PDPA Data Breach Notification: Step-by-Step Guide for Singapore Businesses

A data breach can happen to any organisation, regardless of size. A stolen laptop, a phishing email that works, a misconfigured database, a disgruntled former employee — the causes vary, but the obligation is the same: if the breach is notifiable, you must report it to the PDPC within 3 calendar days of completing your assessment.

Since the Mandatory Data Breach Notification framework took effect on 1 February 2021 under Part VIA of the PDPA, every private sector organisation in Singapore must have a plan for handling breaches. This guide walks you through the entire process, from discovery to remediation.

What Counts as a Data Breach

A data breach under the PDPA occurs when there is:

• Unauthorised access to personal data (someone who should not have access gains it)
• Unauthorised collection of personal data
• Unauthorised use or disclosure of personal data
• Unauthorised copying or modification of personal data
• Loss of storage media containing personal data (e.g., a lost laptop, USB drive, or hard copy file)

A breach does not have to be malicious. Accidental breaches — such as sending a customer email to the wrong recipient, losing a file folder, or misconfiguring a system so data is publicly accessible — are still breaches.

When a Breach Is Notifiable

Not every breach triggers the notification requirement. A breach is notifiable if it meets either of two thresholds:

Threshold 1: Significant Harm

The breach results in, or is likely to result in, significant harm to any affected individual. The PDPA defines significant harm as:

• Financial loss (e.g., unauthorised transactions, identity theft enabling fraud)
• Identity theft
• Physical harm or harassment
• Damage to reputation
• Loss of employment or business opportunities
• Loss of a benefit, privilege, or service

Practical examples: A breach involving NRIC numbers, bank account details, login credentials, health records, or salary information is likely to meet this threshold because these data types can be directly exploited.

Threshold 2: Significant Scale

The breach affects, or is likely to affect, 500 or more individuals, regardless of the type of data or potential harm.

Practical example: A marketing email that accidentally CCs 600 recipients (exposing their email addresses to each other) meets this threshold even though the potential harm from email exposure alone may be limited.

If Either Threshold Is Met, You Must Notify

You do not need both thresholds to trigger the obligation. Meeting either one is sufficient.

The Data Breach Response Process

When you discover or suspect a breach, follow these five steps:

Step 1: Contain the Breach (Immediately)

Your first priority is to stop the breach from continuing and prevent further damage.

Actions to take immediately:

• Isolate affected systems or networks
• Change compromised passwords and access credentials
• Revoke access for any compromised accounts
• Disable any functionality that is actively leaking data
• Preserve evidence (logs, screenshots, affected files) for investigation
• Do not destroy evidence — it may be needed for the PDPC investigation

Time target: Containment should begin within hours of discovery, not days.

Step 2: Assess the Breach (As Soon as Practicable)

Once contained, assess the breach to determine:

1. What data was compromised? (Types: names, NRIC, financial data, health records, etc.)
2. How many individuals are affected? (Count or reasonable estimate)
3. How did the breach occur? (Root cause: hacking, human error, system failure, etc.)
4. Is the breach ongoing or fully contained?
5. What is the potential harm to affected individuals?
6. Is the breach notifiable? (Apply the two thresholds above)

Document everything. Keep a written record of your assessment, including the reasoning behind your determination of whether the breach is notifiable. The PDPC may ask for this documentation.

Time pressure: The PDPA requires you to begin your assessment "as soon as practicable" after becoming aware of the breach. You must not delay the assessment. The 3-day notification clock starts when you complete your assessment, so deliberately prolonging the assessment to delay notification is not acceptable.

Need help assessing a breach? ComplyHQ's AI compliance assistant can walk you through the assessment process step by step. Start a free assessment

Step 3: Notify the PDPC (Within 3 Calendar Days)

If your assessment determines the breach is notifiable, you must notify the PDPC within 3 calendar days of completing the assessment.

How to notify:

1. Use the PDPC's online Data Breach Notification Form at pdpc.gov.sg
2. Submit a completed form — do not simply email the PDPC

What the notification must include:

• Description of the breach (what happened)
• Date and time of the breach (or best estimate)
• Date and time the breach was discovered
• Types of personal data involved
• Number of individuals affected (or best estimate)
• What your organisation has done to contain the breach
• What your organisation is doing to address the breach and prevent recurrence
• Whether affected individuals have been or will be notified
• Contact details of your DPO or designated contact person

Important: You can submit a preliminary notification if you do not yet have all the details. The PDPC prefers early notification with follow-up updates over delayed, complete notifications.

Step 4: Notify Affected Individuals (If Significant Harm)

If the breach is likely to result in significant harm to affected individuals, you must notify them directly, in addition to notifying the PDPC.

When to notify individuals: As soon as practicable. Do not wait until your investigation is complete if you already know that individuals are at risk.

What to tell them:

• What happened (in plain, non-technical language)
• What personal data was compromised
• What the potential consequences are
• What steps you are taking to address the breach
• What steps they should take to protect themselves (e.g., change passwords, monitor bank statements, report suspicious activity)
• How to contact your DPO for more information

How to notify: Use the most effective channel to reach affected individuals — email, SMS, registered mail, or phone call. Public announcements (website notices, press releases) should supplement direct notification, not replace it.

Step 5: Remediate and Prevent Recurrence

After notification, focus on fixing the root cause and preventing similar breaches in the future.

Actions:

• Conduct a thorough root cause analysis
• Implement technical fixes (patching vulnerabilities, strengthening access controls)
• Update policies and procedures based on lessons learned
• Conduct targeted staff retraining
• Review and update your Data Breach Response Plan
• Consider engaging an external security assessor if the breach was significant
• Document all remediation actions taken

The PDPC may issue directions requiring specific remediation measures. Failure to comply with these directions is a separate breach.

Penalties for Breach Notification Failures

The consequences of failing to notify are significant:

Financial Penalties

• Up to S$1 million per breach
• For organisations with annual turnover exceeding S$10 million: up to 10% of annual turnover in Singapore

Aggravating Factor

The PDPC treats failure to notify as an aggravating factor. If you fail to report a notifiable breach, the penalty for the underlying breach (e.g., inadequate security that caused the breach) will likely be higher than if you had reported promptly.

Published Decisions

PDPC enforcement decisions are published publicly, including the organisation's name, the nature of the breach, and the penalty imposed. The reputational damage from a published decision often exceeds the financial penalty.

Real Enforcement Examples

The PDPC has taken enforcement action in several notable data breach cases:

Large-Scale Breaches

The SingHealth breach (2018) remains the most significant PDPA enforcement case in Singapore. The breach compromised personal data of 1.5 million patients, including the Prime Minister. SingHealth was fined S$250,000 and IHIS (the IT agency managing the systems) was fined S$750,000 — totalling S$1 million. The Commission found failures in the Protection Obligation, including inadequate staff training, insufficient security monitoring, and delayed breach response.

SME-Relevant Enforcement

The PDPC regularly takes action against smaller organisations. Published decisions show fines ranging from S$5,000 to S$100,000 for SMEs, typically involving:

• Unpatched software leading to database compromises
• Employee errors such as sending personal data to wrong recipients
• Inadequate access controls on shared systems
• Delayed breach notification

Key Lessons from Enforcement Cases

1. Promptness matters. Organisations that contained and reported breaches quickly received more lenient treatment.
2. Having a response plan helps. The PDPC considers whether the organisation had a breach response plan in place as a mitigating factor.
3. Staff training is essential. Many breaches resulted from employee errors that could have been prevented with basic training.
4. Security proportionality counts. SMEs are not expected to have enterprise-grade security, but they must demonstrate reasonable measures.

Building Your Breach Response Plan

Every organisation should have a documented Data Breach Response Plan before a breach occurs. Here is what yours should include:

Essential Elements

1. Breach definition: What constitutes a data breach in your organisation
2. Response team: Named individuals with defined roles (e.g., DPO leads, IT contains, communications handles external messaging)
3. Escalation procedure: How employees should report suspected breaches internally
4. Assessment checklist: A structured process for determining if a breach is notifiable
5. Notification templates: Pre-drafted templates for PDPC notifications and individual notifications
6. Communication plan: Who communicates what, to whom, and when
7. Contact list: PDPC contact details, DPO contact details, IT support, legal counsel
8. Post-incident review: Process for reviewing and learning from each breach

Testing Your Plan

A plan that exists only on paper is not a plan. Test it regularly:

• Conduct a tabletop exercise at least once a year: walk your team through a simulated breach scenario
• Test your notification process: can you actually submit a PDPC notification within 3 days?
• Verify your contact details are current: can you reach your response team members?

Track your breach readiness alongside your full PDPA compliance status. ComplyHQ's compliance dashboard helps you monitor your preparedness across all 10 PDPA obligations. Get started free

Quick Reference: Breach Notification Timeline

Related Resources

• PDPA Compliance Checklist for Singapore SMEs (2026 Edition) — Complete compliance checklist
• PDPA Penalties and Fines: What You Risk for Non-Compliance — Detailed breakdown of enforcement consequences
• 10 PDPA Obligations Every Singapore Business Must Follow — All obligations explained
• PDPC Data Breach Notification Form — Official notification portal