Statute Details
- Title: Personal Data Protection (Composition of Offences) Regulations 2021
- Act Code: PDPA2012-S70-2021
- Type: Subsidiary legislation (SL)
- Enacting authority: Made by the Personal Data Protection Commission (PDPC) with the approval of the Minister for Communications and Information
- Commencement: 1 February 2021
- Legislative basis: Section 55(4) of the Personal Data Protection Act 2012 (PDPA)
- Key provisions: Sections 1–4 (citation/commencement; compoundable offences under PDPA s 55(1) and s 55(2); revocation of 2013 Regulations)
- Current status (per provided extract): Current version as at 27 Mar 2026
- Instrument number: S 70/2021
- Made on: 28 January 2021
What Is This Legislation About?
The Personal Data Protection (Composition of Offences) Regulations 2021 (“Composition Regulations”) is a procedural instrument that enables the Personal Data Protection Commission (PDPC) to “compound” certain offences under the Personal Data Protection Act 2012 (PDPA). In practical terms, compounding is an alternative to prosecution: instead of taking an offender to court, the PDPC may accept a composition sum and thereby resolve the matter without a criminal trial.
This matters because the PDPA contains a range of offences for contraventions of specific data protection obligations. While the PDPA provides for criminal liability, the Composition Regulations identify which offences are eligible for compounding and under which PDPA compounding pathways. The Regulations therefore shape enforcement strategy, compliance risk, and how organisations can manage potential PDPA breaches.
Although the Regulations are short, they are legally significant. They determine the set of offences that can be dealt with summarily through PDPC compounding, and they also include a transitional element by referencing offences “as in force immediately before 1 February 2021”. This indicates that the PDPA’s offence provisions may have been amended around that date, and the Regulations preserve compounding eligibility for certain earlier-form offences.
What Are the Key Provisions?
Section 1 (Citation and commencement) provides the formal identity of the instrument and states that it comes into operation on 1 February 2021. For practitioners, the commencement date is important because it affects which version of the PDPA offence provisions apply and whether any transitional references (such as those in section 3(b)) are triggered.
Section 2 (Offences compoundable under section 55(1) of the Act) is the first substantive provision. It states that any offence under section 51(1) or section 61(2) of the PDPA may be compounded by the Commission in accordance with section 55(1) of the PDPA.
In plain language, section 2 identifies two PDPA offence categories that are eligible for compounding under the “section 55(1)” compounding mechanism. While the extract does not reproduce the underlying PDPA offence text, the legal effect is clear: if PDPC alleges that an organisation or individual has committed an offence corresponding to PDPA s 51(1) or s 61(2), PDPC has the statutory power (subject to the PDPA’s compounding framework) to offer a composition resolution rather than proceed to prosecution.
For counsel advising on enforcement exposure, section 2 is therefore a gateway provision: it tells you that certain offences are “compundable” and can potentially be resolved through PDPC without court proceedings, subject to PDPC’s discretion and the PDPA’s procedural requirements for composition.
Section 3 (Offences compoundable under section 55(2) of the Act) expands the list of compoundable offences and distinguishes them by reference to section 55(2) of the PDPA. It provides that the following offences may be compounded:
(a) Any offence under section 42(2) of the Act.
(b) Any offence under sections 43(2), 44(2) or 45(2) of the Act as in force immediately before 1 February 2021.
This structure is important. Section 3(a) is straightforward: it makes PDPA s 42(2) offences eligible for compounding under the “section 55(2)” pathway.
Section 3(b) is more nuanced. It limits compounding eligibility for offences under PDPA s 43(2), s 44(2), and s 45(2) to the versions of those provisions as they stood immediately before 1 February 2021. That “as in force immediately before” language is a classic legislative technique used to manage transitional amendments. It suggests that on or around 1 February 2021, the PDPA’s offence provisions (or their numbering/substance) may have been revised, and the Regulations ensure that offences committed under the earlier formulation remain compundable.
From a litigation and compliance perspective, this transitional drafting affects how you assess the relevant legal regime for conduct occurring before vs after 1 February 2021. If alleged conduct occurred in the pre-commencement period, counsel should carefully map the alleged facts to the “as in force immediately before” versions referenced in section 3(b). If conduct occurred after 1 February 2021, the compounding eligibility may depend on whether the updated PDPA provisions fall within the Regulations’ scope (and whether other regulations or amendments address the post-amendment offence text).
Section 4 (Revocation) revokes the earlier Personal Data Protection (Composition of Offences) Regulations 2013 (G.N. No. S 759/2013). This means the 2021 Regulations replace the 2013 framework for compounding. Practitioners should therefore treat the 2021 instrument as the controlling subsidiary legislation for compounding eligibility from its commencement date, while also considering whether any transitional issues arise for offences committed before 1 February 2021.
How Is This Legislation Structured?
The Composition Regulations are structured as a short set of four sections:
Section 1 deals with citation and commencement.
Sections 2 and 3 are the operative provisions. They list the specific PDPA offences that may be compounded, and they do so by linking each list to a particular PDPA compounding subsection: s 55(1) and s 55(2) respectively.
Section 4 revokes the earlier 2013 Regulations.
Notably, the Regulations do not themselves set out the mechanics of compounding (such as the composition sum, procedure, or consequences). Those details are governed by the PDPA, particularly section 55 and related provisions. The Regulations therefore function as a “designation” instrument: they identify which offences fall within the compounding power.
Who Does This Legislation Apply To?
The Composition Regulations apply to matters where PDPC considers compounding offences under the PDPA. In practice, this typically concerns organisations (and potentially individuals, depending on how the underlying PDPA offences are framed) that are alleged to have committed specified PDPA offences.
Because the Regulations are offence-specific, the key question for applicability is not the type of regulated entity (e.g., whether it is a business, public agency, or other data user), but rather whether the alleged conduct constitutes an offence under the particular PDPA sections referenced in the Regulations: s 51(1), s 61(2), s 42(2), and s 43(2), s 44(2), s 45(2) (as in force immediately before 1 February 2021).
Why Is This Legislation Important?
Although the Composition Regulations are brief, they have real consequences for enforcement outcomes. Compounding can significantly affect risk management and legal strategy. For an organisation facing PDPC allegations, the availability of compounding means there may be an opportunity to resolve the matter without the uncertainty, cost, and reputational impact associated with criminal proceedings.
From a practitioner’s standpoint, the Regulations also provide clarity on which offences are eligible for compounding and under which PDPA compounding pathway. This can influence early-stage decisions, including whether to engage PDPC proactively, how to structure internal investigations, and how to present remedial actions and compliance improvements.
Finally, the transitional drafting in section 3(b) underscores the importance of timing. If alleged conduct occurred around the 1 February 2021 threshold, counsel must determine which version of the PDPA offence provisions applies. Misalignment between the alleged conduct date and the referenced “as in force immediately before” provisions could lead to incorrect assumptions about compounding eligibility and the applicable enforcement framework.
Related Legislation
- Personal Data Protection Act 2012 (Act 26 of 2012) — in particular section 55 (composition of offences) and the underlying offence provisions referenced in the Regulations (sections 42, 43, 44, 45, 51, and 61).
- Personal Data Protection (Composition of Offences) Regulations 2013 (G.N. No. S 759/2013) — revoked by section 4 of the 2021 Regulations.
Source Documents
This article provides an overview of the Personal Data Protection (Composition of Offences) Regulations 2021 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the official text for authoritative provisions.