The Migration Went Smoothly. Six Months Later, PDPC Said Otherwise.

You finish a system migration on a Friday. Nothing breaks. No error messages, no angry calls from customers, no red flags in the dashboard. Everyone moves on to the next thing.

That quiet is usually taken as proof it worked.

It isn't. It's only proof that nothing went wrong loudly enough to notice yet.

What actually happened

In March 2023, Marina Bay Sands migrated part of its systems to a new platform. As part of that work, one employee manually compiled the API configuration involved — by hand, without a second person checking it afterwards.

One identifier, tied to a single webpage, was left out of that configuration. That gap meant the page could be reached without the access controls that were supposed to sit around it, exposing personal data belonging to 665,495 rewards members: names and contact details.

Nobody caught it that day. Nobody caught it that month. It ran for around six months before anyone noticed.

PDPC's decision, published in October last year, found MBS in breach of the Protection Obligation under the PDPA and imposed a financial penalty of S$315,000. (PDPC press release)

Why this keeps happening

What's notable about this case isn't the technology. It's how ordinary the failure was.

A migration is exactly the kind of task that gets handed to one capable person, because it's specialised and time-pressured, and because everyone assumes competence is the same thing as a completed check. It usually is. The work is usually done well.

The problem isn't the person. It's that the task had no second step. Nobody was asked to verify the configuration against what it should have been. Nothing was watching afterwards to flag that a page was reachable in a way it shouldn't be.

That combination — a manual task, done once, by one person, with no review and no ongoing check — is common in businesses of every size. It isn't usually a sign of carelessness. It's a sign that the task was treated as finished the moment it stopped causing visible problems.

Why it matters even if you're nowhere near this size

It's tempting to read a case like this and file it under "that's a big-company problem." MBS has legal, compliance and IT resources that most Singapore SMEs simply don't have. And it still came down to one unchecked step.

That cuts the other way for smaller businesses, not in their favour. PDPC's finding wasn't that MBS lacked resources. It was that MBS lacked a process — a verification step, a monitoring mechanism — that would have caught the gap regardless of resourcing. A smaller company doesn't need MBS's budget to have that same process. It needs the habit of never letting a change to personal data go live unchecked, and something that would eventually flag it if it did.

The PDPA's Protection Obligation doesn't set a bar of "protect data as well as your resources allow." It expects reasonable security arrangements to prevent unauthorised access, and "reasonable" doesn't scale down just because the company is small.

What to check before your next system change

You don't need an audit programme to close this gap. You need honest answers to a few questions, asked before the next migration, form update, vendor switch or integration — not after.

  • When personal data is involved, does any system, form or integration change go live without someone other than the person who made it checking the result?
  • If a page, API or export became reachable by mistake, is there anything that would actually notice — or does discovery depend on someone stumbling onto it?
  • Do you know, right now, which of your systems handle personal data and who is responsible for changes to each one?
  • If a change like this happened tomorrow, how long do you think it would run before anyone noticed?

If any of those answers make you uneasy, that's useful information. It's cheaper to find now than in a PDPC decision.

The unglamorous fix

None of this is exciting work. It's a second set of eyes on changes that touch personal data, and something ongoing that would flag when data is reachable that shouldn't be. Most SMEs don't have a gap in intent here — they have a gap in follow-through, because whoever owns data protection is usually doing two or three other jobs, and a completed migration looks exactly like a safe one.

That follow-through is what we help build into how a business actually runs at Veritos, turning "someone should check this" into a task that's visible, owned and doesn't quietly go unwatched once the immediate work is done.

The Marina Bay Sands case is a couple of years old now. The lesson in it hasn't aged at all: the moment nothing seems to have broken is exactly when it's worth checking that nothing did.