How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

If your organisation has suffered a data breach in Singapore, you may be legally required to notify the Personal Data Protection Commission (PDPC) within strict timelines. Under the Personal Data Protection Act (PDPA), failure to report a notifiable data breach can result in financial penalties of up to S$1 million or 10% of annual turnover in Singapore. This guide walks you through exactly how to report a data breach to PDPC, what qualifies as notifiable, and how to stay compliant from start to finish.

What Is a Data Breach Under Singapore's PDPA?

A data breach under the Personal Data Protection Act (PDPA) refers to the unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data. It also includes the loss of any storage medium or device on which personal data is stored, where unauthorised access or disclosure is likely.

Since 1 February 2021, Singapore's mandatory Data Breach Notification (DBN) obligation has been in force under Part VIA of the PDPA. This means organisations no longer have discretion in deciding whether to report certain breaches — notification to PDPC and affected individuals is a legal requirement.

Common Examples of Data Breaches

• Hacking or ransomware attacks compromising customer databases
• Lost or stolen laptops, USB drives, or mobile phones containing personal data
• Accidental email disclosure (e.g., CC instead of BCC to a large list)
• Phishing attacks leading to credential theft
• Insider threats — staff accessing data without authorisation
• Misconfigured cloud storage exposing personal data publicly

When Must You Report a Data Breach to PDPC?

You must report a data breach to PDPC if it is a notifiable data breach. A breach is notifiable when it meets either of these two thresholds:

1. Significant harm threshold: The breach results in, or is likely to result in, significant harm to affected individuals.
2. Significant scale threshold: The breach affects, or is likely to affect, 500 or more individuals.

What Counts as "Significant Harm"?

The Personal Data Protection (Notification of Data Breaches) Regulations 2021 prescribe specific categories of personal data that, if compromised, are deemed to cause significant harm. These include:

• NRIC, FIN, passport, work permit, or birth certificate numbers
• Account details (e.g., credit/debit card numbers, bank account numbers with security codes)
• Health information and medical diagnoses
• Information about adoption, sexual orientation, or domestic abuse
• Private key used to authenticate or sign electronic records
• Login credentials enabling access to accounts holding the above data

Mandatory Timelines for Reporting

Time is critical. Here are the statutory deadlines you must meet:

Action	Deadline	To Whom
Assess whether breach is notifiable	Within 30 calendar days of becoming aware	Internal assessment
Notify PDPC	As soon as practicable, no later than 3 calendar days after determining it is notifiable	PDPC
Notify affected individuals	On or after notifying PDPC, as soon as practicable	Affected individuals
Data Intermediary notifies organisation	Without undue delay	The organisation it processes data for

Important: The 30-day assessment period is not a grace period to delay action. PDPC expects organisations to act expeditiously and document their assessment process.

Step-by-Step: How to Report a Data Breach to PDPC

Step 1: Contain the Breach Immediately

Before notification, take immediate steps to contain the breach. This includes:

1. Isolating affected systems from the network
2. Revoking compromised credentials and resetting passwords
3. Recovering lost devices or data where possible
4. Stopping the unauthorised practice (e.g., disabling a misconfigured database)
5. Preserving evidence for forensic investigation

Step 2: Assess the Breach

Conduct a thorough assessment to determine:

• What personal data was involved
• How many individuals are affected
• The cause and extent of the breach
• The likely harm to individuals
• Whether the breach meets the notification thresholds

Document every step of this assessment. PDPC may request this documentation later.

Step 3: Notify PDPC Through the Official Portal

Submit your notification via the PDPC's online Data Breach Notification form at pdpc.gov.sg. You'll need to provide:

1. Organisation name, UEN, and contact details of the Data Protection Officer (DPO)
2. Date and time the breach occurred and was discovered
3. Description of the breach and how it happened
4. Categories and number of individuals affected
5. Types of personal data compromised
6. Potential harm to affected individuals
7. Containment and remediation actions taken
8. Plans for notifying affected individuals

Step 4: Notify Affected Individuals

Unless an exception applies, you must notify affected individuals in a clear and easily understandable manner. The notification should include:

• The facts of the breach
• The personal data and individuals affected
• Potential consequences and harm
• Measures the organisation has taken or will take
• Steps individuals can take to protect themselves (e.g., change passwords, monitor accounts)
• Contact details for queries

Step 5: Exceptions to Individual Notification

You are not required to notify affected individuals if:

• You have taken remedial action that renders unlikely the significant harm
• The personal data was technologically protected (e.g., strong encryption) such that the breach is unlikely to cause significant harm
• A prescribed law enforcement agency instructs you not to notify
• PDPC waives the requirement upon written application

Step 6: Document and Review

Maintain a comprehensive record of the breach, your response, and lessons learned. Update your data protection policies, conduct staff training, and strengthen security controls to prevent recurrence.

What Happens After You Notify PDPC?

After submission, PDPC may:

• Acknowledge receipt and request further information
• Open an investigation, especially for large-scale or high-risk breaches
• Issue directions to remediate or improve practices
• Impose financial penalties if PDPA breaches are confirmed
• Publish enforcement decisions, which may include your organisation's name

Voluntary disclosure, cooperation, and prompt remediation are considered favourably and can reduce penalty amounts significantly.

Penalties for Non-Compliance

The consequences of failing to report a notifiable breach — or breaching the PDPA itself — are severe:

Organisation Type	Maximum Financial Penalty
Annual turnover > S$10 million	10% of annual turnover in Singapore
All other organisations	S$1 million
Individuals (mishandling personal data)	Up to S$5,000 fine and/or imprisonment

Best Practices to Prevent Data Breaches

Prevention is always cheaper than remediation. Implement these proactive measures:

1. Appoint a Qualified Data Protection Officer

Every organisation in Singapore must appoint at least one DPO. Ensure they have the training, authority, and resources to manage compliance effectively.

2. Conduct Regular Risk Assessments

Map out where personal data is stored, processed, and transmitted. Identify vulnerabilities through periodic Data Protection Impact Assessments (DPIAs).

3. Encrypt Sensitive Data

Encryption at rest and in transit can be a lifesaver — if encrypted data is breached but the keys remain secure, individual notification may not be required.

4. Secure Your Links and Communications

Phishing remains a leading cause of data breaches. When sharing links with customers or staff, use trusted tools to avoid suspicious-looking URLs. Services like Lunyb let you create branded, secure short links with analytics, helping you spot unusual click patterns that could indicate phishing impersonation. For a deeper look at link safety tools, see our 2026 buyer's guide to URL shorteners.

5. Train Staff Regularly

Human error causes the majority of breaches. Run quarterly training on phishing awareness, password hygiene, and proper data handling.

6. Implement Access Controls

Apply the principle of least privilege. Use multi-factor authentication (MFA) for all systems containing personal data.

7. Have an Incident Response Plan

Don't wait for a breach to figure out who does what. Document a clear incident response playbook with named owners, contact lists, and PDPC notification templates ready to go.

Special Considerations for Data Intermediaries

If your organisation processes personal data on behalf of another (e.g., as a cloud provider or outsourced service), you are a Data Intermediary. Your obligations include:

• Notifying the engaging organisation "without undue delay" once you become aware of a breach
• Cooperating in the investigation and notification process
• The engaging organisation remains the party responsible for notifying PDPC and individuals

Ensure your data processing agreements clearly define breach notification timelines and responsibilities.

Cross-Border Breach Considerations

If the breach involves personal data transferred overseas, you may have parallel notification obligations under other regimes such as GDPR (EU), Australia's NDB scheme, or Hong Kong's PDPO. Coordinate your notifications carefully to ensure consistency and meet all timelines.

Frequently Asked Questions

How quickly must I notify PDPC after discovering a data breach?

You have up to 30 calendar days to assess whether the breach is notifiable. Once you determine it is notifiable, you must notify PDPC as soon as practicable, and no later than 3 calendar days from that determination. In practice, regulators expect organisations to act much faster than the maximum timeline.

Do I need to notify individuals if data was encrypted?

Not necessarily. If the affected personal data was protected by strong encryption or similar technological measures, and the breach is unlikely to result in significant harm, you may be exempt from notifying individuals. However, you may still need to notify PDPC if the scale threshold (500+ individuals) is met.

What if I'm unsure whether a breach is notifiable?

Document your assessment thoroughly and err on the side of notification. PDPC views voluntary disclosure favourably. You can also seek guidance from a qualified Data Protection Officer or legal counsel. PDPC has published Advisory Guidelines on the DBN obligation, which provide detailed examples.

Can PDPC fine my company if we report a breach?

Reporting a breach itself does not trigger a fine — failure to comply with PDPA obligations does. If PDPC's investigation finds the breach was caused by inadequate protection measures, fines may apply. However, prompt reporting, cooperation, and remediation typically result in significantly reduced penalties compared to cover-up attempts.

What records should I keep after a breach?

Maintain records of: when and how the breach was discovered, your assessment process and findings, containment and remediation steps, all communications with PDPC and affected individuals, root cause analysis, and improvements implemented. Retain these for at least 3 years, as PDPC may audit your response retrospectively.

Final Thoughts

Reporting a data breach to PDPC is not just a legal obligation — it's an opportunity to demonstrate accountability and rebuild trust with affected individuals. The Singapore PDPA's mandatory notification regime is one of the strictest in Asia-Pacific, but its framework is clear and workable if you prepare in advance.

The single biggest mistake organisations make is treating breach response as an ad-hoc exercise. Build your incident response plan now, train your team, secure your data flows, and ensure your DPO has direct access to leadership. When the next breach happens — and statistically, it will — you'll be ready to respond compliantly, calmly, and credibly.

For organisations strengthening their broader digital security posture, also review your link-sharing practices and consider trusted URL management platforms. You can read our honest review of Lunyb to see how secure link tools fit into a wider compliance strategy.