Section 48
Offences and penalties
of Personal Data Protection Order, 2025
(1)
Any person who-
{a} makes a request under section 18(1) to obtain access to personal data about another individual; or
(b} makes a request under section 19(1) to change personal data about another individual, without the authority of the individual, is guilty of an offence and liable on conviction to a fine not exceeding $5,000, imprisonment for a term not exceeding 12 months or both.
(2)
An organisation or person who-
(a} with an intent to evade a request under section 18 or 19, disposes of, alters, falsifies, conceals or destroys, or directs another person to dispose of, alter, falsify, conceal or destroy, a record containing -
(i)
personal data; or
(ii)
information about the collection, use or disclosure of personal data;
(b)
obstructs or hinders the Authority or an authorised officer in the performance of any function or duty, or the exercise of any power, under this Order;
(c)
without reasonable excuse, neglects or refuses to provide any information or produce any document which the organisation or person is required by or under this Order to provide or produce to the Authority or an authorised officer;
(d)
neglects or refuses to attend before the Authority or an authorised officer as required by or under this Order; or
(e} makes a statement, or furnishes any information or document, to the Authority or an authorised officer under this Order, which the organisation or person knows, or ought reasonably to know, to be false or misleading in any material particular, is guilty of an offence and liable on conviction -
General penalty
(i)
in the case of an individual, to a fine not exceeding $10,000, imprisonment for a term not exceeding 12 months or both; and
(ii)
in any other case, to a fine not exceeding $100,000.