This month, the Commission has issued one Decision and three Undertakings.

The Decision imposed a financial penalty of $20,000 for failing to put in place reasonable security arrangements to protect the personal data in its possession of under its control, and failing to develop and implement policies and practices that are necessary to meet its obligation under the PDPA. 

In the Undertakings, three organisations implemented remediation plans to improve its compliance with the PDPA. The PDPC has accepted these undertakings having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.

Access the Decisions here and Undertakings here.