Lessons from PDPC enforcement: the ACL Construction decision

Updated Mar 14, 2026 · 4 min read · Guides

In its April 2022 decision on ACL Construction (S) Pte Ltd, the PDPC found the company in breach of the PDPA’s Accountability Obligation for failing to appoint a DPO and for having no data protection policies — despite the information involved in the underlying incident falling outside the PDPA’s definition of personal data.

What happened

During a PDPC investigation into a data incident at ACL Construction, the Commission found the company had never appointed a Data Protection Officer as required under Section 11(3) of the PDPA, and had no written data protection policies in place at all.

The key detailThe affected information turned out to be business contact information, which falls outside the PDPA’s definition of personal data — so no personal data was actually compromised. ACL Construction was still found in breach, purely for the missing DPO and policies.

The outcome

Rather than a financial penalty, the PDPC directed ACL Construction to develop and implement data protection policies and to run compulsory staff training — a materially lighter outcome than cases involving an actual data breach, but still a formal enforcement decision on public record.

The takeaway for Singapore SMEs

The Accountability Obligation doesn’t wait for something to go wrong. An organisation can be found in breach for the absence of a DPO and policies alone — and separately, the PDPC has repeatedly treated a missing or ineffective DPO as an aggravating factor that increases penalties in cases that do involve an actual breach.

Close this gap before it’s ever tested

A named DPO and documented policies, live within 5 business days of onboarding.

See DPO plans →

Frequently asked questions

DPO & Compliance

Was ACL Construction fined?

No — the PDPC issued directions to implement policies and staff training rather than a financial penalty, reflecting that no personal data was actually compromised.

Why was the company found in breach if no personal data was affected?

Because the Accountability Obligation requires appointing a DPO and having data protection policies in place regardless of whether a breach involving personal data has occurred.

Does a missing DPO affect penalties in other cases?

Yes — the PDPC has treated a missing or ineffective DPO as an aggravating factor that increases penalties in enforcement decisions involving actual data breaches.

Sources:

PDPC, Breach of Accountability Obligation by ACL Construction (S), published 21 April 2022
WongPartnership LLP, Data Protection Quarterly Updates (April–June 2022)
Infinity Legal LLC, Appointing a Data Protection Officer and Implementing Policies and Procedures to Comply with the PDPA, 2023