Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Stressing the duty in the protection of personal data-Exemplary case of Eatigo International

duty in the protection of personal data

Stressing the duty in the protection of personal data: The exemplary case of Eatigo International

Organisations in Singapore, big and small, are bound by the rules and regulations of the Personal Data Protection Act or the PDPA. Under this law, these organisations are required with utmost diligence in protecting personal data during the collection, use, and even disclosure of it. 

Generally, the failure to comply with the said law will result in the imposition of financial penalties, which range up to $S1,000,000. Nevertheless, there are instances that the PDPC will forgo with the said fine and will just issue a warning, provided that mitigating circumstances are present. 

However, not all circumstances surrounding the organisation can be grounds to get away with the hefty financial penalty imposed, even if it means bleeding your organisation to the point of shutting down. This is the case of Eatigo International, where the PDPC stressed the duty of every organisation to take compliance with PDPA seriously. 

It is the responsibility of Organisations to practise utmost diligence in handling their customers’ personal data. 

Stressing the duty in the protection of personal data: Eatigo International

Eatigo International was made to pay a financial penalty of S$62,400 for Protection Obligation under the PDPA. This occurred when Eatigo International’s cache of personal data from its old database was being offered for sale on an online forum. This affected database contained personal data relating to approximately 2.8 million individuals, encompassing personal data such as passwords, access IDs, and Facebook tokens.

Upon investigation, it was revealed that when Eatigo International migrated to a new database and transitioned to a new engineering team, no one in the organisation had knowledge of the affected database. Unlike in the current online platform, this affected database had no password rotation rules implemented for the affected database; no security reviews were conducted, no system was in place to monitor the exfiltration of large volumes of data, and no personal data asset inventory or access logs were maintained. 

Eatigo International pleaded for a reconsideration for the hefty financial penalty imposed as it will essentially shut down the business, according to them. It added that any financial penalty imposed would adversely affect the organisation’s business and deter any further investors or lenders from providing any further loans or investments to the organisation.

However, according to the PDPC, a mere warning is inappropriate in view of the egregiousness of the organisation’s breach of the PDPA and the impact of the Incident. Hence, to reduce the impact of the financial penalty, the hefty fine can be paid in installments.

The PDPC is not here to make every organisation go out of business but to remind them that there will be consequences when a breach of personal data occurs due to negligence on their part.

What can we get from this case 

The PDPC stresses the necessity of every organisation to stay compliant with the PDPA. It is their responsibility to practise the utmost diligence in handling their customers’ personal data. 

Basically, the PDPC is not here to make every organisation go out of business but to remind them that there will be consequences when a breach of personal data occurs due to negligence on their part. 

Every organisation should know that not taking active measures to protect its personal data will get them in trouble, regardless of your organisation’s financial status. 

How a DPO can help prevent this from happening

Your appointed DPO can work with you on your PDPA compliance, ensuring that there will be policies in place to make sure that the handling of personal data is PDPA compliant. 

A Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organizations comply with the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of PDPA noncompliance as it is the officer responsible for maintaining the positive posture of an organization’s cybersecurity.

DPOs complement organizations’ efforts to ensure that the organisation’s methods of collecting personal data comply with the PDPA. It also ensures that policies are set in place to make sure that there will be no instances of data breaches in the future.

Don’t wait any longer to ensure your organisation is PDPA compliant. Take our free 

3-minute PDPA Compliance Self-audit checklist now, the same “secret weapon” used by our clients to keep them on track. Upon completion, we will send you the results so you can take the necessary action to protect your customers’ data. Complete the free assessment checklist today and take the first step towards protecting your customers’ personal data.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us