This month, the Commission has issued two Decisions and six Undertakings.

The first Decision imposed a financial penalty of $18,000 for failing to put in place reasonable security arrangements to protect customers' personal data in its possession or under its control.

The second Decision resulted in a financial penalty of $7,000 for failing to put in place reasonable security arrangements to protect against the unauthorised use of and access to customers' personal data for registration for pre-paid SIM cards.

In the Undertakings, six organisations implemented remediation plans to improve its compliance with the PDPA. The PDPC has accepted these undertakings having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.