ShareAndGoShareAndGo

Security

What a data breach really costs a Singapore SME.

When small business owners think about the cost of a data breach, they usually picture a fine. In practice the fine, if there is one, is often not the largest cost. The bigger bills come from time, disruption and trust.

This article walks through where the costs fall for a small or mid-sized Singapore business, using the Personal Data Protection Commission's own guidance on obligations and penalties. We have not quoted a headline average cost, because we could not find a Singapore figure from an official source that we were confident in.

Get startedSee security

Cost one: the assessment

The first cost arrives immediately, and it is people's time. Under the PDPA, the PDPC's Guide on Managing and Notifying Data Breaches says that once an organisation has credible grounds to believe a data breach has occurred, it must take reasonable and expeditious steps to assess whether the breach is notifiable, within 30 calendar days, and must document the steps it takes.

For a small business, that means senior people stopping their normal work to establish what happened, which documents or systems were involved, whose personal data was affected and how many people. If you use outside IT support, they bill for the investigation. If you need legal advice on whether the breach is notifiable, that is another bill.

How long this takes depends almost entirely on your records. If you can see exactly who accessed which files and when, the assessment is a matter of reading the log. If documents travelled as email attachments and through shared links, it becomes a reconstruction exercise.

Cost two: notification

According to the PDPC's guide, a breach must be notified if it is likely to result in significant harm to affected individuals, or if it involves the personal data of 500 or more individuals. Once an organisation has determined that a breach is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days, and notify affected individuals where required.

Notifying properly takes work. The PDPC's guide lists what the notification to the Commission must include, from how the breach occurred and the number of individuals affected to a chronological account of the steps taken. Telling affected individuals means drafting clear letters or emails, setting up a way to answer their questions and handling the calls that follow.

Cost three: enforcement

The PDPC has a range of enforcement tools, and financial penalties are one of them. According to the PDPC's Advisory Guidelines on Enforcement of the Data Protection Provisions, revised on 1 October 2022, the Commission may require an organisation to pay a financial penalty of up to S$1 million, or 10% of the organisation's annual turnover in Singapore where that turnover exceeds S$10 million, whichever is higher, for an intentional or negligent contravention of the data protection provisions.

Those are maximums. The same guidelines say that in deciding the amount, the Commission considers factors including harm, such as the number of affected individuals and the categories of personal data, and culpability, meaning the organisation's conduct and its overall compliance with the PDPA. The PDPC can also give directions requiring an organisation to take specific steps. Either way, an enforcement process takes management time and usually professional fees.

Cost four: the business you lose

For most SMEs, this is the largest cost and the hardest to measure. A client who learns that their payroll file went to the wrong company may move to another provider. A buyer who discovers that a seller's confidential information leaked during a sale process may lower their price or walk away. A professional firm that has to tell clients about a breach may find that referrals dry up for a while.

There is also the cost of distraction. In a small business, the people handling the incident are the same people who would otherwise be winning work and serving clients.

Cost five: fixing the cause

The final cost is changing whatever let the breach happen. The PDPC's handbook on How to Guard Against Common Types of Data Breaches, based on cases the PDPC has handled, identifies five common gaps: coding issues, configuration issues, malware and phishing, security and responsibility issues, and weak management of accounts and passwords. Fixing any of them after an incident is more expensive than fixing it before, because it happens under pressure.

Where prevention is cheapest

For many SMEs, the documents most likely to cause a breach are the ones that leave the business: files sent to clients, buyers, auditors, lenders and advisers. These are the documents you control least once they are sent. The cheapest prevention is to stop sending copies at all, and to share access to a controlled copy instead.

  • A misaddressed invitation exposes nothing if access depends on the reader confirming their own email address.
  • A view-only reader who never receives the original file cannot forward it.
  • A record of who opened what turns a week of reconstruction into an hour of reading.
  • Access that ends on a date you set does not linger after a matter closes.

How ShareAndGo reduces the bill

ShareAndGo puts confidential documents in rooms where every reader is invited by email and confirms that address with a six-digit code. Groups see only the folders you allow, and you decide per room and per group whether people can download, print or copy. View-only readers see documents rendered on our side with their name, email address and the date on every page.

Every view, upload, download, invitation and change is recorded in an audit log, chained so alterations are detectable and exportable as a spreadsheet, so if something does go wrong your assessment starts with facts. Every upload is scanned for viruses, and invitations can be revoked in one click. Your documents, records and files are stored in Singapore, and our privacy page lists the services that run elsewhere.

Frequently asked questions

What is the maximum PDPA penalty?
According to the PDPC's enforcement guidelines, up to S$1 million or 10% of annual turnover in Singapore for organisations whose Singapore turnover exceeds S$10 million, whichever is higher. Actual penalties depend on the circumstances.
Does every breach lead to a penalty?
No. The PDPC has a range of enforcement options and considers factors such as harm and culpability. Your adviser can explain how this might apply to a specific incident.
Does insurance cover these costs?
Some policies cover parts of a breach response. Check the terms of your own policy with your broker.

Keep reading

PDPA breach notification, step by step

Thresholds, timeframes and what a notification must contain.

Five signs your documents are less secure than you think

Warning signs worth checking before anything goes wrong.

ShareAndGo security

The controls that keep documents in your hands.