The Personal Data Protection Commission (“the
Commission”) issued a Warning to Specialized Asia Pacific
Pte. Ltd. (“SAP”) for breach its personal data
protection obligations under Section 24 of the Personal Data
Protection Act (“PDPA”).
Specialized Asia Pacific Pte. Ltd. is a wholesale company of
sporting products and equipment including bicycles and healthcare
equipment, established in 2009 in Singapore.
Context
On 29 January 2021, SAP informed the Commission of an incident
breach of data security relating to its Specialized Cadence
Application that it developed, operated, and maintained. The
application, which had a default privacy setting which made
all the data created by users or developers to be visible to any
third party who could use a third-party security testing software
to intercept such data. As a result of this default privacy
setting, the personal data of 2,445 individuals were at risk of
unauthorized access. The personal data included names,
