any vulnerability assessment to detect if there were any vulnerabilities in the system prior to its roll out.

Clearly, engaging a third-party provider (other than the system developer) to conduct a vulnerability or penetration test helps lower security risks. However, these tests are not cheap. In our experience, businesses would weigh the size of their system, the amount and sensitivity of personal data being collected and stored against the costs of conducting such a test.

This leads to our next observation.

Observation 5: The PDPC Considers the Extent and Impact of Breaches as Mitigation Factors

In the case with respect to DataPost, DataPost was fined only S$3000/-. The decision states

20. However, the Commission also notes the following mitigating factors:

  1. The scale of the breach was small. Only personal data belonging to two individuals was disclosed to a single recipient;
  2. There was no evidence to suggest that the data breach caused and actual loss or damage to any person”

This suggests that data protection measures should be commensurate with the amount and sensitivity of data collected by the organisation. Larger organizations with hold larger amounts of data might consider more extensive measures such as more frequent vulnerability tests.

Observation 6: Obtaining Consent is an Important Concept Within the PDPA

In the case with respect to MCST and Managing Agents of Condominiums, the Commission noted:

As part of the Consent Obligation, section 13 of the PDPA requires that prior consent be obtained by an organisation in order to collect, use or disclose personal data about an individual.

Therefore, owners of mobile apps and websites should display the Privacy or Data Protection Policy prominently within the mobile app or website and obtain the appropriate consents. Unfortunately, as non-lawyers, we cannot advise on the content of the Privacy or Data Protection Policy. A Google search of “PDPA” will bring up numerous samples of such policies.

Observation 7: It is a Myth that the Server Needs to be in Singapore

With regard to server arrangements, we have heard several times from potential clients that to comply with PDPA, servers need to be located in Singapore.

We believe that this is a myth (and are ready to stand corrected if there are other views on this).

Whilst it is difficult to prove the negative, we cannot find any decision by the PDPC which states that (1) cloud servers pose greater vulnerability than in-house servers OR (2) servers should be located in Singapore. Indeed the location of the server does not seem to play a part in any of the decisions.

We believe that the key question relates to the actual vulnerability of the server, rather than where it is located. Most high quality cloud server providers have strict access policies to the servers. On the other-hand, an in-house server located in Singapore but in an unsecure area would be highly vulnerable to access breaches.


Hope the observations are useful for anyone looking to develop a mobile app or website in Singapore. PDPA is indeed something to consider, but should not be an overly onerous consideration.

Brought to you by the RobustTechHouse team.

Also published on Medium.

Recent Posts
Showing 20 comments
  • fallout 76 hacks

    Awesome, this is what I was looking for in google

  • fireboy and watergirl

    I would like to appreciate the effort you have put into writing this blog. I hope you will have more quality articles in the near future.
    among us

  • The Personal Data Protection Act (PDPA) provides a baseline standard of protection for personal data in Singapore. It complements sector-specific legislative and regulatory frameworks such as the Banking Act and Insurance Act.

  • majorsite

    As I am looking at your writing, majorsite I regret being unable to do outdoor activities due to Corona 19, and I miss my old daily life. If you also miss the daily life of those days, would you please visit my site once? My site is a site where I post about photos and daily life when I was free.

  • Godskin Apostle

    I sincerely appreciate it. I learned a ton from your essay, which helped me great widen my perspective.

  • Lila Kerr

    I found the online exam help service to be very helpful. The tutors were knowledgeable and patient, and the service was easy to use. I would highly recommend this service to anyone who is looking for help with their exams.

  • casinocommunity

    From some point on, I am preparing to build my site while browsing various sites. It is now somewhat completed. If you are interested, please come to play with casinocommunity !!

  • namdosan1409

    With Car Games, you’ll never run out of high-octane fun. Get behind the wheel and experience the rush of speed and competition today!

  • kisstransire

    Decisions produced by the Personal Data Protection Council may provide more specific information on what businesses should do to free games comply with the PDPA. They’re conveniently laid out for you below.

  • It’s great to see that your mobile app and website development company considers the concerns of potential clients in Singapore regarding the PDPA.

  • To get more precise guidance on what companies should do to adhere to the PDPA, it is useful to go through actual decisions made by the Personal Data Protection Council. Helpfully, they are provided.

  • mark johnson

    In the ever-evolving world of fashion, the Women Pique Band-Collar Blazer has emerged as a timeless and versatile wardrobe staple that transcends seasons and occasions. From its origins as a symbol of male authority in the early 19th century to its contemporary reimagining as a powerful fashion statement for women, the blazer has come a long way.

  • alfarsklyn

    “This post is a breathtaking display of talent and skill.”
    شركة تنظيف بالدمام

  • Chris

    A leather biker jacketleather biker jacket is a type of leather jacket that is inspired by the style and culture of motorcycle riders

  • Gabriel Plummer

    Casement windows from Quartz Luxury Windows are the way to go if you want to add beauty to your home without sacrificing any practicality.

  • ERang25

    Dear immortals, I need some wow gold inspiration to create.

  • Mixer Settler Equipment

    Welcome to contact a professional Mixer Settler Equipment factory.

  • Amelie Charlton

    Privacy is a top priority, and‘s switchable privacy glass is an excellent investment.

  • I enjoyed reading your post, very nice share, I want to twit this to my followers. Thanks!.

  • five nights at freddy's game

    I’d also like to say that this game is great and fun. Play this board game on this app for free if you’re bored when you have some free time. You don’t need to download anything or sign up.

Contact Us

We look forward to your messages. Please drop us a note for any enquiries and we'll get back to you, asap.

Not readable? Change text. captcha txt
Why Tech Outsourcing is the Right Decision for Your CompanyCreate first apple watch app