Adapted from the UK's Computer Misuse Act 1990 from which it borrowed three types of offences (mere unauthorized access, access with ulterior motive and modification of the contents of a computer), the Singapore Computer Misuse Act 1993 (CMA) boasted innovative features of its own: intercepting a computer service, abetting of offence, the making of a compensation order against the wrongdoer, and, until recently, admissibility of evidence.
The Info-communications Development Authority (IDA) launched Singapore’s first Infocomm Security Masterplan to coordinate cybersecurity efforts across the Government. A key priority was building basic capabilities within the public sector to mitigate and respond to cyber threats.
The second Masterplan focused especially on the security of Singapore’s CIIs, with a vision of making Singapore a ‘Secure and Trusted Hub’.
The Personal Data Protection Act 2012 (No. 26 of 2012) ('PDPA') governs the collection, use, and disclosure of individuals' personal data by organisations in a manner that recognises both the right of individuals to protect their personal data, and the need of organisations to collect, use, and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances.
The third Masterplan expanded to cover the wider infocomm ecosystem, which includes businesses and individuals, in addition to the previous focus on CIIs. It sought to make Singapore a ‘Trusted and Robust Infocomm Hub’.
The CMA was amended to include cybersecurity measures and renamed the Computer Misuse and Cybersecurity Act (CMCA), and was amended again in 2017 to strengthen the country's response to national level cyberthreats. The amendments broadened the scope of the CMA by criminalizing certain conduct not already covered by the existing law and enhancing penalties in certain situations (for example, the amended CMA criminalises the use of stolen data to carry out a crime even if the offender did not steal the data himself or herself, and prohibits the use of programs or devices used to facilitate computer crimes, such as malware or code crackers). The amendments also extended the extraterritorial reach of the CMA by covering actions by persons targeting systems that result in, or create a significant risk of, serious harm in Singapore, even if the persons and systems are both located outside Singapore.
Singapore’s Cybersecurity Strategy aims to create a resilient and trusted cyber environment. Four pillars underpin the strategy are: 1. Strengthen the resilience of Critical Information Infrastructures; 2. mobilizing businesses and the community to make cyberspace safer; 3. Developing a vibrant cybersecurity ecosystem; 4. form and maintain strong international partnerships.
The Act created a cyber security regulator, the Cybersecurity Commissioner, and gave the Commissioner significant powers for the response and prevention of cyber security incidents affecting Singapore. The Act also identified 11 critical sectors of essential services and set out a framework for the monitoring of Critical Information Infrastructures (CIIs). The essential services include energy, info-communications, water, healthcare, banking, aviation and the media. Under the Act, CIIs are obliged to report cyber security incidents to the Commissioner, conduct regular audits and risk assessments, and provide reports on their cybersecurity if requested by the Commissioner. The Act also creates a framework for licensing and regulating service providers of certain types of cyber security services, including a requirement that they be a "fit and proper" person to provide the service. These requirements extend to both Singaporean and overseas service providers offering such services in Singapore.
Amendments include the following: 1. introduction of a mandatory data breach notification requirement; 2. expansion of the scope of deemed consent; 3. inclusion of additional exceptions to express consent; 4. introduction of criminal offenses; 5. commencing October 1, 2022, the maximum financial penalty for breaches of the PDPA will also be increased.
This guide is drafted by PDP Commission, and is intended to help organisations to identify, prepare for, and manage data breaches. Organisations may also refer to this guide for key information on the mandatory Data Breach Notification Obligation under the PDPA, including the criteria, timelines and information to be provided when notifying the PDPC and affected individuals.
The 2021 Strategy outlines Singapore’s updated goals and approach to adapt to a rapidly evolving strategic and technological environment. It seeks to actively defend our cyberspace, simplify cybersecurity for end-users, and promote the development of international cyber norms and standards. Workforce and ecosystem development are the foundations of this strategy. It comprises three strategic pillars namely build resilient infrastructure, enable a safer cyberspace, enhance international cyber cooperation.