27:I[35618,["/_next/static/chunks/0~kq_fcbb~0yz.js","/_next/static/chunks/08yvrn8o4u_2w.js","/_next/static/chunks/0_qr0a30p2r_0.js","/_next/static/chunks/0ybgfm2q~g8d3.js","/_next/static/chunks/0.933bw7~tln7.js","/_next/static/chunks/14gq.5yvzptgk.js","/_next/static/chunks/0p3obcb6~vnya.js","/_next/static/chunks/0nawjgi9~47r2.js"],"default"] 21:["$","div",null,{"className":"page-banner__category","children":[["$","div",null,{"className":"page-banner__illustration","children":["$","img",null,{"src":"/assets/5b626164-8019-4615-b710-58c6c35a0973.webp","alt":"","loading":"lazy","width":500,"height":300}]}],["$","span",null,{"children":"Announcements"}]]}] 22:["$","h1",null,{"children":"New Undertakings on 4 December 2025"}] 23:["$","span",null,{"className":"page-banner__date","children":["Published on ","04 Dec 2025"]}] 24:["$","div",null,{"className":"page-share","children":[["$","span",null,{"children":"Share:"}],["$","ul",null,{"children":[["$","li","facebook",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to facebook","aria-label":"Share to facebook","data-network":"facebook","role":"button","children":[["$","span",null,{"className":"sr-only","children":"facebook"}],["$","span",null,{"className":"icon-facebook"}]]}]}],["$","li","linkedin",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to linkedin","aria-label":"Share to linkedin","data-network":"linkedin","role":"button","children":[["$","span",null,{"className":"sr-only","children":"linkedin"}],["$","span",null,{"className":"icon-linkedin"}]]}]}],["$","li","whatsapp",{"children":["$","a",null,{"className":"st-custom-button","title":"Share to whatsapp","aria-label":"Share to whatsapp","data-network":"whatsapp","role":"button","children":[["$","span",null,{"className":"sr-only","children":"whatsapp"}],["$","span",null,{"className":"icon-whatsapp"}]]}]}]]}]]}] 28:T54b,

This week, the Commission has published four Undertakings.

The incidents involved a mix of ransomware attacks and unauthorised access by exploiting legitimate login credentials, which disrupted business operations and exposed gaps in the organisations' cybersecurity defences. Common contributing factors included weak access controls, use of outdated firewall, software, and default accounts.

To address these issues and strengthen data protection practices, the organisations will be implementing a range of remediation measures, including:

Enforcing multi-factor authentication across systems and administrative accounts
Performing regular vulnerability assessments and penetration testing
Hardening server configurations and segmenting network access
Training staff on cybersecurity and data protection awareness
Obtaining relevant data protection and cybersecurity certifications

The PDPC has accepted these Undertakings after considering the types of personal data affected, the circumstances surrounding each incident, and the organisations' readiness to implement their remediation plans to meet their obligations under the PDPA.

Access the Undertakings here.