Common lapses

Lapses during data and system migrations: Implement relevant measures and test thoroughly before making changes
Lack of measures to detect and prevent data breaches: Implement monitoring and data loss prevention measures such as alerts to detect unusual data access and bulk downloads

Recent data breach cases in Singapore and around the world have shown common lapses in how organisations protect personal data. This advisory highlights these lapses and recommends measures for organisations to strengthen their data protection practices, drawing from PDPC's investigation findings and learnings from other jurisdictions.

Section 24 of the PDPA requires an organisation to make reasonable security arrangements to protect personal data¹ in its possession or under its control. Examples of personal data include, but are not limited to, an individual’s name, mobile number, residential address and NRIC number (in full and partial form²). This is to prevent (a) unauthorised access, collection, use, disclosure, copying, modification or disposal, or similar risks; and (b) the loss of any storage medium or device on which personal data is stored.

Lapses during data and system migrations

Data protection risks often arise when organisations migrate data or systems, such as moving to a new customer database or upgrading system infrastructure. These migrations involve multiple steps, including mapping data fields, extracting data from legacy systems, and configuring access controls. Each step in the migration carries a risk of error, which could create system vulnerabilities that may be exploited by attackers, expose personal data or cause information to be sent to the wrong recipients.

Illustration

As part of its plan to revamp its billing system, Company A decides to migrate its customer information database to a new platform. However, a mismatch between the data fields across the old and new system results in customers' address information being migrated incorrectly, causing billing statements which contain personal data to be sent to the wrong customers. This example illustrates how data migration can be a complex undertaking that requires thorough planning and testing.

To prevent such lapses, organisations should take relevant measures. For example:

Implementing process checks to verify the accuracy of data mapping
Keeping the test environment offline and separate from the Internet in the development phase
Implementing adequate end-to-end controls in data transfers between the source and target systems, reviewing and testing against documented configurations, and conducting tests to ensure robustness of the system
Automating critical steps where possible to minimise human error while also ensuring adequate human verification
Conducting vulnerability assessment and penetration testing (VAPT) prior to system go-live after any changes, and checking to ensure that no credentials or personal data are left behind in the test environment

Lack of measures to detect and prevent data breaches

Data breaches can occur even when organisations have implemented standard security arrangements such as firewalls and access management. Attackers may bypass perimeter defences or exploit compromised user accounts to access databases containing personal data. Without database-level monitoring, organisations often remain unaware that large volumes of personal data are being accessed inappropriately or extracted from their systems.

Illustration

An attacker gains access to Organisation B's network through a phishing email and uses stolen user credentials to access its customer databases. Despite having network security measures in place, Organisation B has no alerts to detect when unusually large amounts of customer data are being downloaded, allowing the breach to continue undetected for months. This example illustrates the potential consequences when organisations lack the measures to detect and prevent data breaches.

To address this gap, organisations should implement database-level monitoring and data loss prevention measures, where feasible. Organisations can deploy systems that can detect unusual data access patterns, such as large downloads or access to sensitive data outside normal business hours. Additionally, organisations should have clear policies and protocols to respond to security alerts as part of their data breach management plans.

Review data protection policies and practices

Organisations are strongly encouraged to routinely review their data protection policies and practices to enable them to identify data protection gaps and the appropriate remedies.

Resources and guidance

Help and Resources for Organisations
Advisory Guidelines and Guides

^[1] Personal data is defined in the Personal Data Protection Act 2012 (PDPA) as data, whether true or not, about an individual who can be identified (a) from that data; or (b) from that data and other information to which the organisation has or is likely to have access.

^[2] Partial NRIC number refers to a part of the full NRIC number, such as the last 3 numerical digits and checksum of the NRIC number (e.g. “567A” from the full NRIC number of “S1234567A”).