Requirements & Penalties
Mandatory cybersecurity obligations for businesses operating in Singapore under the latest 2026 regulatory updates.
ALL Singapore Companies MUST:
Appoint a DPO
Designate a Data Protection Officer responsible for ensuring the organization complies with the PDPA.
Breach Notification
Notify PDPC within 3 calendar days for breaches causing "significant harm" or affecting 500+ individuals.
Security Arrangements
Implement reasonable measures like 2FA, encryption, and automated patching to prevent unauthorized access.
The Cost of Non-Compliance
Up to S$1 Million or 10% of Annual Turnover
(Whichever is higher)
Recent Enforcement Records (2025-26)
Compliance Audit
A Castle subscription will assist you to meet these mandatory requirements and avoid crippling financial penalties and liabilities.
ALL Critical Information Infrastructure (CII) Owners MUST have:
Certification Deadline
Cyber Trust Mark (Level 5) Certification by the end of 2027.
Board Governance
Cybersecurity training for their board members.
Incident Real-time Reporting
Incident reports if essential services could be disrupted; for significant incidents, within two hours.
2026 Expansion Categories
STCC
Systems of Temporary Cybersecurity Concern (timed critical hardware).
ESCI
Entities of Special Cybersecurity Interest (non-CII with sensitive data).
FDI
Foundational Digital Infrastructure (the backbone, e.g., Cloud Providers).
These cyber requirements were expanded under the 2026 regulatory updates where the CSA included computer systems that are critical only for a limited duration as STCC – Systems of Temporary Cybersecurity Concern; Entities of Special Cybersecurity Interest (ESCI) for non-CIIs but perform functions of national interest or hold highly sensitive data; and FDIs - Foundational Digital Infrastructure that are the "backbone" of the digital economy, such as cloud service providers and data centers. Failure to report a major incident can lead to penalties exceeding S$100k, license revocation and/or 2 years imprisonment for individuals and officers.
The ministries are also tightening the requirements for their respective sectors, for e.g. the Health Information Bill passed in Jan 2026 makes it mandatory for all licensed healthcare providers to share data with the National Electronic Health Record (NEHR). Unauthorized access to the NEHR is a criminal offense with fines up to S$100,000 or jail time.
Health Sector Protocol
The Health Information Bill (Jan 2026) makes it mandatory for all licensed healthcare providers to share data with the National Electronic Health Record (NEHR).
Failure to report major incidents leads to license revocation.
Extended Enforcement: Up to 2 years imprisonment for individuals and officers found in breach of protocol.