个人数据违规：会面临什么后果？Personal-data violations: what can happen?

先看适用法律Start with the applicable law

AI项目涉及个人数据时，应先判断PDPA是否适用，以及收集、使用、披露、保护等环节是否合规。处罚针对具体违法行为，不是因为“使用AI”就自动产生。First assess PDPA applicability and the collection, use, disclosure and protection of personal data. Penalties concern contraventions, not the mere use of AI.

罚款上限不是固定罚款A ceiling is not an automatic fine

符合相关执法条件时，新加坡年营业额超过1,000万新元的机构，相关财务处罚上限为新加坡年营业额的10%；其他情况上限为100万新元。营业额为2,000万新元时，相关上限为200万新元，并不意味着每次都罚200万。For qualifying enforcement, the ceiling is 10% of annual Singapore turnover above S$10 million, and S$1 million otherwise. At S$20 million turnover, S$2 million is the relevant ceiling—not an automatic fine.

不只有罚款More than a financial penalty

还可能有整改指示。应结合事实、适用条文和执法决定理解后果，不能把这里的上限直接套用到每个事件或其他国家。Remedial directions may also apply. Outcomes depend on facts, provisions and decisions; do not apply these ceilings automatically to every incident or jurisdiction.

企业怎么准备Practical preparation

实务建议：建立个人数据清单、明确负责人、保留权限及供应商管理记录，并准备事件响应流程。这是管理建议，不是保证免罚的条件。Practical suggestions: maintain a data inventory, ownership, access and vendor records, and incident procedures. These are management recommendations, not a guarantee against enforcement.

资料依据Source attribution

PDPA 第48I、48J条；PDPC 2022年执法修订说明 / PDPA Sections 48I, 48J; PDPC enforcement update, 2022

保留出处供核验；本页以本站整理的解读为主，不要求跳转外部网站才能阅读。Sources are identified for verification. The explanation is provided here without requiring a visit to an external site.