How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

Singapore's Personal Data Protection Act (PDPA) sets out strict obligations for organisations that experience a data breach. Since the introduction of the mandatory Data Breach Notification (DBN) regime in February 2021, every business handling personal data in Singapore must understand exactly when and how to report a data breach to the Personal Data Protection Commission (PDPC). This guide walks you through the entire process — from initial detection to final submission — so you can respond confidently and stay compliant.

What Is a Data Breach Under Singapore's PDPA?

A data breach under the PDPA refers to the unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data, or the loss of any storage medium or device on which personal data is stored. This includes both malicious incidents (such as hacking and phishing) and accidental ones (such as emails sent to the wrong recipient or lost laptops).

Not every breach must be reported. The PDPA requires notification only when the breach meets specific thresholds — namely, when it is likely to cause significant harm to affected individuals or affects 500 or more individuals.

Common Examples of Reportable Breaches

• Ransomware attacks that encrypt customer databases
• Unauthorised access to financial or medical records
• Loss of unencrypted USB drives or laptops containing personal data
• Mis-sent emails containing sensitive information to large groups
• Website vulnerabilities exposing customer accounts

When Must You Report a Data Breach to the PDPC?

Under Section 26D of the PDPA, an organisation must notify the PDPC of a notifiable data breach as soon as practicable, and no later than 3 calendar days after the day the organisation assesses that the breach is notifiable.

A breach is considered notifiable if it meets either of the following criteria:

1. Significant harm threshold: The breach results in, or is likely to result in, significant harm to affected individuals.
2. Significant scale threshold: The breach affects 500 or more individuals.

What Counts as "Significant Harm"?

The PDPC has prescribed categories of personal data whose unauthorised disclosure is deemed to result in significant harm. These include:

• Full name or alias combined with NRIC, FIN, or passport number
• Financial information such as bank account or credit card details
• Health and medical information
• Information on adoption, vulnerable individuals, or domestic abuse
• Account credentials (e.g. usernames and passwords)

Step-by-Step: How to Report a Data Breach to PDPC

Reporting a breach is a structured process. Follow these steps to ensure full compliance with the PDPA.

Step 1: Contain the Breach Immediately

Before notification, take immediate action to limit damage. This may include isolating affected systems, revoking compromised credentials, recovering lost devices, or temporarily shutting down breached services. Document every action taken — the PDPC will ask about your containment measures.

Step 2: Assess Whether the Breach Is Notifiable

You have up to 30 days from the date you first became aware of a suspected breach to conduct a reasonable and expeditious assessment. The assessment should determine:

• The type of personal data involved
• The number of individuals affected
• The likelihood and severity of harm
• Whether the breach meets the notifiable thresholds

Step 3: Notify the PDPC Within 3 Calendar Days

Once you have determined the breach is notifiable, you must submit a report to the PDPC within 3 calendar days. Submission is done online via the PDPC's official Data Breach Notification form at www.pdpc.gov.sg.

Step 4: Notify Affected Individuals

If the breach is likely to result in significant harm, you must also notify affected individuals on or after notifying the PDPC. Notifications should be clear, in plain language, and include practical steps individuals can take to protect themselves.

Step 5: Document and Remediate

Maintain comprehensive records of the breach, your assessment, notifications sent, and remedial measures implemented. The PDPC may request these records during follow-up enquiries.

Information Required in the PDPC Notification Form

The online notification form requires detailed information. Prepare the following before you begin:

Category	Details Required
Organisation Details	Company name, UEN, Data Protection Officer (DPO) contact
Incident Overview	Date and time of breach, date of discovery, cause
Scope	Number of individuals affected, types of personal data involved
Impact Assessment	Potential harm, risk evaluation, evidence of misuse (if any)
Containment Measures	Immediate actions taken, current status of breach
Remedial Plan	Long-term controls, staff training, technical safeguards
Notification to Individuals	Whether and how affected individuals were informed

Exceptions: When You Don't Need to Notify Individuals

Even if a breach is notifiable to the PDPC, you may be exempt from notifying affected individuals in certain circumstances:

• Remedial action taken: The organisation has taken action that renders it unlikely that significant harm will occur (e.g. successful remote wipe of a stolen device).
• Technological protection: The personal data was protected by encryption or other technological measures making it unintelligible to unauthorised parties.
• Law enforcement instruction: A prescribed law enforcement agency or the PDPC instructs the organisation not to notify, typically to avoid compromising investigations.

Penalties for Non-Compliance

Failure to comply with the data breach notification obligation can result in significant financial penalties. Under the amended PDPA, the PDPC can impose financial penalties of:

• Up to S$1 million, or
• 10% of the organisation's annual turnover in Singapore (for organisations with turnover exceeding S$10 million), whichever is higher.

Beyond fines, non-compliance can damage brand reputation, erode customer trust, and trigger civil claims from affected individuals.

Best Practices to Prevent Data Breaches

Prevention is always more cost-effective than remediation. Implement these practices to reduce breach risk and demonstrate accountability under the PDPA.

1. Appoint a Qualified Data Protection Officer (DPO)

Every organisation in Singapore must appoint a DPO whose contact details are publicly available. The DPO oversees PDPA compliance and serves as the primary contact during incidents.

2. Conduct Regular Risk Assessments

Map your data flows, identify high-risk processing activities, and conduct Data Protection Impact Assessments (DPIAs) where appropriate.

3. Implement Strong Technical Safeguards

• Encrypt personal data both at rest and in transit
• Use multi-factor authentication for all sensitive systems
• Apply patches and security updates promptly
• Maintain regular, tested backups

4. Train Staff Regularly

Human error remains the leading cause of data breaches. Conduct mandatory annual training on phishing, password hygiene, and incident reporting procedures.

5. Secure Links and Communications

When sharing customer-facing links — such as account verification, marketing campaigns, or support pages — use trusted tools that offer secure redirects and click analytics. Privacy-focused link management platforms like Lunyb let you shorten and monitor URLs without exposing sensitive parameters, helping reduce the risk of phishing impersonation tied to your brand. You can read more in our honest review of Lunyb.

Building a Data Breach Response Plan

Every organisation should have a documented Data Breach Management Plan (DBMP). A robust DBMP typically includes:

1. Detection mechanisms — monitoring tools, employee reporting channels, third-party alerts
2. Response team roles — DPO, IT, Legal, Communications, Senior Management
3. Containment playbooks — scenario-specific steps for ransomware, lost devices, insider threats, etc.
4. Assessment criteria — clear thresholds aligned with PDPA notifiability rules
5. Notification templates — pre-approved messaging for PDPC, individuals, and media
6. Post-incident review process — root cause analysis and corrective actions

How Lunyb Supports PDPA-Aligned Link Hygiene

While Lunyb is not a breach notification tool, secure URL handling is an underappreciated part of data protection. Mis-configured tracking links can leak personal identifiers in query strings, and unmanaged shortened URLs can be hijacked for phishing campaigns targeting your customers. Using a reputable shortener with HTTPS, access controls, and analytics — and avoiding embedding raw personal data in URLs — is a simple but effective safeguard. For more on choosing the right platform, see our 2026 buyer's guide to URL shorteners.

Frequently Asked Questions

1. How long do I have to report a data breach to the PDPC?

You must notify the PDPC as soon as practicable, and no later than 3 calendar days after determining that the breach is notifiable. The assessment itself should be completed within 30 days of becoming aware of a suspected breach.

2. Do I need to report every data breach in Singapore?

No. Only breaches that are likely to cause significant harm to individuals, or that affect 500 or more individuals, are notifiable. However, you should document and assess every incident, even minor ones, as part of good governance.

3. What happens if I report late or fail to report?

The PDPC can impose financial penalties of up to S$1 million or 10% of annual Singapore turnover (whichever is higher) for organisations above S$10 million in turnover. Late reporting may also trigger formal investigations and reputational harm.

4. Can I notify the PDPC before completing my full investigation?

Yes — and you should. The PDPC encourages early notification even if all facts are not yet available. You can submit updates and supplementary information as the investigation progresses.

5. Do data intermediaries (vendors) need to notify the PDPC directly?

No. Data intermediaries must notify the organisation they are processing data for (the data controller) without undue delay. The controller is then responsible for assessing and notifying the PDPC and affected individuals.

Final Thoughts

Reporting a data breach to the PDPC is more than a regulatory checkbox — it is a critical trust-building exercise with your customers. By understanding the notification thresholds, preparing a response plan in advance, and investing in preventive measures, Singapore organisations can navigate even serious incidents with clarity and confidence. When in doubt, consult your DPO or seek legal advice early. The 3-day clock moves quickly, but a well-prepared organisation will always be ready.