Discovering your personal data has been exposed in a breach is unsettling, whether it happened to a bank, a healthcare provider, or an online retailer you shop with. Singapore’s Personal Data Protection Act gives you genuine, meaningful rights when this happens, extending well beyond simply being notified. This guide explains what those rights actually are.
What the PDPA Requires of Organisations
Organisations that experience a notifiable data breach, one that results in, or is likely to result in, significant harm to affected individuals, are generally required to notify both the Personal Data Protection Commission and the individuals affected, unless certain specific exceptions apply. These exceptions include situations where the organisation has already taken remedial action, or implemented technological measures such as encryption, that render significant harm unlikely.
Your First Option: Lodging a Complaint With the PDPC
If you believe an organisation has breached its obligations under the PDPA, you can lodge a complaint directly with the Personal Data Protection Commission. Upon receiving a complaint, the PDPC may direct you and the organisation to resolve the matter directly, refer it for mediation, or conduct a full investigation into whether the organisation has genuinely complied with the law.
What the PDPC Can Actually Do to the Organisation
If an investigation finds the organisation breached the PDPA, the PDPC has real enforcement power, including imposing significant financial penalties. Under the current enforcement framework, penalties can reach the higher of a substantial fixed amount or ten percent of the organisation’s annual turnover in Singapore for larger organisations. Notable past enforcement actions include a one million dollar penalty imposed on parties involved in a major healthcare data breach, illustrating that this is a genuinely serious regulatory regime, not merely a symbolic one.
Why a PDPC Penalty May Not Feel Like Enough
It is worth being honest here. Financial penalties imposed by the PDPC go to the regulator, not to you personally as the affected individual. If you have genuinely suffered loss or damage because of the breach, this route alone may not feel like a satisfactory outcome, which is precisely why the PDPA also gives you a separate, personal avenue for recourse.
Your Right to a Private Civil Action
Under the PDPA, any individual who has suffered loss or damage directly as a result of an organisation’s breach of the Act has the right to bring a private civil action against that organisation, seeking compensation for their own specific loss. This is a genuinely powerful right, since it means you are not limited to relying on the regulator’s own enforcement action, and can pursue your own claim directly.
A Landmark Case That Significantly Expanded What You Can Claim
For a long time, there was genuine uncertainty about whether emotional distress alone, without a specific financial loss, could count as recoverable “loss or damage” under this private right of action. This was resolved in a landmark 2022 Court of Appeal decision, which held that emotional or mental distress genuinely suffered as a result of a PDPA breach can constitute loss or damage for which compensation may be claimed. This significantly broadened the practical value of this right, since many data breach victims suffer real distress without necessarily incurring a specific, easily quantifiable financial loss.
What Remedies a Court Can Grant
In a private civil action, the court has broad discretion to grant whatever relief it considers appropriate, which can include monetary damages, and injunctions, court orders either compelling or restricting a specific action by the organisation, such as an order requiring the organisation to stop using your data or to destroy it entirely.
You Do Not Necessarily Need to Go Through the PDPC First
While many people assume they must wait for a PDPC decision before pursuing their own civil claim, this is not strictly required as a matter of law. You can pursue a private civil action even if you have not filed a complaint with the PDPC at all, or you can pursue both routes, since they serve genuinely different, complementary purposes rather than one being a mandatory precondition for the other.
What You Cannot Do: Bring a Class Action on Others’ Behalf
It is worth understanding a genuine limitation here. The PDPA does not currently give individuals the right to mandate a not-for-profit organisation to seek collective remedies on behalf of a group of affected people. Each individual’s right to bring a private action is personal to them, meaning if many people are affected by the same breach, each would generally need to pursue their own individual claim.
Building Your Case if You Choose to Pursue a Claim
If you decide to pursue a private civil action, gather clear evidence of the breach itself, such as the organisation’s own notification to you, and evidence of the genuine loss or damage you have suffered, whether financial loss, or the emotional distress now recognised as a valid basis for a claim following the landmark 2022 decision.
Why This Right Genuinely Matters for Ordinary Singaporeans
Given how much of daily life now runs through organisations holding your personal data, from banks to healthcare providers to online retailers, having a genuine, personal legal avenue when something goes wrong is not a niche protection reserved for unusual situations. It reflects a deliberate policy choice to give individuals real leverage over how their data is handled, not just leaving enforcement entirely to a regulator acting on the public’s behalf in the abstract.
Considering Whether Legal Advice Is Worthwhile for Your Situation
Given the genuine complexity of establishing a PDPA breach and the loss or damage flowing from it, particularly following the more nuanced legal territory opened up by the emotional distress ruling, it is worth getting at least an initial consultation with a lawyer before deciding how to proceed, especially if the breach has caused you genuine, meaningful harm rather than a minor, easily resolved inconvenience.
Practical Steps to Take as Soon as You Learn of a Breach
Beyond the legal process, take practical protective steps immediately once you learn your data has been breached: change any passwords that may have been compromised, monitor your bank and credit accounts closely for unusual activity, and be especially alert to follow-up phishing attempts, since breached data is sometimes used to make further scam attempts appear more credible. Keeping a record of any additional harm that flows from these follow-on risks can also become relevant if you later pursue a claim.
Frequently Asked Questions
How long do I have to bring a private civil action for a data breach under the PDPA?
This is generally subject to the standard limitation periods that apply to civil claims in Singapore, so it is worth seeking advice promptly once you become aware of a breach affecting you, rather than assuming you have an unlimited amount of time.
Does it matter whether the organisation that breached my data is based in Singapore or overseas?
The PDPA can apply to organisations processing personal data in Singapore even if they are based overseas, though pursuing a claim against an overseas organisation can involve additional practical and jurisdictional considerations.
Can I claim compensation if my data was breached due to a cyberattack the organisation could not have reasonably prevented?
This depends on whether the organisation took reasonable security measures as required under the PDPA, so a sophisticated attack does not automatically excuse an organisation if its underlying protections were genuinely inadequate.
Is there a minimum amount of loss or damage required before I can bring a claim?
There is no fixed minimum threshold specified, though the amount of compensation ultimately awarded will reflect the genuine extent of the loss or damage you can demonstrate you suffered.
Can I still pursue a claim if the organisation has already been penalised by the PDPC for the same breach?
Yes, a PDPC penalty against the organisation does not prevent you from separately pursuing your own private civil action for your personal loss or damage, since these are distinct, complementary legal avenues.
Thank you for sharing this article...
About the Author: Randy Alta
