Singapore’s data protection deadline: a company’s survival guide

Businesses in Singapore are facing a crucial compliance deadline that’s fast approaching.

By September 30, every existing company in the city-state – from large enterprises to small startups – must appoint a registered data protection officer (DPO) under the Personal Data Protection Act (PDPA). New companies, on the other hand, must have one in place from their date of incorporation.

While it is easy to dismiss this as yet another spurious admin requirement, data protection truly matters and is about more than just ticking a box. After all, mishandling data can cost companies up to S$1 million (US$776,000) in fines. It can cause irreversible reputational damage, too.

Image credit: Timmy Loen

Not a “nice-to-have”

Let’s face it, data is pretty much the lifeblood of every business these days. Companies probably deal with more personal data than they even realize, from customer contact details to employee information.

If any of this data leaks, the consequences go beyond just fines. It can also lead to lawsuits, loss of customer trust, and a tarnished brand.

See also: Meet the 50 top-funded startups and tech companies in Singapore

With the rise of generative AI, businesses now handle more personal data – often in more complex and unexpected ways. However, AI-generated interactions, content, and insights come with new hurdles to data protection efforts. One good example is workers processing customer information with third-party AI platforms without checking data privacy policies first.

This new tech makes it even more essential for companies to implement effective data management strategies that are crucial in safeguarding customers’ trust.

Ignorance is costly

Without a DPO, a firm is vulnerable to data breaches that can disrupt operations. It can incur hefty fines as well. For example, just look at Carousell, which was fined S$58,000 (US$45,000) earlier this year for a data exposure incident. Likewise, Horizon Fast Ferry was hit with a S$28,000 (US$22,000) fine after a ransomware attack.

Carousell office / Source: Carousell

These aren’t isolated incidents, and they show how costly even a small oversight can be.

Apart from fines, there are other significant costs associated with data compromise that can far outweigh the penalties themselves.

What does a DPO actually do?

Problem-solving on a budget