How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

If you've just discovered a data breach in Singapore, the clock is already ticking. Under the Personal Data Protection Act (PDPA), organisations have strict obligations to assess, notify, and remediate — and individuals have the right to know when their data has been exposed. This 2026 guide walks you through exactly how to report a data breach to the Personal Data Protection Commission (PDPC), what to do before you file, and how Lunyb helps both organisations and individuals stay ahead of leaks instead of scrambling after them.

Whether you're a startup founder, a compliance officer, or an individual whose email has shown up in a leak, the steps below will give you a clean, defensible process — and a smarter way to monitor exposure going forward.

What Counts as a Notifiable Data Breach in Singapore

A notifiable data breach under Singapore's PDPA is any unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data that meets a specific harm or scale threshold. Not every security incident requires notification — but the ones that do must be reported promptly.

The two notification triggers

The PDPC requires notification when a breach:

Results in, or is likely to result in, significant harm to affected individuals (for example, exposure of NRIC numbers, financial account details, medical records, or login credentials); OR
Affects 500 or more individuals, regardless of whether harm is likely.

Examples of significant-harm data

Full NRIC or FIN numbers combined with name or date of birth
Credit card numbers, bank account details, or CVVs
Passwords, security questions, or authentication tokens
Health, mental health, or insurance records
Children's personal data
Private communications and intimate images

If your incident touches any of these categories, treat it as notifiable until a documented assessment proves otherwise.

The PDPC Reporting Timeline You Must Hit

Singapore's data breach notification regime runs on two important deadlines. Missing either one exposes your organisation to enforcement action, financial penalties, and reputational damage.

The 30-day assessment window

From the moment a breach is discovered, organisations have up to 30 calendar days to assess whether it is notifiable. This is not a grace period to delay — it's a maximum. Regulators expect you to act expeditiously.

The 3-day PDPC notification window

Once you've assessed a breach as notifiable, you must notify the PDPC as soon as practicable, and no later than 3 calendar days after making that determination.

Notifying affected individuals

If the breach is likely to cause significant harm, you must also notify affected individuals at the same time or after notifying the PDPC — unless an exception applies (for example, remedial action has already made harm unlikely, or law enforcement has instructed you to delay).

Action	Deadline	Who You Notify
Assess whether breach is notifiable	Within 30 days of discovery	Internal
Notify PDPC of notifiable breach	Within 3 days of assessment	PDPC
Notify affected individuals	At or after PDPC notification	Affected persons

Step-by-Step: How to Report a Data Breach to PDPC

Reporting a breach to the PDPC is done through an online form on the PDPC website. Follow these steps in order to keep your response defensible and complete.

Step 1: Contain the breach

Isolate affected systems — disconnect compromised servers, revoke tokens, rotate credentials.
Preserve evidence: logs, access records, email headers, affected files.
Stop ongoing unauthorised access before it escalates.

Step 2: Assess scope and impact

Identify what personal data was affected (categories, fields, volume).
Count affected individuals as precisely as possible.
Determine whether the data meets the significant-harm threshold or the 500-person threshold.
Document your assessment — regulators will ask to see it.

Step 3: Prepare your submission

Before opening the PDPC form, gather:

Organisation details (UEN, DPO contact)
Date and time of breach discovery
Date and time of breach occurrence (if known)
Cause (cyberattack, human error, system fault, lost device)
Categories and number of affected individuals
Data types involved
Containment steps taken
Remediation plan and timeline
How and when you will notify affected individuals

Step 4: Submit via the PDPC Data Breach Notification form

Go to the PDPC website and locate the Data Breach Notification form under the "Report a Data Breach" section.
Log in using CorpPass.
Complete all mandatory fields — incomplete submissions delay the process.
Upload supporting documents if available.
Download and save the acknowledgement for your records.

Step 5: Notify affected individuals

Use clear, plain-language notifications that explain:

What happened and when
What data was involved
What the person should do (change passwords, watch bank statements, enable 2FA)
What you are doing to fix it
A contact point for questions

Step 6: Follow up with PDPC

Provide updates if new information emerges, and respond quickly to any PDPC queries. Keep a complete incident file for at least the retention period your legal team recommends.

What Happens After You Report

After a notification is filed, the PDPC reviews the submission and may request additional information, open an investigation, or close the matter if remediation is adequate. Cooperative, well-documented organisations generally fare much better than those who delay or minimise.

Possible outcomes

No further action — if the breach was minor and well-handled.
Directions — the PDPC may order specific remedial steps.
Financial penalties — for serious or negligent breaches.
Published decisions — case summaries may be published on the PDPC website.

If You're an Individual Affected by a Breach

You don't need to file with PDPC yourself when an organisation leaks your data — that's the organisation's duty. But you do need to act fast to protect your accounts, identity, and money.

Immediate steps for individuals

Change the password on the breached account and any account that reused the same password.
Turn on two-factor authentication everywhere you can.
Watch your bank and card statements for unfamiliar charges.
Be alert for phishing emails, SMS, and calls that reference the breach — scammers move fast after a leak.
Consider freezing your credit bureau file if financial data was exposed.
If an organisation should have notified you and didn't, you can lodge a complaint with the PDPC.

How Lunyb Helps You Stay Ahead of Breaches

Reporting a breach is reactive. The real win is catching exposure early — ideally before a scammer has time to use your leaked details. Lunyb is built for exactly that. It's a phone privacy and scam-protection app that gives individuals in Singapore (and the teams protecting them) a practical, all-in-one toolkit that would otherwise take a dozen separate services.

Data Breach Alerts for your email and phone

Lunyb continuously checks your email addresses and phone numbers against known data exposures and alerts you when something new surfaces. Instead of finding out months later through a suspicious charge, you get told early enough to rotate passwords, lock down accounts, and warn family members.

Scam Checker for post-breach phishing

The weeks after a breach are peak scam season. Attackers weaponise leaked details to craft convincing SMS, WhatsApp messages, and emails. Lunyb's Scam Checker lets you paste any suspicious message or link and get a quick read on whether it's a known scam pattern — so you don't click first and regret later.

Scam Shield and caller protection

Leaked phone numbers mean scam calls. Lunyb's Scam Shield helps filter and flag suspicious callers before you pick up, which matters a lot when your number has been dumped on a public forum.

Privacy Check for app permissions

Many breaches start with an over-permissioned app quietly harvesting data. Privacy Check reviews what your installed apps can actually see — contacts, location, microphone, photos — so you can revoke anything that doesn't earn its keep.

Encrypted Password and Photo Vault

Reusing passwords is the single biggest reason one breach cascades into five. Lunyb's encrypted vault stores credentials and sensitive photos locally and safely so you can use unique, strong passwords everywhere without memorising them.

On-device tracker and threat blocking

Lunyb includes a local DNS shield that blocks known trackers and malicious domains at the network level, right on your device. It's a quiet, always-on layer that cuts down the background data collection that often feeds leak databases in the first place.

Security Score and exposure help

The app gives you a single security score so you know where you stand, plus guidance for reducing your footprint with data-broker-style exposures. For Singapore users whose details show up in cross-border leaks, this is the shortest path from "my data is out there" to "I've actually done something about it."

Why this beats doing it manually

Task	DIY Approach	With Lunyb
Check email and phone against leaks	Multiple free sites, re-check manually	Continuous monitoring with alerts
Verify suspicious links and messages	Guess, or search each one	Paste and check in Scam Checker
Block scam callers	Report numbers one by one	Scam Shield flags risky calls
Manage passwords	Reuse or write them down	Encrypted vault, unique per site
Block trackers	Browser extensions, inconsistent	On-device DNS shield, always on
Know your overall risk	Unclear	Single security score

Plans start from about S$-equivalent US$19.99/month and renew until you cancel, which you can do online anytime. Optional Leak Protection is billed separately and can be paused without cancelling the main plan — useful flexibility if you only need deeper monitoring in bursts.

A Practical Breach Response Checklist

Keep this checklist in your incident playbook — or in your personal notes if you're an individual who has just been told your data is out.

For organisations

Contain the breach within hours, not days
Preserve logs and evidence
Assess notifiability within 30 days
Notify PDPC within 3 days of assessment
Notify affected individuals with clear guidance
Document every decision and timestamp
Review and update your Data Protection Policy
Retrain staff on the specific failure that led to the breach

For individuals

Change passwords on the affected account and any reuse
Enable two-factor authentication
Scan bank and card statements
Watch for breach-themed phishing
Set up continuous monitoring with Lunyb
Review app permissions on your phone
Consider a credit freeze if financial data was exposed

Common Mistakes to Avoid When Reporting

Waiting too long to assess. The 30-day window is a maximum, not a target.
Under-counting affected individuals. Err on the side of inclusion until you have confirmed data.
Vague notifications to individuals. Tell people exactly what data was exposed and what to do.
Treating notification as the end. Remediation, root-cause analysis, and process changes come after.
Not briefing leadership and PR. Legal, comms, and engineering need to row together.
Ignoring the follow-up duty to update the PDPC as new facts emerge.

Start Protecting Yourself Today

Knowing how to report a data breach to the PDPC is essential, but prevention and early detection are what actually keep your money, your identity, and your reputation intact. Don't wait for a breach notification letter to start caring about your digital footprint.

Head to lunyb.com and take the free privacy quiz — it only takes a minute and shows you where your biggest exposure risks sit right now. From there, you can start Breach Alerts, Scam Checker, Scam Shield, and the encrypted vault from one app on your phone. If you also want a privacy-first way to share links and QR codes without leaking metadata, check our take on Lunyb as a privacy-first URL shortener and our comparison with Rebrandly.

Frequently Asked Questions

Who has to report a data breach to the PDPC?

Any organisation subject to Singapore's PDPA that experiences a notifiable data breach — meaning one likely to cause significant harm to affected individuals, or one affecting 500 or more people. This applies whether you're a local SME, a multinational with Singapore operations, or a data intermediary processing data on behalf of another organisation.

How long do I have to notify the PDPC after a breach?

You have up to 30 calendar days from discovery to assess whether the breach is notifiable. Once you determine it is notifiable, you must notify the PDPC as soon as practicable and no later than 3 calendar days after that assessment.

What if I'm not sure whether my breach is notifiable?

Document your assessment carefully. If the data involves NRIC numbers, financial details, passwords, health records, or children's data, or if 500+ individuals are affected, treat it as notifiable. When in doubt, consult legal counsel or your Data Protection Officer — and err on the side of notifying.

Can individuals report a breach to the PDPC themselves?

Individuals don't file the organisation's breach notification, but you can lodge a complaint with the PDPC if you believe an organisation mishandled your personal data or failed to notify you of a breach that affected you. You can also report scams and phishing attempts that follow a breach to the Singapore Police Force and ScamShield.

How does Lunyb help after my data has already been leaked?

Lunyb gives you Data Breach Alerts for your email and phone so you learn about new exposures quickly, a Scam Checker for suspicious messages and links that often follow a leak, Scam Shield for risky calls, an encrypted password vault to stop one breach from cascading into others, and on-device tracker blocking to shrink your ongoing footprint. Start at lunyb.com or download the app from the App Store or Google Play.