← Data protection and cybercrime laws by country, compared
Singapore: data protection law, cybercrimes, fines and penalties
PDPA enforced by the PDPC, which publishes its decisions; fines tied to local turnover and 3-day notification.
- Law
- PDPA (Personal Data Protection Act)
- Authority
- PDPC (Personal Data Protection Commission)
- Max fine
- 10% of local turnover (if > S$10M) or S$1M
- Breach notification
- 3 calendar days after assessment
- DPO
- —
Crimes
| Unauthorised access | Computer Misuse Act 1993, s.3 | Up to 2 years |
| Access with intent to commit an offence | Computer Misuse Act 1993, s.4 | Up to 10 years |
| Scams (cheating) | Penal Code, s.420 | Up to 10 years |
Risks
- Scams (Online Criminal Harms Act)
- Shared liability for banking fraud (Shared Responsibility Framework, 2024)
- Cybersecurity Act: separate deadlines for critical information infrastructure (CII)