In Singapore, data breaches are no longer just an IT issue—they carry severe legal and financial consequences. Under Section 24 of the Personal Data Protection Act (PDPA)—known as the Protection Obligation—organizations are legally required to make “reasonable security arrangements” to prevent unauthorized access, collection, use, disclosure, or copying of personal data.
Failure to meet Section 24 compliance can lead to financial penalties from the Personal Data Protection Commission (PDPC) of up to 10% of an organization’s annual turnover in Singapore (or S$1 million, whichever is higher).
High-profile enforcement actions show that data leaks rarely happen because of sophisticated nation-state exploits. Instead, attackers systematically exploit subtle application logic flaws to exfiltrate bulk personal data (PII).
This is where Vulnerability Assessment and Penetration Testing (VAPT) becomes essential. By simulating real-world cyberattacks, ethical hackers uncover critical weaknesses in your web applications, APIs, and AI integrations before malicious actors can weaponize them.
Here are 5 common application vulnerabilities that trigger PDPA breaches—and how penetration testing protects your organization under Section 24.
1. Broken Access Control (Accessing Another User’s or Tenant’s Data)
- PDPA Risk: Unauthorized Disclosure of Personal Data (Section 24 Violation).
- The Flaw: Broken access control occurs when an application fails to verify whether a logged-in user has permission to view specific records. A classic example is Insecure Direct Object References (IDOR), where changing an ID in a URL (e.g.,
user_id=101to102) exposes another customer’s NRIC, contact details, or financial statements. - How Pen-Testing Helps: Testers manipulate session tokens and parameter values across different authorization levels to ensure strict data isolation between users and enterprise tenants.
2. Unauthenticated API Access (Exposing Data Without Logging In)
- PDPA Risk: Failure to Prevent Unauthorized Access.
- The Flaw: Modern web and mobile applications rely heavily on APIs. Developers sometimes leave backend API endpoints exposed without authentication mechanisms, relying on “security through obscurity” (assuming attackers won’t guess the endpoint URL).
- How Pen-Testing Helps: Using automated discovery and endpoint mapping, penetration testers identify hidden or undocumented API routes that leak personal data without requiring a valid login.
3. Excessive Data Exposure (Returning More Personal Data Than Necessary)
- PDPA Risk: Violation of Data Minimization & Security Protection Principles.
- The Flaw: Applications often rely on the frontend interface to filter out hidden information. However, the backend API might send the entire database record—including unmasked NRICs, birthdates, or internal identifiers—in the underlying HTTP response.
- How Pen-Testing Helps: Testers inspect raw API payloads (JSON/XML) to catch hidden data leakage, ensuring your applications transmit only the minimal data required for the user’s immediate screen view.
4. Insufficient Rate Limiting (Data Harvesting at Scale)
- PDPA Risk: Failure to Safeguard Against Automated Exfiltration.
- The Flaw: If your search portals, login screens, or account-lookup endpoints lack request throttling, malicious actors can deploy automated scripts to scrape personal data at scale or execute brute-force attacks without triggering security alerts.
- How Pen-Testing Helps: Ethical hackers test your application’s anti-automation defenses, attempting rapid-fire queries to verify that rate limiting and IP throttling effectively block scraping attempts.
5. Security Misconfiguration & Information Disclosure (Including AI Chatbot Risks)
- PDPA Risk: Inadequate Technical Security Measures.
- The Flaw: This broad category includes verbose error messages that reveal database tables, unencrypted storage buckets, and default admin credentials. Today, it increasingly involves LLM-powered AI Chatbots. Without strict guardrails, an AI chatbot can be exploited via prompt injection—tricking the LLM into bypassing its instructions to expose internal company knowledge bases, system secrets, or other customers’ chat logs.
- How Pen-Testing Helps: Penetration testers conduct server configuration audits and specialized AI security assessments (including prompt injection testing) to guarantee conversational tools cannot be manipulated to leak sensitive data.
Proactive Defense: Meeting the PDPC’s Expectation
When the PDPC investigates a data breach, one of their primary questions is: Did the organization conduct regular technical security assessments prior to deployment to fulfill its Section 24 duties?
A well-executed VAPT serves as clear evidence of technical due diligence under the PDPA. By identifying and patching these 5 application vulnerabilities today, you protect your customers’ privacy, uphold your organization’s reputation, and avoid costly regulatory penalties.
Need help assessing your organisation’s security?
Find out how Perennial Consultancy can help identify vulnerabilities and strengthen the protection of your organisation’s personal data through VAPT.
Government Funding Available: If you are a Singapore SME, your organization may be eligible for up to 70% co-funding support under the Cyber Security Agency of Singapore (CSA) CISO-as-a-Service (CISOaaS) scheme.
