Fifth Update on the Government's Personal Data Protection Efforts

The Government has published key efforts undertaken to strengthen the public sector data security regime between 1 April 2023 and 31 March 2024 (i.e. FY2023). This is the fifth annual update. All 24 initiatives recommended by the Public Sector Data Security Review Committee (PSDSRC)¹ in 2019 have been implemented. (Please refer to Annex A for the full list of PSDSRC initiatives).

No Serious Data Incidents over Last Four Years

There were 201 government data incidents reported in FY2023 as compared to 182 incidents reported in FY2022. The increase in the number of incidents is due to the higher volume of data usage as more government services are digitalised to provide convenience to citizens and businesses. In addition, improved awareness among public officers on the need to report incidents may have also contributed to the increase.

The vast majority of incidents were of low severity. This is the fourth consecutive year with no incidents assessed to be of high severity and above. Incidents of medium severity also decreased from 46 in FY2022 to 29 in FY2023. This is partly the result of progressive implementation of security processes and technical measures and increased public sector awareness on data security.

Government’s Initiatives to Strengthen Data Security in FY2023

The Government has progressively put in place various measures since 2019 to enhance the public sector data security regime. The following are key highlights of government initiatives introduced in FY2023.

Central Privacy Toolkit (Cloak) Expanded to Include New Features

Cloak allows public officers to apply privacy-enhancing technologies to datasets while preserving the data’s value for sharing and use, thus mitigating the risk of data leaks. Since its launch in March 2023, the toolkit has expanded its offerings and has been used by 1,400 public officers from 90 agencies. For instance, its free-text anonymisation feature has anonymised 20 million documents and served more than 20 generative AI use cases in government.

Deployment of Automation Tools to Prevent Data Compromises

As of end-March 2024, all eligible systems in the government used the Central Accounts Management (CAM) tool to automatically remove user accounts that were no longer needed. This has mitigated the risk of unauthorised access by officers who have left their roles and the exploitation of dormant accounts by malicious actors.

Enhancements have also been made to the Government’s Data Loss Protection (DLP) tool which mitigates the accidental loss of classified and/or sensitive data from government networks, systems, and devices. For instance, since September 2023, email recipients can no longer see the email addresses of other external recipients if there are more than 30 recipients.

Enhancing Competencies in Public Service

The Government recognises that it is not possible to eliminate data incidents entirely and remains committed to respond swiftly to data incidents. From August to September 2023, the Government conducted the annual central ICT and Data Incident Management exercise involving 31 agencies across four Ministry Families. This enhanced the Government’s ability to provide a coordinated and efficient response when required.

Enhancing public officers’ instincts and instilling a culture of excellence in using data securely is an ongoing effort. In FY2023, the Government introduced gamified events to help public officers learn about data protection in an engaging way. In February 2024, the mandatory Data Security e-learning module was also refreshed to include content related to new technologies and prevalent trends, such as Large Language Models (LLMs) and phishing scams.

Implementation of All 24 Recommended PSDSRC Initiatives

All 24 PSDSRC initiatives have been implemented. The Government remains committed to ensuring a robust data security regime. We will continue to review the effectiveness of our existing measures regularly, introducing enhancements or new measures when necessary. New initiatives aimed at strengthening the Government’s data security will be shared on the Ministry of Digital Development and Information (MDDI) website.

The full FY2023 report can be found at go.gov.sg/public-sector-data-security-review.

¹ The Public Sector Data Security Review Committee (PSDSRC) made five key recommendations in 2019 to improve the Government’s data security regime. The Government accepted the Committee’s recommendations in full and committed to implementing them in phases from FY2020 to FY2023.

Annex A: Implementation Progress of the PSDSRC Initiatives

All 24 initiatives recommended by the PSDSRC have been implemented as of 31 March 2024.