Potential Violations in Recent Mobile Guardian Data Breach Incident

Assoc Prof Jamus Jerome Lim asked the Minister for Communications and Information (a) whether the Personal Data Protection Commission (PDPC) will be conducting an investigation into potential violations of the Personal Data Protection Act (PDPA) in relation to the data breach of a user management portal that affected 127 schools in April 2024; (b) if so, what is the expected timeline for completing this investigation; and (c) whether PDPC will consider imposing financial penalties on the responsible parties if legal breaches are found.

The Personal Data Protection Act (PDPA) governs the collection, use and disclosure of personal data by private sector organisations. Colleagues from the Ministry of Education have shared more details about the facts of the incident. The Personal Data Protection Commission of Singapore is currently investigating if any private sector organisation involved has breached data protection obligations under the PDPA.