Personal Data Protection Act 2012 · 2020 Revised Edition · Part 9C · Enforcement
48J. Financial penalties
Feedback & supportIn plain English
The commission may impose a financial penalty for intentional or negligent breaches of certain rules. For an organisation, the cap is $1 million, or for some breaches, 10% of annual turnover in Singapore if that turnover exceeds $10 million. For an individual, the cap is $200,000. In setting a penalty, the commission weighs factors like how serious the breach is.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Last amended by an amending law of 2020.
Subject to subsection (2), the Commission may, if it is satisfied that —
Commission
“Commission” means the person designated as the Personal Data Protection Commission under section 5 to be responsible for the administration of this Act;
an organisation has intentionally or negligently contravened any provision of Part 3, 4, 5, 6, 6A or 6B; or
a person has intentionally or negligently contravened —
any provision of Part 9; or
section 48B(1),require, by written notice, the organisation or person (as the case may be) to pay a financial penalty.
Subsection (1) does not apply in relation to any contravention of a provision of this Act, the breach of which is an offence under this Act.
A financial penalty imposed on an organisation under subsection (1)(a) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:
organisation
“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —(a)formed or recognised under the law of Singapore; or(b)resident, or having an office or a place of business, in Singapore;
in the case of a contravention on or after the date of commencement of section 24 of the Personal Data Protection (Amendment) Act 2020 by an organisation whose annual turnover in Singapore exceeds $10 million — 10% of the annual turnover in Singapore of the organisation;
in any other case — $1 million.
A financial penalty imposed on a person under subsection (1)(b)(i) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:
in the case of an individual — $200,000;
in any other case — $1 million.
A financial penalty imposed on a person under subsection (1)(b)(ii) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:
in the case of an individual — $200,000;
in the case of a contravention on or after the date of commencement of section 24 of the Personal Data Protection (Amendment) Act 2020 by a person whose annual turnover in Singapore exceeds $20 million — 5% of the annual turnover of the person in Singapore;
in any other case — $1 million.
For the purposes of subsections (3) and (4), different maximum amounts may be prescribed in respect of contraventions of different provisions of this Act.
For the purposes of subsections (3)(a) and (4A)(b), the annual turnover in Singapore of an organisation or a person (as the case may be) is the amount ascertained from the most recent audited accounts of the organisation or person available at the time the financial penalty is imposed on that organisation or person.
The Commission must, in determining the amount of a financial penalty imposed under subsection (1), have regard to, and give such weight as the Commission considers appropriate to, all of the following matters:
the nature, gravity and duration of the non‑compliance by the organisation or person, as the case may be;
the type and nature of the personal data affected by the non‑compliance by the organisation or person, as the case may be;
whether the organisation or person (as the case may be), as a result of the non‑compliance, gained any financial benefit or avoided any financial loss;
whether the organisation or person (as the case may be) took any action to mitigate the effects and consequences of the non‑compliance, and the timeliness and effectiveness of that action;
whether the organisation or person (as the case may be) had, despite the non‑compliance, implemented adequate and appropriate measures for compliance with the requirements under this Act;
whether the organisation or person (as the case may be) had previously failed to comply with this Act;
the compliance of the organisation or person (as the case may be) with any direction given under section 48I or 48L(4) in relation to remedying or mitigating the effect of the non‑compliance;
whether the financial penalty to be imposed is proportionate and effective, having regard to achieving compliance and deterring non‑compliance with this Act;
the likely impact of the imposition of the financial penalty on the organisation or person (as the case may be), including the ability of the organisation or person to continue the usual activities of the organisation or person;
any other matter that may be relevant.