20:["$","div",null,{"className":"page-banner__category","children":[["$","div",null,{"className":"page-banner__illustration","children":["$","img",null,{"src":"/assets/5b626164-8019-4615-b710-58c6c35a0973.webp","alt":"","loading":"lazy","width":500,"height":300}]}],["$","span",null,{"children":"Announcements"}]]}] 21:["$","h1",null,{"children":"New Commission's Decisions and Undertakings on 23 May 2024"}] 22:["$","span",null,{"className":"page-banner__date","children":["Published on ","23 May 2024"]}] 23:["$","div",null,{"className":"page-share","children":[["$","span",null,{"children":"Share:"}],["$","ul",null,{"children":[["$","li","facebook",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to facebook","aria-label":"Share to facebook","data-network":"facebook","role":"button","children":[["$","span",null,{"className":"sr-only","children":"facebook"}],["$","span",null,{"className":"icon-facebook"}]]}]}],["$","li","linkedin",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to linkedin","aria-label":"Share to linkedin","data-network":"linkedin","role":"button","children":[["$","span",null,{"className":"sr-only","children":"linkedin"}],["$","span",null,{"className":"icon-linkedin"}]]}]}],["$","li","whatsapp",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to whatsapp","aria-label":"Share to whatsapp","data-network":"whatsapp","role":"button","children":[["$","span",null,{"className":"sr-only","children":"whatsapp"}],["$","span",null,{"className":"icon-whatsapp"}]]}]}]]}]]}] 27:T51f,

This month, the Commission has issued three Decisions and six Undertakings.

The first Decision resulted in a financial penalty of $74,000 for (i) failing to put in place reasonable security arrangements to protect individuals' personal data in its possession or under its control, and (ii) not appointing any individual to ensure its compliance with PDPA.

The second Decision involved Directions for failing to put in place reasonable security arrangements to protect individuals' personal data in its possession or under its control.

The third Decision imposed a financial penalty of $28,000 for failing to put in place reasonable security arrangements to protect its platform users' personal data in its possession or under its control.

In the Undertakings, six organisations implemented remediation plans to improve its compliance with the PDPA. The PDPC has accepted these undertakings having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.

Access the Decisions here and Undertakings here.