What Is a Data Breach Under the PDPA?

A data breach occurs when there is unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data held by your organisation. This definition under Singapore’s Personal Data Protection Act (PDPA) is deliberately broad — and it applies whether the breach was caused by a sophisticated cyberattack or a simple human error.

Common examples include ransomware attacks exfiltrating customer databases, phishing emails leading to compromised employee accounts, accidental disclosure of spreadsheets containing customer data to the wrong recipient, loss or theft of an unencrypted laptop or USB drive, insider threats from employees accessing data without authorisation, and third-party vendor breaches where a data processor you engaged is compromised.

Critically, a breach does not need to be malicious to trigger your obligations. An honest mistake — an employee emailing the wrong attachment — can still constitute a notifiable breach under the PDPA.

The Mandatory Data Breach Notification Regime

Singapore’s mandatory data breach notification requirements took effect on 1 February 2021 as part of the PDPA amendments. Before this date, notification was voluntary. Today, it is a legal obligation — and the clock starts ticking the moment you become aware of a breach that is (or is likely to be) notifiable.

The regime operates on two tiers, each with distinct requirements and timelines.

Tier 1: Notify the PDPC Within 3 Calendar Days

If a data breach is (or is likely to be) notifiable, you must inform the Personal Data Protection Commission (PDPC) within 3 calendar days of becoming aware of it. Note that this is calendar days — not business days. Weekends and public holidays count.

At this early stage, you may not have all the answers. The PDPC understands this. You should notify with the information available and submit updates as your investigation progresses.

Your notification to the PDPC must include your organisation’s name and contact details, the nature and circumstances of the breach, the type of personal data involved, an estimate of the number of individuals affected, the likely consequences for affected individuals, and the measures you have taken or plan to take to address the breach.

Submit your notification through the PDPC’s Data Breach Portal at go.gov.sg/dbp.

Tier 2: Notify Affected Individuals as Soon as Practicable

In addition to notifying the PDPC, you must notify the individuals whose personal data was compromised as soon as practicable. Unlike the PDPC notification, there is no fixed deadline for this tier — but delays attract scrutiny, and the PDPC expects businesses to act promptly.

Your notification to affected individuals must describe the nature of the breach, the type of personal data involved, what the organisation is doing to address the breach, what steps the individual can take to protect themselves (such as changing passwords, monitoring credit reports, or being alert to phishing attempts), and contact details for further enquiries.

Notification must be direct — sent to the individual by email, letter, or SMS. Posting a notice on your website is not sufficient unless direct notification is not reasonably practicable, in which case public communication may be used with the PDPC’s agreement.

When Is a Breach “Notifiable”?

Not every breach triggers the mandatory notification obligation. A breach is notifiable if it results in, or is likely to result in, significant harm to affected individuals, or if it affects 500 or more individuals.

The PDPA identifies categories of personal data whose exposure is deemed to cause significant harm. These include full name combined with NRIC, FIN, or passport number; financial account numbers including bank accounts and credit or debit card numbers with security codes; medical records or health information; biometric data; passwords or login credentials; and private sexual images.

If your breach involves any of these categories, treat it as notifiable unless you have documented reasons to conclude otherwise. When in doubt, notify. The PDPC treats good-faith over-notification far more favourably than under-notification.

Immediate Steps After Discovering a Breach

Speed and order matter when a breach is discovered. Here is a practical first-response checklist.

Within the first hour: Contain the breach immediately — isolate affected systems, revoke compromised credentials, and block any ongoing unauthorised access. Preserve all evidence: do not delete logs, overwrite data, or make changes that could impede your investigation. Alert your Data Protection Officer (DPO) and senior management without delay.

Within 24 hours: Conduct a preliminary assessment to determine what data was affected, how many individuals are involved, and how the breach occurred. Assess whether the breach is (or is likely to be) notifiable under the PDPA. Begin drafting your PDPC notification.

Within 3 calendar days: Submit your notification to the PDPC via the Data Breach Portal, even if your investigation is not yet complete. Engage legal counsel if the breach is significant or if you are uncertain about your obligations.

Ongoing: Continue investigating and submit updates to the PDPC as more information becomes available. Prepare and dispatch notifications to affected individuals. Remediate the root cause of the breach. Review and strengthen your data protection policies and controls to prevent recurrence.

Exceptions to the Notification Requirement

There are limited exceptions to mandatory notification. A notification to affected individuals may not be required if the breach is subject to a law enforcement exception (where notification would tip off a suspect in a criminal investigation), a national security or public interest exception, or if the organisation can demonstrate that the breach is unlikely to result in significant harm — for example, because the data was strongly encrypted and the encryption key was not compromised.

These exceptions are narrow and must be applied carefully. Document your reasoning thoroughly if you rely on an exception. The safest course remains notification, and the PDPC will not penalise an organisation for notifying a breach that turns out not to be notifiable.

Penalties for Non-Compliance

The consequences of failing to comply with PDPA breach notification obligations are serious. For breaches occurring from 1 October 2022 onwards, organisations with annual turnover exceeding S$10 million can face financial penalties of up to 10% of annual turnover. For organisations below this threshold, the cap is S$1 million. These are per-breach penalties, and multiple breaches can result in multiple enforcement actions.

Beyond financial penalties, the PDPC may issue directions requiring specific remediation steps. Enforcement decisions are published publicly, making reputational damage a significant additional consequence. Affected individuals also have the right to bring private claims for damages under Section 48O of the PDPA.

The PDPC takes a risk-proportionate approach. Organisations that self-report promptly, cooperate fully with investigations, and implement robust remediation measures are treated more favourably than those that delay or conceal breaches.

Preparing Your Business Before a Breach Occurs

The best time to prepare for a data breach is before one happens. Every Singapore business handling personal data should have the following in place.

A Data Breach Response Plan: Documented, step-by-step procedures for detecting, assessing, containing, and notifying breaches. The plan should assign clear roles and responsibilities and be tested through regular drills or tabletop exercises.

An Appointed Data Protection Officer (DPO): Businesses in Singapore are required to designate a DPO under the PDPA. Your DPO should have a thorough understanding of notification obligations and the authority to mobilise resources quickly when a breach is detected.

A Personal Data Inventory: Know exactly what personal data your organisation holds, where it is stored, how it flows through your systems, and who has access. Without this inventory, it is impossible to assess the scope of a breach rapidly or respond effectively.

Staff Training: Employees are often the first to detect — or inadvertently cause — a data breach. Regular training on recognising the signs of a breach and the correct internal reporting procedures is essential to reducing response time.

Pre-Drafted Notification Templates: Having ready-to-use templates for both PDPC notifications and individual notifications can save critical hours when a breach is confirmed. Templates should be reviewed and updated regularly.

Strong Vendor Contracts: If third-party vendors process personal data on your behalf, your contracts must require them to notify you immediately upon discovering any breach. Your 3-day clock with the PDPC runs from when you become aware — not when your vendor tells you.

For support with PDPA compliance, DPO appointment, or data protection policy documentation, contact Singapore Secretary Services today.

Frequently Asked Questions

What if I am unsure whether the breach is notifiable?
Notify the PDPC anyway. The PDPC will assess the breach and provide guidance. It is always better to notify unnecessarily than to miss the 3-day deadline for a notifiable breach. Document your assessment either way.

The breach happened over a weekend. Does the 3-day clock still run?
Yes. The 3-day window is measured in calendar days, not business days. If you discover a breach on a Friday evening, your PDPC notification is due by Monday evening at the latest. Weekends and public holidays do not pause the clock.

My vendor suffered the breach, not us. Are we still responsible?
Yes. As the data controller, you remain responsible for the personal data even when a third-party data processor handles it on your behalf. Your 3-day notification period runs from when you become aware of the breach — which is why vendor contracts must require immediate notification to you.

Do we need to engage a lawyer?
For significant breaches, legal advice is strongly recommended. A lawyer can help you accurately assess your obligations, draft precise notifications, manage regulatory communications, and limit your exposure to civil liability from affected individuals.

Is the PDPA the only law that applies?
Depending on your industry, additional sectoral requirements may apply. MAS-regulated financial institutions, for example, have their own cybersecurity incident reporting requirements under the MAS Technology Risk Management Guidelines. Healthcare providers must also comply with the Ministry of Health’s incident reporting framework.

Conclusion

A data breach is a crisis, but your response determines whether it becomes a catastrophe. Singapore’s PDPA notification regime prioritises speed, transparency, and accountability — and businesses that respond promptly and in good faith are treated more favourably by the regulator.

Do not wait for a breach to start preparing. Building a robust data breach response capability — response plan, trained staff, ready templates, and a capable DPO — is one of the most important investments your business can make in its compliance infrastructure.

Singapore Secretary Services assists businesses with PDPA compliance, DPO appointment, and data protection documentation. Contact us on WhatsApp or visit our compliance services page to learn more.