PART 6 | Codes of practice and standards of performance |
35A.—(1) The Commissioner may, from time to time —| (a) | issue or approve one or more codes of practice or standards of performance for the regulation of the following persons with respect to measures to be taken by them to ensure the cybersecurity of the computers or computer systems indicated:| (i) | owners of provider-owned critical information infrastructure — the provider-owned critical information infrastructure; | | (ii) | designated providers responsible for third‑party‑owned critical information infrastructure — the third-party-owned critical information infrastructure for which they are responsible; | | (iii) | owners of systems of temporary cybersecurity concern — the systems of temporary cybersecurity concern; | | (iv) | entities of special cybersecurity interest — the systems of special cybersecurity interest in relation to which they are designated; | | (v) | major foundational digital infrastructure service providers — the major foundational digital infrastructure in relation to which they are designated; and |
| | (b) | amend or revoke any code of practice or standard of performance issued or approved under paragraph (a). |
| (2) If any provision in any code of practice or standard of performance is inconsistent with this Act, the provision, to the extent of the inconsistency, does not have effect. |
(3) Where a code of practice or standard of performance is issued, approved, amended or revoked by the Commissioner under subsection (1), the Commissioner must —| (a) | publish a notice of the issue, approval, amendment or revocation (as the case may be) in such manner as will secure adequate publicity for such issue, approval, amendment or revocation; | | (b) | specify in the notice the date of the issue, approval, amendment or revocation (as the case may be); and | | (c) | ensure that, so long as the code of practice or standard of performance remains in force, copies of that code or standard, and of all amendments to that code or standard, are available free of charge to a person to whom that code or standard applies. |
|
(4) None of the following has any effect until the notice relating to it is published in accordance with subsection (3):| (a) | a code of practice or standard of performance; | | (b) | an amendment to a code of practice or standard of performance; | | (c) | a revocation of a code of practice or standard of performance. |
|
| (5) Any code of practice or standard of performance has no legislative effect. |
| (6) Subject to subsections (4) and (7), every person mentioned in subsection (1) must comply with the codes of practice and standards of performance that apply to the person. |
| (7) The Commissioner may, either generally or for such time as the Commissioner may specify, waive the application to a person of any code of practice or standard of performance, or any part of it. [Act 19 of 2024 wef 31/10/2025] |
|
| Appeal to Minister against decision, etc., under Parts 3, 3A, 3B, 3C and 3D, etc. |
35B.—(1) This section applies to appeals to the Minister against any decision, order or written direction of the Commissioner under Part 3, 3A, 3B, 3C or 3D set out in subsection (2), or any code of practice or standard of performance issued, approved or amended by the Commissioner.(2) A person who is aggrieved by —| (a) | the decision of the Commissioner to issue a notice under —| (i) | section 7(1) or (1A) designating the provider‑owned critical information infrastructure as such; | | (ii) | section 16A(1) designating the designated provider responsible for third-party-owned critical information infrastructure as such; | | (iii) | section 17(1) designating the system of temporary cybersecurity concern as such; | | (iv) | section 18(1) designating the entity of special cybersecurity interest as such; or | | (v) | section 18G(1) designating the major foundational digital infrastructure service provider as such; |
| | (b) | the decision of the Commissioner to issue a notice under —| (i) | section 9A(1) extending the designation of the provider-owned critical information infrastructure as such; | | (ii) | section 16D(1) extending the designation of the designated provider responsible for third‑party‑owned critical information infrastructure as such; | | (iii) | section 17C(1) extending the designation of the system of temporary cybersecurity concern as such; | | (iv) | section 18C(1) extending the designation of the entity of special cybersecurity interest as such; or | | (v) | section 18J(1) extending the designation of the major foundational digital infrastructure service provider as such; |
| | (c) | an order of the Commissioner under section 16B(5), 16E(2), 16F(2) or (3), 16H(2), 16I(2) or 16J(2); | | (d) | a written direction of the Commissioner under section 12(1), 16(2), 16G(1), 16L(2), 17E(1), 18E(1) or 18L(1); or | | (e) | any provision in any code of practice or standard of performance issued or approved by the Commissioner that applies to the person, or any amendment made to it, |
| may appeal to the Minister against the decision, order, direction, provision or amendment in the manner prescribed. |
|
| (3) An appeal under subsection (2) must be made within 30 days after the date of the notice, order or direction, or the issue, approval or amendment (as the case may be) of the code of practice or standard of performance (as the case may be) or such longer period as the Minister allows in a particular case (whether allowed before or after the end of the 30 days). |
(4) Any person who makes an appeal to the Minister under subsection (2) must, within the period specified in subsection (3) —| (a) | state as concisely as possible the circumstances under which the appeal arises, and the issues and grounds for the appeal; and | | (b) | submit to the Minister all relevant facts, evidence and arguments for the appeal. |
|
(5) Where an appeal has been made to the Minister under subsection (2), the Minister may require —| (a) | any party to the appeal; and | | (b) | any person who is not a party to the appeal but appears to the Minister to have information that is relevant to the matters appealed against, |
| to provide the Minister with all such information as the Minister may require, whether for the purpose of deciding if an Appeals Advisory Panel should be established or for determining the appeal, and any person so required must provide the information in such manner and within such period as may be specified by the Minister. |
|
| (6) The Minister may dismiss an appeal of an appellant who fails to comply with subsection (4) or (5). |
| (7) Unless otherwise provided by this Act or allowed by the Minister, where an appeal is lodged under this section, the decision, order, direction or other thing appealed against must be complied with until the determination of the appeal. |
(8) The Minister may determine an appeal under this section —| (a) | by confirming, varying or reversing a decision, notice, order, direction, provision of a code of practice or standard of performance, or an amendment to such code or standard; or | | (b) | by directing the Commissioner to reconsider the Commissioner’s decision, notice, order, direction or provision of a code of practice or standard of performance, as the case may be. |
|
| (9) Before determining an appeal under subsection (8), the Minister may consult any Appeals Advisory Panel established for the purpose of advising the Minister in respect of the appeal but, in making such determination, is not bound by the advice of the Panel. |
| (10) The decision of the Minister in any appeal is final. |
| (11) The Minister may make regulations in respect of the manner in which an appeal may be made to, and the procedure to be adopted in the hearing of any appeal by, the Minister under this section. [Act 19 of 2024 wef 31/10/2025] |
|
35C.—(1) Where the Minister considers that an appeal lodged under section 35B(2) involves issues the resolution or understanding of which require particular technical skills or specialised knowledge, the Minister may establish an Appeals Advisory Panel to provide advice to the Minister in respect of the appeal.(2) For the purposes of establishing an Appeals Advisory Panel, the Minister may do all or any of the following:| (a) | determine, and from time to time vary, the terms of reference of the Appeals Advisory Panel; | | (b) | appoint persons possessing particular technical skills or specialised knowledge to be the chairperson and other members of an Appeals Advisory Panel; | | (c) | at any time remove the chairperson or other member of an Appeals Advisory Panel from such office; | | (d) | determine any other matter which the Minister considers incidental to or expedient for the proper and efficient conduct of business by the Appeals Advisory Panel. |
|
(3) An Appeals Advisory Panel may regulate its proceedings in such manner as it considers appropriate, subject to the following:| (a) | the quorum for a meeting of the Appeals Advisory Panel is a majority of its members; | | (b) | a decision supported by a majority of the votes cast at a meeting of the Appeals Advisory Panel at which a quorum is present is the decision of that Panel. |
|
| (4) The remuneration and allowances (if any) of a member of an Appeals Advisory Panel is to be determined by the Minister. |
| (5) An Appeals Advisory Panel is independent in the performance of its functions. [Act 19 of 2024 wef 31/10/2025] |
|
36.—(1) Where, in a proceeding for an offence under this Act, it is necessary to prove the state of mind of a corporation in relation to a particular conduct, evidence that —| (a) | an officer, employee or agent of the corporation engaged in that conduct within the scope of his or her actual or apparent authority; and | | (b) | the officer, employee or agent had that state of mind, |
| is evidence that the corporation had that state of mind. |
(2) Where a corporation commits an offence under this Act, a person —| (a) | who is —| (i) | an officer of the corporation, or a member of the corporation (in the case where the affairs of the corporation are managed by its members); or | | (ii) | an individual involved in the management of the corporation and in a position to influence the conduct of the corporation in relation to the commission of the offence; and |
| | (b) | who —| (i) | consented or connived, or conspired with others, to effect the commission of the offence; | | (ii) | is in any other way, whether by act or omission, knowingly concerned in, or is party to, the commission of the offence by the corporation; or | | (iii) | knew or ought reasonably to have known that the offence by the corporation (or an offence of the same type) would be or is being committed, and failed to take all reasonable steps to prevent or stop the commission of that offence, |
|
| shall be guilty of that same offence as is the corporation, and shall be liable on conviction to be punished accordingly. |
|
| (3) A person mentioned in subsection (2) may rely on a defence that would be available to the corporation if it were charged with the offence with which the person is charged and, in doing so, the person bears the same burden of proof that the corporation would bear. |
(4) To avoid doubt, this section does not affect the application of —| (a) | Chapters 5 and 5A of the Penal Code 1871; or | | (b) | the Evidence Act 1893 or any other law or practice regarding the admissibility of evidence. |
|
| (5) To avoid doubt, subsection (2) also does not affect the liability of the corporation for an offence under this Act, and applies whether or not the corporation is convicted of the offence. |
(6) In this section —| “corporation” includes a limited liability partnership within the meaning of section 2(1) of the Limited Liability Partnerships Act 2005; |
“officer”, in relation to a corporation, means any director, partner, chief executive, manager, secretary or other similar officer of the corporation, and includes —| (a) | any person purporting to act in any such capacity; and | | (b) | for a corporation whose affairs are managed by its members, any of those members as if the member were a director of the corporation; |
|
“state of mind” of a person includes —| (a) | the knowledge, intention, opinion, belief or purpose of the person; and | | (b) | the person’s reasons for the intention, opinion, belief or purpose. |
|
|
|
| Offences by unincorporated associations or partnerships |
37.—(1) Where, in a proceeding for an offence under this Act, it is necessary to prove the state of mind of an unincorporated association or a partnership in relation to a particular conduct, evidence that —| (a) | an employee or agent of the unincorporated association or the partnership engaged in that conduct within the scope of his or her actual or apparent authority; and | | (b) | the employee or agent had that state of mind, |
| is evidence that the unincorporated association or partnership had that state of mind. |
(2) Where an unincorporated association or a partnership commits an offence under this Act, a person —| (a) | who is —| (i) | an officer of the unincorporated association or a member of its governing body; | | (ii) | a partner in the partnership; or | | (iii) | an individual involved in the management of the unincorporated association or the partnership and in a position to influence the conduct of that unincorporated association or that partnership in relation to the commission of the offence; and |
| | (b) | who —| (i) | consented or connived, or conspired with others, to effect the commission of the offence; | | (ii) | is in any other way, whether by act or omission, knowingly concerned in, or is party to, the commission of the offence by the unincorporated association or the partnership; or | | (iii) | knew or ought reasonably to have known that the offence by the unincorporated association or the partnership (or an offence of the same type) would be or is being committed, and failed to take all reasonable steps to prevent or stop the commission of that offence, |
|
| shall be guilty of the same offence as is that unincorporated association or that partnership, and shall be liable on conviction to be punished accordingly. |
|
| (3) A person mentioned in subsection (2) may rely on a defence that would be available to the unincorporated association or the partnership if it were charged with the offence with which the person is charged and, in doing so, the person bears the same burden of proof as that unincorporated association or that partnership would bear. |
(4) To avoid doubt, this section does not affect the application of —| (a) | Chapters 5 and 5A of the Penal Code 1871; or | | (b) | the Evidence Act 1893 or any other law or practice regarding the admissibility of evidence. |
|
| (5) To avoid doubt, subsection (2) also does not affect the liability of an unincorporated association or a partnership for an offence under this Act, and applies whether or not that unincorporated association or that partnership is convicted of the offence. |
(6) In this section —“officer”, in relation to an unincorporated association (other than a partnership), means the president, the secretary, or any member of the committee of the unincorporated association, and includes —| (a) | any person holding a position analogous to that of president, secretary or member of a committee of the unincorporated association; and | | (b) | any person purporting to act in any such capacity; |
|
| “partner” includes a person purporting to act as a partner; |
“state of mind” of a person includes —| (a) | the knowledge, intention, opinion, belief or purpose of the person; and | | (b) | the person’s reasons for the intention, opinion, belief or purpose. |
|
|
|
38.—(1) An investigation officer authorised by the Commissioner may, in relation to any offence under this Act (except any offence under section 23) or any regulations made under this Act, on declaration of the investigation officer’s office and production to the person against whom the investigation officer is acting such identification card as the Commissioner may direct to be carried —| (a) | require any person whom the investigation officer reasonably believes to have committed that offence to furnish evidence of the person’s identity; | | (b) | require, by written notice, any person whom the investigation officer reasonably believes has —| (i) | any information; or | | (ii) | any document in the person’s custody or control, |
| that is relevant to the investigation, to furnish that information or document within the time and manner specified in the written notice; |
| | (c) | require, by written order, the attendance before the investigation officer of any person within the limits of Singapore who, from any information given or otherwise obtained by the investigation officer, appears to be acquainted with the facts or circumstances of the case; or | | (d) | examine orally any person who appears to be acquainted with the facts or circumstances of the case —| (i) | whether before or after that person or anyone else is charged with an offence in connection with the case; and | | (ii) | whether or not that person is to be called as a witness in any inquiry, trial or other proceedings in connection with the case. |
|
| (2) The person mentioned in subsection (1)(d) is bound to state truly the facts and circumstances with which the person is acquainted concerning the case, except that the person need not say anything that might expose the person to a criminal charge, penalty or forfeiture. |
(3) A statement made by a person examined under subsection (1)(d) must —| (a) | be reduced to writing; | | (b) | be read over to the person; | | (c) | if the person does not understand English, be interpreted to the person in a language that the person understands; and | | (d) | after correction (if necessary), be signed by the person. |
|
| (4) If any person fails to attend as required by an order under subsection (1)(c), the investigation officer may report such failure to a Magistrate who may then issue a warrant to secure the attendance of that person as required by the order. |
| (5) An investigation officer may, without payment, take possession or make copies of any document (or any part of it) furnished under subsection (1), for further investigation. |
(6) Any person who —| (a) | refuses to give access to, or assaults, obstructs, hinders or delays, an investigation officer in the discharge of the investigation officer’s duties under this Act; | | (b) | wilfully misstates or without lawful excuse refuses to give any information or produce any document required by an investigation officer under subsection (1); or | | (c) | fails to comply with a lawful demand of an investigation officer in the discharge of the investigation officer’s duties under this Act, |
| shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $20,000 or to imprisonment for a term not exceeding 12 months or to both. |
|
| (7) In this section and section 39, “investigation officer” means the Deputy Commissioner, or any Assistant Commissioner or cybersecurity officer authorised by the Commissioner, exercising the powers of investigation under this section or section 39. |
|
| Power to enter premises under warrant |
39.—(1) A Magistrate may, on the application of an investigation officer, issue a warrant in respect of any premises if the Magistrate is satisfied that there are reasonable grounds to suspect that there is on the premises any document —| (a) | which has been required by an investigation officer under section 38 to be furnished, but has not been furnished in compliance with that requirement; or | | (b) | which, if required by an investigation officer under section 38 to be furnished, will be concealed, removed, tampered with or destroyed. |
| (2) If the Magistrate is also satisfied that there are reasonable grounds to suspect that there is on those premises any other document that relates to any matter relevant to the investigation concerned, the Magistrate may direct that the powers exercisable under the warrant extend to that other document. |
(3) A warrant under subsection (1) may authorise a named investigation officer, and any other officer whom the Commissioner has authorised in writing to accompany the investigation officer —| (a) | to enter and search the premises specified in the warrant, using such force as is reasonably necessary for the purpose; | | (b) | to take possession of, make copies of, or secure against interference, any document (or any part of it) that appears to be a document mentioned in subsection (1) or (2) (called in this section the relevant document); | | (c) | to require any person on the premises to provide an explanation of any relevant document or, where applicable, to state, to the best of that person’s knowledge and belief, where the relevant document may be found; and | | (d) | to require any relevant document that is stored in electronic form and accessible at the premises to be produced in a form that —| (i) | can be taken away; and | | (ii) | is visible and legible. |
|
|
| (4) The warrant continues in force until the end of the period of one month beginning on the day on which it is issued. |
(5) If the owner or occupier of the premises is present when the investigation officer proposes to execute the warrant, the investigation officer must —| (a) | identify himself or herself to the owner or occupier; | | (b) | show the owner or occupier proof of the identity and authorisation of the investigation officer; and | | (c) | give the owner or occupier a copy of the warrant. |
|
(6) If there is no one at the premises when the investigation officer proposes to execute the warrant, the investigation officer must, before executing it —| (a) | take such steps as are reasonable in all the circumstances to inform the owner or occupier of the premises of the intended entry into the premises; and | | (b) | where the owner or occupier is so informed, give the owner or occupier or the legal or other representative of the owner or occupier a reasonable opportunity to be present when the warrant is executed. |
|
| (7) If the investigation officer is unable to inform the owner or occupier of the premises of the intended entry into the premises, the investigation officer must, when executing the warrant, leave a copy of it in a prominent place on the premises. |
(8) The investigation officer must —| (a) | prepare and sign a list of all documents and other things taken under subsection (3)(b) and (d) in execution of the warrant; and | | (b) | give a copy of the list to the owner or occupier of the premises or the legal or other representative of the owner or occupier. |
|
| (9) On leaving the premises after executing the warrant, the investigation officer must, if the premises are unoccupied or the owner or occupier of the premises is temporarily absent, leave the premises as effectively secured as the investigation officer found them. |
(10) In this section —| “occupier”, in relation to any premises specified in a warrant under subsection (1), means a person whom the investigation officer named in the warrant reasonably believes to be the occupier of those premises; |
| “premises” includes any building, structure, vehicle, vessel or aircraft. |
|
|
| 40. Despite any provision to the contrary in the Criminal Procedure Code 2010, a District Court has jurisdiction to try any offence under this Act and has power to impose the full penalty or punishment in respect of the offence. |
41.—(1) The Commissioner or any Assistant Commissioner authorised by the Commissioner may compound any offence under this Act that is prescribed as a compoundable offence by collecting from a person reasonably suspected of having committed the offence a sum not exceeding the lower of the following:| (a) | one half of the amount of the maximum fine that is prescribed for the offence; | | (b) | a sum of $5,000. |
| (2) Where any offence is compoundable under this section, the abetment of or a conspiracy to commit the offence, or an attempt to commit the offence when the attempt is itself an offence, may be compounded in like manner. |
| (3) On payment of the sum of money, no further proceedings may be taken against that person in respect of the offence. |
| (4) All sums collected under this section must be paid into the Consolidated Fund. |
|
41A.—(1) A person who, in any particular case, is unable to do any thing that the person is required to do under Part 3, 3A, 3B, 3C or 3D (including any direction or order issued under those Parts) within the time specified for it may apply in writing to the Commissioner for an extension of time.| (2) The Commissioner may grant an extension of time (whether for the same or less than the period of extension applied for), upon being satisfied that there are good reasons to do so. [Act 19 of 2024 wef 31/10/2025] |
|
42.—(1) A document that is permitted or required by this Act to be served on a person may be served as described in this section.(2) A document permitted or required by this Act to be served on an individual may be served —| (a) | by giving it to the individual personally; | | (b) | by sending it by prepaid registered post to the address specified by the individual for the service of documents or, if no address is so specified, the individual’s residential address or business address; | | (c) | by leaving it at the individual’s residential address with an adult apparently resident there, or at the individual’s business address with an adult apparently employed there; | | (d) | by affixing a copy of the document in a conspicuous place at the individual’s residential address or business address; | | (e) | by sending it by fax to the fax number last known to the person giving or serving the document as the fax number for the service of documents on the individual; or | | (f) | by sending it by email to the individual’s email address. |
|
(3) A document permitted or required by this Act to be served on a partnership (other than a limited liability partnership) may be served —| (a) | by giving it to any partner or other like officer of the partnership; | | (b) | by leaving it at, or by sending it by prepaid registered post to, the partnership’s business address; | | (c) | by sending it by fax to the fax number used at the partnership’s business address; or | | (d) | by sending it by email to the partnership’s email address. |
|
(4) A document permitted or required by this Act to be served on a body corporate (including a limited liability partnership) or an unincorporated association may be served —| (a) | by giving it to the secretary or other like officer of the body corporate or unincorporated association, or the limited liability partnership’s manager; | | (b) | by leaving it at, or by sending it by prepaid registered post to, the body corporate’s or unincorporated association’s registered office or principal office in Singapore; | | (c) | by sending it by fax to the fax number used at the body corporate’s or unincorporated association’s registered office or principal office in Singapore; or | | (d) | by sending it by email to the body corporate’s or unincorporated association’s email address. |
|
(5) Service of a document under this section takes effect —| (a) | if the document is sent by fax and a notification of successful transmission is received, on the day of transmission; | | (b) | if the document is sent by email, at the time that the email becomes capable of being retrieved by the person; and | | (c) | if the document is sent by prepaid registered post, 2 days after the day the document was posted (even if it is returned undelivered). |
|
| (6) This section does not apply to documents to be served in proceedings in court. |
(7) In this section —“business address” means —| (a) | in the case of an individual, the individual’s usual or last known place of business in Singapore; or | | (b) | in the case of a partnership (other than a limited liability partnership), the partnership’s principal or last known place of business in Singapore; |
|
| “email address” means the last email address given by the addressee concerned to the person giving or serving the document as the email address for the service of documents under this Act; |
| “residential address” means an individual’s usual or last known place of residence in Singapore. |
|
|
43.—(1) Subject to subsections (3) and (7), every specified person must preserve, and aid in preserving, the secrecy of —| (a) | all matters relating to a computer or computer system of any person; | | (b) | all matters relating to the business, commercial or official affairs of any person; | | (c) | all matters that have been identified as confidential under subsection (5); and | | (d) | all matters relating to the identity of persons furnishing information to any specified person, |
| that may come to the specified person’s knowledge in the performance of his or her functions or the discharge of his or her duties under this Act. |
(2) The specified person must not communicate any matter mentioned in subsection (1) to any person, except insofar as such communication —| (a) | is necessary for the performance of any such function or the discharge of any such duty; or | | (b) | is lawfully required by any court, or lawfully required or allowed by or under this Act or any other written law. |
|
| (3) This section does not apply to any information provided in compliance with a direction or requirement under section 23. |
| (4) Any person who fails to comply with subsection (1) or (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both. |
| (5) Any person, when furnishing any information to a specified person, may identify information that the person claims to be confidential information. |
| (6) Every claim made under subsection (5) must be supported by a written statement giving reasons why the information is confidential. |
(7) Despite subsection (1), the Commissioner may disclose any information relating to any matter mentioned in subsection (1) in any of the following circumstances:| (a) | where the written consent of the person to whom the information relates has been obtained; | | (b) | for the purposes of —| (i) | a prosecution under this Act; | | (ii) | subject to subsection (8), enabling the Commissioner to give effect to any provision of this Act; | | (iii) | enabling the Commissioner to investigate a suspected offence under this Act or to enforce a provision of this Act; | | (iv) | disclosing to any police officer any information which discloses the commission of an offence under the Computer Misuse Act 1993; or | | (v) | complying with such provision of an agreement between Singapore and a country or territory outside Singapore (called in this section a foreign country) as may be prescribed, where the conditions specified in subsection (9) are satisfied. |
|
|
(8) If the Commissioner is considering whether to disclose any information under subsection (7)(b)(ii), the Commissioner must have regard to —| (a) | the need to exclude, so far as is practicable, information the disclosure of which would in his or her opinion be contrary to the public interest; | | (b) | the need to exclude, so far as is practicable —| (i) | commercial information the disclosure of which would, or might, in his or her opinion, significantly harm the legitimate business interests of the undertaking to which it relates; or | | (ii) | information relating to the private affairs of an individual the disclosure of which would, or might, in his or her opinion, significantly harm the individual’s interest; and |
| | (c) | the extent to which the disclosure is necessary for the purposes for which the Commissioner is proposing to make the disclosure. |
|
(9) The conditions mentioned in subsection (7)(b)(v) are —| (a) | the information or documents requested by the foreign country are available to the Commissioner; | | (b) | unless the Government otherwise allows, the foreign country undertakes to keep the information or documents given confidential at all times; and | | (c) | the disclosure of the information or documents is not likely to be contrary to the public interest. |
|
(10) In this section, “specified person” means a person who is or has been —| (a) | the Commissioner, the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or a person appointed or employed to assist the Commissioner; | | (b) | an authorised officer appointed under section 6; | | (c) | a member of an Appeals Advisory Panel established under section 35C; [Act 19 of 2024 wef 31/10/2025] | | (d) | a cybersecurity technical expert appointed under section 22; | | (e) | an assistant licensing officer; or | | (f) | the Minister, or a person appointed or employed to assist the Minister. |
|
|
| Protection from personal liability |
44.—(1) No liability shall lie against the Commissioner, the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer, an authorised officer appointed under section 6, an assistant licensing officer, a member of an Appeals Advisory Panel established under section 35C or any other person acting under the direction of the Commissioner who, acting in good faith and with reasonable care, does or omits to do anything in —| (a) | the exercise or purported exercise of any power under this Act; or | | (b) | the performance or purported performance of any function or duty under this Act. [Act 19 of 2024 wef 31/10/2025] |
| (2) Where the Commissioner provides a service to the public whereby information is supplied to the public pursuant to any written law, neither the Commissioner nor any person acting under the direction of the Commissioner who is involved in the supply of such information is liable for any loss or damage suffered by any person by reason of any error or omission of whatever nature appearing in the information or however caused, if the error or omission was made in good faith and despite the exercise of reasonable care in the ordinary course of the discharge of the duties of the Commissioner or such person. |
|
45.—(1) No witness in any proceedings for an offence under Part 3, 3A, 3B, 3C or 3D, or for a civil penalty under section 37A or 37C, is obliged or permitted —| (a) | to disclose the name, address or other particulars of an informer who has given information with respect to that offence, or the substance of the information received from the informer; or | | (b) | to answer any question if the answer would lead, or would tend to lead, to the discovery of the name, address or other particulars of the informer. [Act 19 of 2024 wef 31/10/2025] |
| (2) If any document which is in evidence or liable to inspection in any proceedings mentioned in subsection (1) contains any entry in which any informer is named or described or which might lead to the informer’s discovery, the court must cause the entry to be concealed from view or to be obliterated so far only as may be necessary to protect the informer from discovery. |
(3) If, during any proceedings —| (a) | the court, after full inquiry into the case, believes that the informer wilfully made in the informer’s complaint a material statement which the informer knew or believed to be false or did not believe to be true; or | | (b) | the court is of the opinion that justice cannot be fully done between the parties to the proceedings without the discovery of the informer, |
| it is lawful for the court to require the production of the original complaint, if in writing, and permit inquiry, and require full disclosure of the informer. |
|
|
46.—(1) The Minister may, by order in the Gazette, exempt any person or any class of persons from all or any of the provisions of this Act, either generally or in a particular case and subject to such conditions as may be prescribed.| (2) If any exemption is granted under subsection (1) with conditions, the exemption operates only if the conditions are complied with. |
|
47.—(1) The Minister may at any time, by order in the Gazette, amend the First or Second Schedule.| (2) The Minister may, in any order made under subsection (1), make such transitional, incidental, consequential or supplementary provision as may be necessary or expedient. |
| (3) Any order made under subsection (1) must be presented to Parliament as soon as possible after publication in the Gazette. |
|
48.—(1) The Minister may make regulations for carrying out the purposes and provisions of this Act.(2) Without limiting subsection (1), the Minister may make regulations for or with respect to all or any of the following matters:| (a) | the procedure for the designation of a provider-owned critical information infrastructure, designated provider responsible for third-party-owned critical information infrastructure, system of temporary cybersecurity concern, entity of special cybersecurity interest or major foundational digital infrastructure service provider; [Act 19 of 2024 wef 31/10/2025] | | (b) | the technical or other standards relating to cybersecurity to be maintained in respect of a provider-owned critical information infrastructure, third-party-owned critical information infrastructure, system of temporary cybersecurity concern, system of special cybersecurity interest or major foundational digital infrastructure; [Act 19 of 2024 wef 31/10/2025] | | (c) | the responsibilities and duties of the owner of a provider-owned critical information infrastructure or system of temporary cybersecurity concern, designated provider responsible for third-party-owned critical information infrastructure, entity of special cybersecurity interest or major foundational digital infrastructure service provider; [Act 19 of 2024 wef 31/10/2025] | | (d) | the type of changes that are considered material changes to the design, configuration, security or operations of a provider-owned critical information infrastructure or a third-party-owned critical information infrastructure to be reported by the owner of the provider-owned critical information infrastructure or the designated provider responsible for third-party-owned critical information infrastructure; [Act 19 of 2024 wef 31/10/2025] | | (e) | the type of cybersecurity incidents relating to —| (i) | a provider-owned critical information infrastructure that are required to be reported by the owner of the provider-owned critical information infrastructure; | | (ii) | a third-party-owned critical information infrastructure that are required to be reported by the designated provider responsible for third-party-owned critical information infrastructure; | | (iii) | a system of temporary cybersecurity concern that are required to be reported by the owner of the system of temporary cybersecurity concern; | | (iv) | a system of special cybersecurity interest that are required to be reported by the entity of special cybersecurity interest; or | | (v) | a major foundational digital infrastructure that are required to be reported by the major foundational digital infrastructure service provider; [Act 19 of 2024 wef 31/10/2025] |
| | (f) | the requirements for, and the manner for the carrying out of, cybersecurity audits and cybersecurity risk assessments required to be conducted by the owner of a provider-owned critical information infrastructure or the owner of a third-party-owned critical information infrastructure; [Act 19 of 2024 wef 31/10/2025] | | (g) | the form and nature of cybersecurity exercises that may be conducted; | | (h) | the class or classes of licence to be issued, and the requirements for the grant or renewal of the licence; | | (i) | the conduct of licensees in carrying on their business; | | (ia) | the use of any accreditation, certification or inspection mark of the Cyber Security Agency of Singapore; [Act 19 of 2024 wef 31/10/2025] | | (j) | the fees to be paid in respect of any matter or thing required for the purposes of this Act, including the refund and remission (in whole or part) of such fees; | | (k) | all matters and things which by this Act are required or permitted to be prescribed or which are necessary or expedient to be prescribed to give effect to this Act. |
|
(3) Except as otherwise expressly provided in this Act, the regulations —| (a) | may be of general or specific application; | | (b) | may provide that any contravention of any specified provision of the regulations shall be an offence; and | | (c) | may provide for penalties not exceeding a fine of $50,000 or imprisonment for a term not exceeding 12 months or both for each offence and, in the case of a continuing offence, a further penalty not exceeding a fine of 10% of the maximum fine prescribed for that offence for every day or part of a day during which the offence continues after conviction. |
|
|
| Saving and transitional provisions |
49.—(1) Despite anything in this Act, any person who, immediately before the date of commencement of Part 5, is engaged in the business of providing a licensable cybersecurity service, may continue to engage in that business —| (a) | for 6 months starting on the date of commencement of Part 5; and | | (b) | if, within the period in paragraph (a), the person applies for a licence under section 26, until the earlier of the following:| (i) | the date on which the licensing officer grants the licence to the person; | | (ii) | the date that the application is finally refused or withdrawn. |
|
| (2) For a period of 2 years after the date of commencement of any provision of this Act, the Minister may, by regulations, prescribe such additional provisions of a saving or transitional nature consequent on the enactment of that provision as the Minister may consider necessary or expedient. [51 |
|
|