How to Report a Data Breach to PDPC Singapore: A Step-by-Step Guide

If your organisation has suffered a data breach in Singapore, the clock starts ticking the moment you become aware of it. Under the Personal Data Protection Act (PDPA), Singapore organisations have strict legal obligations to assess and report notifiable breaches to the Personal Data Protection Commission (PDPC). Failure to comply can result in financial penalties of up to S$1 million or 10% of annual turnover, whichever is higher.

This guide walks you through exactly how to report a data breach to PDPC Singapore, including timelines, thresholds, the notification process, and what to do before and after submission.

What Is a Data Breach Under Singapore's PDPA?

A data breach under the PDPA refers to the unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data, or the loss of any storage medium or device on which personal data is stored. The definition is broad and covers everything from cyberattacks and ransomware to lost laptops, misdirected emails, and improperly disposed paper records.

Singapore's mandatory data breach notification regime came into effect on 1 February 2022 under the amended PDPA. Since then, organisations are legally required to assess every breach and notify both the PDPC and affected individuals if certain conditions are met.

Common Examples of Reportable Breaches

• Ransomware or malware infections that expose customer databases
• Phishing attacks resulting in unauthorised access to employee email accounts containing personal data
• Lost or stolen unencrypted laptops, USB drives, or mobile devices
• Misconfigured cloud storage exposing files to the public internet
• Sending personal data to the wrong recipient via email or post
• Insider misuse, where employees access data without authorisation

When Must You Report a Data Breach to PDPC?

Not every breach needs to be reported. Under Section 26B of the PDPA, a breach is "notifiable" if it meets either of these two thresholds:

1. Significant harm threshold: The breach results in, or is likely to result in, significant harm to affected individuals. This includes financial loss, identity theft, reputational damage, or physical harm.
2. Significant scale threshold: The breach affects 500 or more individuals, regardless of harm.

The PDPC has published a list of personal data categories presumed to cause significant harm if compromised. These include NRIC numbers, financial account details, health information, and login credentials.

Notification Timelines You Must Follow

Step-by-Step: How to Report a Data Breach to PDPC

Here is the practical process your organisation should follow once a suspected breach is detected.

Step 1: Contain the Breach Immediately

Before notification, take immediate steps to stop the breach from worsening. This includes isolating affected systems, revoking compromised credentials, removing exposed data from public-facing servers, and preserving forensic evidence for investigation.

Step 2: Assemble Your Breach Response Team

Activate your Data Breach Management Plan and convene the response team. This should include your Data Protection Officer (DPO), IT/security staff, legal counsel, and senior management. If you don't have a DPO appointed, this is a separate PDPA violation that needs to be rectified.

Step 3: Assess Whether the Breach Is Notifiable

Within 30 days, conduct a documented assessment covering:

• What personal data was compromised
• How many individuals are affected
• The likely harm to those individuals
• Whether the data was encrypted or otherwise rendered unintelligible
• Whether remedial actions reduce the risk of harm

If the breach meets either threshold, you must proceed to notification. Document your assessment regardless of outcome — PDPC may request it during audits.

Step 4: Submit the Notification via PDPC's Online Portal

Notifications are submitted through the official PDPC Data Breach Notification form on the PDPC website (pdpc.gov.sg). You'll need:

• Your organisation's UEN and contact details
• DPO contact information
• Date and time the breach occurred and was discovered
• Description of the breach and root cause (if known)
• Categories and approximate number of affected individuals
• Types of personal data involved
• Containment and remediation measures taken
• Plans for notifying affected individuals

You must submit within 3 calendar days of determining the breach is notifiable. If you don't have complete information yet, file an initial notification and update PDPC as details emerge.

Step 5: Notify Affected Individuals

You must notify affected individuals in a clear, conspicuous manner about the breach, the data involved, potential consequences, and what they can do to protect themselves. Notification can be by email, post, SMS, or public announcement if direct contact isn't feasible.

There are two narrow exceptions where you may delay or skip individual notification: (1) when PDPC waives the requirement, or (2) when law enforcement requests a delay for investigation purposes.

Step 6: Follow Up With Remediation and Reporting

After the initial notification, continue to update PDPC with new findings. Implement long-term fixes such as enhanced access controls, encryption, staff training, and revised data handling policies.

What Information PDPC Will Ask For

The PDPC notification form is structured around the following key areas. Preparing this information in advance can save critical hours during a real incident.

Penalties for Failing to Report

The PDPC takes non-compliance seriously. Penalties under the amended PDPA include:

• Up to S$1 million in financial penalties for organisations with annual turnover under S$10 million
• Up to 10% of annual turnover for larger organisations
• Directions to stop processing data, publish acknowledgments, or compensate affected individuals
• Reputational damage from publicly enforced decisions on the PDPC website

In recent enforcement actions, PDPC has fined organisations for failing to notify, late notification, inadequate security arrangements, and weak access controls. Even small organisations have been penalised for breaches affecting just a few hundred individuals.

How to Reduce Your Risk Before a Breach Happens

Prevention is always cheaper than notification. Here are practical measures that align with PDPA's Protection Obligation under Section 24:

Technical Safeguards

• Encrypt personal data at rest and in transit
• Enforce multi-factor authentication on all administrative accounts
• Use encrypted DNS and private browsing tools for staff handling sensitive data
• Patch systems within defined SLAs and conduct regular vulnerability scans
• Implement least-privilege access and review permissions quarterly

Organisational Safeguards

• Appoint a qualified DPO and register their contact with ACRA
• Maintain a written Data Breach Management Plan, tested annually
• Conduct PDPA training for all staff handling personal data
• Vet data intermediaries and include breach notification clauses in contracts
• Use trusted link management platforms like Lunyb when sharing URLs externally, so you control redirects, monitor click activity, and avoid exposing internal endpoints. You can read more in our honest review of Lunyb.

Documentation and Audit Readiness

Keep records of your data inventory, consent forms, processing purposes, retention schedules, and breach assessments. PDPC investigators routinely request these during inquiries, and well-maintained records can significantly reduce penalty exposure.

Working With Data Intermediaries and Vendors

If you outsource data processing — to a cloud provider, payroll vendor, marketing agency, or analytics platform — you remain accountable under the PDPA. Data intermediaries must notify you "without undue delay" of any breach affecting your data, so you can in turn assess and report to PDPC.

Make sure your vendor contracts include:

• Mandatory breach notification within a defined timeframe (e.g. 24 hours)
• Cooperation clauses for PDPC investigations
• Audit rights and security certification requirements
• Liability and indemnity provisions
• Data return or destruction obligations at contract termination

When evaluating third-party tools, especially those that handle URLs, customer data, or marketing analytics, compare options carefully. Our 2026 buyer's guide to URL shorteners and our Rebrandly review can help you assess vendors against compliance and security criteria.

Frequently Asked Questions

Do I need to report a breach if data was encrypted?

If the personal data was encrypted to a strong industry standard and the encryption keys were not compromised, the breach is generally unlikely to meet the significant harm threshold. However, you still need to document the assessment and consider whether the 500-individual scale threshold applies. When in doubt, consult your DPO or legal counsel.

What happens if I miss the 3-day notification deadline?

Late notification is itself a breach of the PDPA and can attract financial penalties. If you've missed the deadline, notify PDPC as soon as possible and provide a full explanation of the delay. Voluntary disclosure and cooperation typically result in more lenient outcomes than discovery during investigation.

Can I report a breach anonymously?

No. PDPC notifications require your organisation's identification, including UEN, DPO contact, and senior management acknowledgment. Anonymous tip-offs from whistleblowers or affected individuals can be made separately, but mandatory notifications are formal organisational submissions.

Do small businesses and startups need to comply?

Yes. The PDPA applies to all organisations in Singapore regardless of size, with very limited exceptions for personal or domestic activity. Small businesses must appoint a DPO, implement reasonable security arrangements, and notify breaches just like large enterprises. PDPC offers free guides and toolkits tailored for SMEs.

What if the breach happened overseas but affects Singapore residents?

The PDPA has extraterritorial reach. If your organisation collects, uses, or discloses personal data of individuals in Singapore — even from overseas operations — you're subject to PDPA obligations, including breach notification. Cross-border breaches involving Singapore residents must be reported to PDPC if they meet the notifiable thresholds.

Final Thoughts

Reporting a data breach to PDPC is not just a legal checkbox — it's a test of how prepared your organisation is to handle a crisis. The 30-day assessment window and 3-day notification deadline leave little room for improvisation, so the work needs to happen before an incident, not during one.

Build your Data Breach Management Plan now, train your staff, audit your vendors, and document everything. If a breach does occur, act quickly, communicate transparently, and treat the notification process as an opportunity to demonstrate accountability. Done well, even a serious breach can be managed without catastrophic regulatory or reputational fallout.