1. Introduction

Privacy and confidentiality breach claims in Singapore concern the unlawful collection, use, disclosure, access, retention, misuse, or distribution of personal and confidential information.

These disputes arise when individuals, companies, employers, financial institutions, healthcare providers, technology platforms, government contractors, or professional service providers fail to protect information entrusted to them.

Singapore recognises several legal mechanisms for protecting privacy and confidentiality, including:

The Personal Data Protection Act 2012 (PDPA).

The common-law action for breach of confidence.

Contractual confidentiality obligations.

Equitable remedies and fiduciary duties.

Copyright and other intellectual property protections, where applicable.

Cybersecurity and sector-specific regulatory obligations.

Central legal question: When personal information or confidential material is improperly accessed, disclosed, or misused, what civil remedies are available to the affected individual or organisation under Singapore law?

An important distinction is that Singapore does not generally recognise a free-standing, comprehensive common-law tort of invasion of privacy. Instead, privacy-related claims usually rely on statutory personal-data protection, breach of confidence, contractual obligations, and other established causes of action.

2. Meaning and scope of privacy and confidentiality breaches

Privacy and confidentiality are related but legally distinct concepts.

Examples of privacy breaches

Unauthorised disclosure of customer information.

Publication of medical records.

Exposure of identity documents.

Misuse of biometric information.

Unlawful sharing of employee information.

Unauthorised access to financial records.

Disclosure of private communications.

Improper use of personal data for marketing.

Examples of confidentiality breaches

Disclosure of trade secrets.

Misuse of confidential business strategies.

Disclosure of privileged or confidential legal documents.

Misuse of confidential employment information.

Unauthorised sharing of client information.

Disclosure of confidential financial transactions.

3. Applicable legal framework in Singapore

A. Personal Data Protection Act 2012

The PDPA is the principal legislation regulating personal data protection in Singapore's private sector.

Its framework includes the following obligations:

The Protection Obligation under section 24 is particularly important.

An organisation must make reasonable security arrangements to protect personal data in its possession or under its control against unauthorised access, collection, use, disclosure, copying, modification, disposal, or similar risks.

Example: A financial institution stores customer identification documents on an inadequately secured server. Hackers obtain access and disclose the documents. The affected individuals may have grounds to pursue available legal remedies, depending on the statutory requirements and evidence.

B. Common-law breach of confidence

The action for breach of confidence protects information that has been communicated or obtained in circumstances importing an obligation of confidence.

Generally, the claimant must establish:

The information possessed the necessary quality of confidence.

The information was communicated or obtained in circumstances importing an obligation of confidence.

There was unauthorised use or disclosure, or threatened misuse.

This protection extends beyond personal information to commercial, professional, financial, and technical information.

C. Contractual confidentiality obligations

Confidentiality clauses are common in:

Employment agreements.

Banking agreements.

Healthcare arrangements.

Consultancy contracts.

Technology service agreements.

Commercial partnerships.

Non-disclosure agreements.

A party that breaches an enforceable confidentiality obligation may face contractual damages and, where appropriate, injunctive relief.

D. Fiduciary obligations

Professionals who owe fiduciary duties may also be liable when they improperly use confidential information obtained through their position.

Examples include lawyers, trustees, directors, and certain financial advisers.

E. Sector-specific regulation

Additional requirements may arise under legislation and regulatory frameworks applicable to banking, healthcare, telecommunications, cybersecurity, and financial services.

4. Important Singapore case laws

The following cases are particularly relevant to privacy, confidential information, unauthorised access, misuse of personal data, and remedies. They include direct Singapore authorities and decisions that clarify the legal framework.

Case 1. I-Admin (Singapore) Pte Ltd v Hong Ying Ting and others [2020] SGCA 32

Leading Court of Appeal authority

Facts: I-Admin, a payroll-processing and HR software company, alleged that former employees had accessed, downloaded, retained, and circulated its confidential business materials and client information without permission.

Legal issue: Whether possession and unauthorised acquisition of confidential information could constitute breach of confidence even without proof of subsequent commercial use.

Decision: The Court of Appeal modified the traditional approach to breach of confidence. Once the claimant establishes that the information has the necessary quality of confidence and was acquired in circumstances importing an obligation of confidence, an action is presumed. The defendant must then show that their conscience was unaffected.

Legal principles:

Confidentiality can be breached through unauthorised acquisition or possession.

Actual commercial exploitation is not always necessary.

Confidential information receives equitable protection.

Courts can grant injunctions and monetary remedies.

Relevance: This is especially important in cases involving hacked databases, unauthorised copying of customer records, and employees downloading confidential files.

Case 2. Adinop Co Ltd v Rovithai Ltd and another [2019] SGCA 67

Leading commercial confidentiality authority

Facts: Adinop disclosed customer information to Rovithai for a specific commercial purpose under a distributorship arrangement. The information was subsequently used for another purpose.

Legal issue: Whether customer information supplied for a limited commercial purpose was protected by an equitable duty of confidence.

Decision: The Court of Appeal found that Rovithai had breached its equitable duty of confidence by using the customer information for an unauthorised purpose.

Legal principles:

Customer information can possess the necessary quality of confidence.

The circumstances of disclosure may create an equitable confidentiality obligation.

Information supplied for one purpose cannot automatically be used for another.

A claimant must establish the necessary connection between the breach and the claimed loss.

Relevance: This case is particularly applicable to customer database misuse, unauthorised marketing, commercial data sharing, and disclosure of personal information to third parties.

eLitigation

Case 3. Clearlab SG Pte Ltd v Ting Chong Chai and others [2014] SGHC 221

Facts: Former employees allegedly took confidential technical documents, manufacturing information, business records, and other proprietary materials to establish a competing business.

Legal issue: Whether the former employees and associated parties had breached their obligations of confidence.

Decision: The High Court found substantial breaches of confidence involving the unauthorised taking and use of confidential business information.

Legal principles:

Confidential information must be sufficiently identifiable.

Information need not be completely secret to qualify for protection.

Employment relationships can create express and equitable confidentiality obligations.

Former employees cannot misuse their former employer's confidential information.

Relevance: This case is important for employers facing employee data theft, unauthorised copying of client records, and misuse of confidential internal documents.

eLitigation+1

Case 4. PH Hydraulics & Engineering Pte Ltd v Intrepid Offshore Construction Pte Ltd and another [2012] 4 SLR 36

Facts: The dispute involved commercial information and allegations concerning misuse of confidential material in a business relationship.

Legal issue: Whether the information and circumstances of disclosure established an obligation of confidence.

Decision: The Singapore Court of Appeal addressed the established elements of breach of confidence.

Legal principles:

The information must possess the necessary quality of confidence.

It must have been imparted in circumstances importing an obligation of confidence.

There must be unauthorised use to the detriment of the party communicating it, under the traditional formulation.

Relevance: The case provides a foundational framework for disputes involving confidential technical documents, business information, and contractual relationships.

Case 5. X Pte Ltd v CDE [1992] 2 SLR(R) 575

Facts: The dispute concerned the protection of confidential information and the circumstances in which an obligation of confidence arises.

Legal issue: Whether information disclosed in particular circumstances attracted equitable protection.

Legal principle: The case is an important Singapore authority applying the traditional principles of breach of confidence derived from Coco v AN Clark (Engineers) Ltd.

Relevance: It helps establish when confidential business information, professional communications, and other sensitive material can receive protection under Singapore law.

Case 6. RB Investments Pte Ltd v Kardachi, Jason Aleksander and others [2023] SGHC 274

Facts: The dispute involved confidential information, legal privilege, and the circumstances in which information received by third parties may attract an obligation of confidentiality.

Legal issue: Whether third parties who obtain confidential information can become subject to equitable confidentiality obligations.

Legal principles:

A third party may owe confidentiality obligations when the confidential nature of information is apparent.

An obligation of confidence can arise without a direct contractual relationship.

The claimant must establish the necessary circumstances giving rise to the duty.

Relevance: This is important for data processors, external consultants, cloud service providers, and third-party recipients of confidential documents.

laws.sg

Case 7. Tan Tung Wee Eddie v Singapore Health Services Pte Ltd [2025] SGHC 10

Important healthcare confidentiality authority

Facts: A healthcare professional accessed medical records of patients who were not under his care. He subsequently challenged his dismissal.

Legal issue: Whether the employee was justified in accessing confidential patient records without authorisation.

Decision: The High Court dismissed his damages claim. It held that he had not established justification for accessing the medical records of patients who were not under his care. The court also rejected his reliance on a whistleblower justification.

Legal principles:

Medical records are subject to strong confidentiality protections.

Employment within a healthcare institution does not confer unrestricted access to patient information.

Professional access must be justified by legitimate responsibilities and applicable authorisation.

Unauthorised access may constitute a breach of patient confidentiality.

Relevance: This case is particularly significant for hospitals, doctors, nurses, healthcare administrators, and medical-data platform operators.

eLitigation

Case 8. Farm to Fork Sdn Bhd v Adamas SG Pte Ltd and another [2024] SGHC 286

Facts: The litigation concerned contractual and commercial obligations, including allegations of misuse of confidential information.

Legal issue: Whether the parties' contractual arrangements and conduct gave rise to enforceable obligations and liability.

Relevance: It provides a recent example of how confidentiality obligations can be examined alongside contractual and commercial claims.

It is useful for analysing confidentiality clauses in consultancy, business outsourcing, and commercial service arrangements.

eLitigation

5. Civil liability arising from different types of privacy breaches

A. Unauthorised disclosure of personal information

This occurs when an organisation or individual discloses personal information without appropriate legal authority.

Examples include:

Disclosure of customer databases.

Sharing employee salary information.

Publishing private addresses.

Unauthorised disclosure of identity documents.

Sharing patient information with unrelated parties.

Potential liability:

An affected person may pursue a PDPA private action if the requirements of section 48O are satisfied. A separate breach-of-confidence claim may also be available where the relevant equitable requirements are established.

B. Medical privacy and confidentiality claims

Medical records contain particularly sensitive information.

Potential breaches include:

Unauthorised access to patient records.

Disclosure of medical diagnoses.

Publication of psychiatric records.

Sharing genetic information without authority.

Disclosure of medical information to employers.

Improper access by healthcare employees.

Relevant authority: Tan Tung Wee Eddie v Singapore Health Services Pte Ltd [2025] SGHC 10.

Healthcare institutions should maintain role-based access controls, access logs, staff confidentiality policies, and appropriate disciplinary procedures.

C. Employee privacy and workplace surveillance

Employers may collect and process employee information for legitimate employment purposes, but they must comply with applicable legal obligations.

Disputes can involve:

Monitoring private communications.

Unauthorised disclosure of salary details.

Collection of excessive biometric data.

Improper use of CCTV recordings.

Disclosure of disciplinary records.

Unauthorised sharing of employee performance information.

The legality of workplace monitoring depends on the circumstances, applicable PDPA requirements, employment arrangements, and other relevant laws.

D. Banking and financial confidentiality

Financial information can include account balances, transactions, credit records, loan applications, and investment details.

Potential claims arise from:

Unauthorised disclosure of account information.

Misuse of customer transaction records.

Disclosure of confidential financial documents.

Improper sharing of credit information.

Inadequate protection of banking databases.

Banking secrecy obligations under Singapore legislation may also be relevant, including section 47 of the Banking Act 1970 and its applicable exceptions.

E. Digital platform and cybersecurity breaches

Technology companies and online platforms may face civil claims arising from:

Database hacking.

Credential theft.

Unauthorised account access.

Exposure of private messages.

Cloud-storage failures.

Improper sharing of user profiles.

Misuse of biometric identifiers.

A company may face regulatory action as well as civil litigation, depending on the breach and applicable statutory requirements.

F. Commercial and trade-secret confidentiality

Businesses may pursue claims when confidential commercial information is improperly obtained or disclosed.

Examples include:

Customer lists.

Manufacturing processes.

Business plans.

Pricing strategies.

Software source code.

Research and development information.

The decisions in I-Admin, Adinop, and Clearlab are particularly important in this category.

6. Private civil action under section 48O of the PDPA

Section 48O is especially significant because it provides a statutory route for private civil proceedings.

A person who suffers loss or damage directly as a result of specified contraventions of the PDPA may bring an action in court.

The provision covers specified contraventions by organisations and persons under the statutory categories identified in the section.

Requirements for a claim

A claimant should establish:

The defendant committed a contravention covered by section 48O.

The claimant suffered loss or damage.

The loss or damage resulted directly from the contravention.

The statutory requirements for bringing the proceedings have been satisfied.

Remedies

The court may grant:

Injunctions.

Declarations.

Damages.

Other appropriate relief.

Important distinction: A PDPA breach does not automatically entitle every affected individual to damages. The claimant must establish the statutory requirements, including directly resulting loss or damage. The PDPC's regulatory enforcement powers are separate from an individual's private civil action.

Singapore Statutes Online

7. Available civil remedies in Singapore

Example

Suppose a Singapore company maintains a database containing 100,000 customers' personal information.

An employee downloads the database and transfers it to a competing business.

The original company may consider:

A breach-of-confidence claim.

A contractual confidentiality claim.

Copyright claims, if protected works were copied.

Injunctive relief.

Delivery-up or destruction orders.

Affected customers may separately consider a PDPA private action if they satisfy section 48O.

8. Important regulatory and institutional dimensions

Personal Data Protection Commission

The Personal Data Protection Commission (PDPC) administers and enforces the PDPA.

Its regulatory functions include:

Investigating suspected data protection breaches.

Assessing compliance with organisational obligations.

Issuing directions.

Imposing financial penalties where authorised.

Publishing decisions and guidance.

SingHealth data breach

An important regulatory example is the SingHealth cybersecurity incident.

Singapore Health Services Pte Ltd and Integrated Health Information Systems Pte Ltd [2019] SGPDPC 3

The incident involved the exfiltration of personal data relating to approximately 1.5 million patients, including outpatient prescription information relating to nearly 160,000 patients.

The PDPC examined the organisations' data protection and security responsibilities.

Legal significance: The incident demonstrates that organisations handling large volumes of sensitive information must maintain appropriate technical and organisational safeguards.

This is a regulatory decision, not a reported civil court judgment.

Personal Data Protection Commission

9. Defences and limitations in privacy and confidentiality litigation

Defendants may rely on several arguments, depending on the nature of the claim.

1. Valid consent: The collection, use, or disclosure was authorised by legally sufficient consent.

2. Statutory exception: The relevant conduct was permitted under an applicable PDPA exception or other legislation.

3. Absence of confidentiality: The information was already publicly available or lacked the necessary quality of confidence.

4. No obligation of confidence: The circumstances did not create an express, implied, or equitable confidentiality obligation.

5. Public interest: Disclosure was justified by a sufficiently strong public interest in the circumstances.

6. Absence of causation: The alleged breach did not cause the claimant's asserted loss.

7. No legally recoverable damage: The claimant cannot establish the loss or damage required for the particular cause of action.

8. Authorised access: The defendant accessed or used the information within the scope of legitimate authority.

The availability of each defence depends on the particular statutory or common-law claim.

10. Emerging legal challenges in Singapore

Special concern: AI and confidential information

AI systems create additional confidentiality risks because information may be:

Uploaded to third-party platforms.

Retained in external systems.

Used for model development.

Disclosed through insecure integrations.

Exposed through inadequate access controls.

Organisations should assess whether the information is personal data, confidential business information, or both.

They should also examine consent, notification, security, retention, transfer, and contractual requirements.

11. Practical compliance framework for Singapore organisations

Privacy and Confidentiality Protection Framework

Data classification

Identify personal, sensitive, commercial, and legally confidential information.

Consent and purpose control

Establish appropriate authority for collecting, using, and disclosing personal data.

Access management

Restrict access according to employees' and contractors' responsibilities.

Encryption and security

Apply appropriate technical and organisational safeguards.

Third-party agreements

Establish enforceable confidentiality and data-processing obligations.

Breach response

Investigate incidents and comply with applicable notification requirements.

Retention and deletion

Retain information only as permitted or required by applicable law.

Audit and accountability

Maintain records of access, disclosure, investigations, and remedial action.

12. Conclusion

Civil Law and Privacy and Confidentiality Breach Claims in Singapore involve an important combination of statutory data protection, equitable confidentiality, contractual liability, and professional responsibility.

The PDPA establishes the principal statutory framework for personal data protection, while the common law of confidence protects information obtained or held under circumstances importing confidentiality obligations.

The most significant authorities include:

I-Admin (Singapore) Pte Ltd v Hong Ying Ting [2020] SGCA 32.

Adinop Co Ltd v Rovithai Ltd [2019] SGCA 67.

Clearlab SG Pte Ltd v Ting Chong Chai [2014] SGHC 221.

PH Hydraulics & Engineering Pte Ltd v Intrepid Offshore Construction [2012] 4 SLR 36.

X Pte Ltd v CDE [1992] 2 SLR(R) 575.

RB Investments Pte Ltd v Kardachi [2023] SGHC 274.

Tan Tung Wee Eddie v Singapore Health Services Pte Ltd [2025] SGHC 10.

Farm to Fork Sdn Bhd v Adamas SG Pte Ltd [2024] SGHC 286.

Overall legal principle: Individuals and organisations entrusted with personal or confidential information must respect the legal restrictions governing its collection, access, use, retention, and disclosure. Unauthorised handling can result in statutory, contractual, equitable, and other civil liability.

Research note: The above cases address different aspects of confidentiality and privacy-related obligations. Not all are direct PDPA damages actions. The statutory private-action requirements must be assessed separately from common-law breach-of-confidence claims.