top of page
Search

Larsen & Toubro Infotech Limited Singapore Branch Fined $108,000


Data breaches have become increasingly common, causing significant financial, reputational, and legal consequences for businesses. One such case involves Larsen & Toubro Infotech Limited Singapore Branch, which has been fined $108,000 for breaching data protection obligations by the Personal Data Protection Commission (PDPC). This decision by the PDPC highlights the importance of complying with data protection regulations to safeguard the personal data of individuals. In this blog post, we will discuss the details of the case and the lessons that businesses can learn from it.


What Happened?

Larsen & Toubro Infotech Limited Singapore Branch is a global IT services and solutions provider that offers software development, consulting, and technology services. In May 2021, the PDPC found that the company had breached several obligations under Singapore’s Personal Data Protection Act (PDPA) in connection with a data breach that occurred in 2020. The data breach involved the exposure of the personal data of 66,896 individuals, including their names, national identification numbers, contact details, and employment information.


The PDPC found that Larsen & Toubro Infotech Limited Singapore Branch had failed to put in place reasonable security arrangements to protect the personal data of individuals, as required under the PDPA. The company had also failed to make reasonable efforts to ensure that its overseas vendor, who was responsible for managing the affected system, complied with the PDPA. Additionally, the company had failed to notify the affected individuals and the PDPC of the data breach in a timely manner, as required under the PDPA.


Potential Penalties?

As a result of the breaches, the PDPC has imposed a financial penalty of $108,000 on Larsen & Toubro Infotech Limited Singapore Branch. In addition, the company has been directed to appoint an independent third-party assessor to review its data protection policies and practices and to implement remedial measures where necessary.


What Can We Learn from This?

The case of Larsen & Toubro Infotech Limited Singapore Branch provides several lessons for businesses in relation to data protection compliance. Firstly, businesses must ensure that they have in place reasonable security arrangements to protect the personal data of individuals. This includes identifying and assessing security risks, implementing security measures to address those risks, and regularly reviewing and updating those measures.


Secondly, businesses must ensure that their overseas vendors comply with data protection regulations, where applicable. This includes conducting due diligence on the vendors’ data protection policies and practices, and putting in place contractual arrangements that require the vendors to comply with the relevant data protection obligations.


Thirdly, businesses must ensure that they notify affected individuals and the relevant authorities of any data breaches in a timely manner. Notification should be made as soon as practicable, and must include details of the breach, the personal data affected, and the remedial measures that have been taken or will be taken.


Takeaways:

The case of Larsen & Toubro Infotech Limited Singapore Branch serves as a reminder of the importance of complying with data protection obligations. Businesses must take all necessary steps to safeguard the personal data of individuals, and failure to do so may result in significant penalties and reputational damage. By implementing reasonable security measures, conducting due diligence on overseas vendors, and promptly notifying affected individuals and authorities of any data breaches, businesses can mitigate the risks associated with data protection breaches.


As technology continues to evolve and data becomes increasingly valuable, it is crucial for businesses to prioritize data protection and privacy. With the PDPC’s decision to fine Larsen & Toubro Infotech Limited Singapore Branch, businesses in Singapore must take heed and ensure that they are fully compliant with the PDPA. By doing so, they can not only avoid financial and legal penalties but also build trust with their customers and stakeholders.


References:

Disclaimer: The information provided on all our blog post is intended for general informational purposes only and does not constitute legal advice. The author and publisher are not liable for any damages or losses resulting from reliance on this information. It is recommended to consult with a legal professional for specific advice regarding PDPA compliance and other related data privacy obligations.

bottom of page