NYA Tuition Pte Ltd
bd_206c9d6a082d3d20 · schema v1 · pii pii-v1
Regulator's decision — not a breach notification
This record is a regulator's decision, not the organisation's own breach notice. Breach-notification fields (discovery date, notification clock) are structurally absent — what this source establishes is the outcome and the provisions the decision cites.
Background The Personal Data Protection Commission (the “Commission”) received complaints from two individuals regarding the receipt of unsolicited marketing messages (“specified messages”) sent by NYA Tuition Pte. Ltd. (the “Organisation”). The Organisation had continued to send specified messages to the two complainants even after acknowledging their respective withdrawal requests for the Organisation to cease sending such messages (the “Incident”). The specified messages did not include proper sender identification and contact information as required under section 44 of the Personal Data Protection Act 2012 (the “PDPA”). The First Complainant received a specified message from the Organisation on 24 May 2024 despite having previously withdrawn consent to receiving such messages in March 2022, and despite the Organisation’s previous confirmations of the withdrawal of consent and removal of the First Complainant’s number from its database. The First Complainant’s number has been registered with the Do Not Call registry since April 2022. The Second Complainant received six specified messages from the Organisation between August 2022 and December 2024, despite having explicitly withdrawn consent to receiving such messages multiple times between August 2022 and June 2024. The Organisation had confirmed the withdrawal of consent and removal of the Second Complainant’s number from its database in January 2023, and again in June 2024. The Second Complainant’s number has been registered with the Do Not Call registry since December 2013. However, the Second Complainant continued to receive specified messages from the Organisation at the same number. In respect of both Complainants, the Organisation did not act as required under section 47(3) of the PDPA. The Organisation also did not check the Do Not Call register as required under section 43(1) of the PDPA, before sending th
P pin to compareR raw source
Incident timeline — partial
? — ?
Breach window unknown
Aug 5, 2026
Filed
—
No linked breach filing · watching
Compliance clocks stay unassessable until a breach filing is linked. This record is the regulator's action, not a breach notice. Dashed segments fill in automatically when corroboration arrives.
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- outcome + obligations
- fine (SGD) and affected count where a grounds document states them
- discovery date
- notification clock
See the underlying breach notice, if any.