Key Concept 6 — Consequences of Non-Compliance

Fines are only one of the risks — trust is often the bigger loss.

Most enforcement cases start with something avoidable: a security gap, a missing legal basis, an unanswered request from a customer or a complaint from an employee.

Typical consequences

  • Fines by the data protection authority, often based on turnover or on a fixed unit
  • Orders from authorities: stop a processing activity, delete data, change a system — which can halt a business process overnight
  • Claims for damages by the affected people, in some countries also through class actions or consumer associations
  • Loss of trust of customers, employees and business partners, and negative press
  • Business impact: lost tenders, failed due diligence and stricter requirements from customers
  • Personal liability of managers and employees under some laws

Sanctions in your jurisdiction

Singapore

Supervisory authority: Personal Data Protection Commission (PDPC)

  • Financial penalties of up to 10% of annual turnover in Singapore (for turnover above S$10 million) or S$1 million, whichever is higher
  • Directions to stop processing or to destroy personal data
  • Offences for individuals, e.g. unauthorised disclosure or re-identification of anonymised data
ResGuard — Data Protection Workshop 1 · Task 1 · Jurisdiction: Singapore Slide 8 of 10