SingaporePersonal Data Protection Act, enforcement and private right of action
Personal Data Protection Act 2012, ss.48J, 48O, as added by Act 40 of 2020
In force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Singapore must be prepared to answer to the PDPC for a Part 4 through 6B violation, facing a financial penalty of up to 10 percent of Singapore annual turnover for a serious contravention, and an individual harmed by such a violation may bring a civil claim for relief directly.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commission of Singapore (PDPC) (guidance, recorded ); Piper, Martin v Singapore Kindness Movement [2025] SGHC 173, General Division of the High Court of Singapore, judgment of (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 48J(3): a financial penalty imposed on an organisation under s.48J(1)(a) (an intentional or negligent contravention of Part 3, 4, 5, 6, 6A or 6B) must not exceed 10% of the organisation's annual turnover in Singapore where that turnover exceeds S$10 million, or S$1 million in any other case. Because 10% of a S$10 million turnover is exactly S$1 million, the two branches cross over at that threshold, so the effective rule is the higher of a S$1 million fixed cap or 10% of Singapore annual turnover. Two further, narrower caps sit alongside this organisation-level rule and do not form part of the s.48J(3) rule: s.48J(4) caps a financial penalty on a person under s.48J(1)(b)(i) (a Part 9 contravention) at S$200,000 for an individual, or S$1 million for a non-individual person; s.48J(4A) caps a financial penalty on a person under s.48J(1)(b)(ii) (a s.48B(1) dictionary-attack contravention) at S$200,000 for an individual, rising to 5% of the person's annual turnover in Singapore where that turnover exceeds S$20 million, otherwise S$1 million.
- Rule
- Higher of
- As of
- Currency
- SGD
- Fixed cap
- 1,000,000
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
Personal Data Protection Commission (PDPC)
Settledness
- As of
- Case link
- https://www.elitigation.sg/gd/s/2025_SGHC_173
- Guidance link
- https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Other-Guides/Active-Enforcement/Guide-on-Active-Enforcement_Oct2022.pdf
- Case citation
- Piper, Martin v Singapore Kindness Movement [2025] SGHC 173, General Division of the High Court of Singapore, judgment of
- Guidance body
- Personal Data Protection Commission of Singapore (PDPC)
- Open questions
- Is emotional distress that follows a third party's later conduct, rather than the organisation's own contravention, suffered "directly as a result of a contravention" for the purposes of the right of private action in section 48O(1) of the Personal Data Protection Act 2012?
What it makes you log
Logging duty
Sections 48J and 48O let the Commission require a financial penalty for a contravention of Parts 3 to 6B or Part 9 and give a person who suffers loss a civil right of action. Neither names a log, record or audit; the annual turnover that caps a penalty is read from the organisation’s own audited accounts, which is a party’s own figure and not an audit of a record. The Commission’s investigation powers of section 50 and the Ninth Schedule sit outside the sections this row cites.
- Kind
- None
- As of
What this law does
The Personal Data Protection Commission (PDPC) is Singapore's supervisory authority. Financial penalties under s.48J, added by the 2020 amendment and commencing , reach up to 10 percent of Singapore annual turnover for an organisation with turnover exceeding S$10 million (otherwise up to S$1 million), and up to S$200,000 for an individual, or up to 5 percent of turnover exceeding S$20 million.
Section 48O(1), also added by the 2020 amendment, gives a person who suffers loss or damage directly from a contravention of the Consent Obligation (Part 4), Access and Correction (Part 5), Care of Personal Data (Part 6), Notification of Data Breaches (Part 6A), or Data Portability (Part 6B) provisions a right of action for relief in civil proceedings; its own specific commencement date within the 2020 amendment was not independently isolated.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .