How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

Singapore's Personal Data Protection Act (PDPA) makes data breach notification mandatory for organisations that suffer significant data security incidents. Since the introduction of the Mandatory Data Breach Notification regime on 1 February 2021, businesses operating in Singapore must understand exactly when, how, and what to report to the Personal Data Protection Commission (PDPC).

This guide walks you through the entire process of reporting a data breach to the PDPC, from the moment you detect an incident to the final notification submission. Whether you're a small business owner, a Data Protection Officer (DPO), or part of an incident response team, this article provides the practical steps you need to stay compliant.

What Is a Notifiable Data Breach Under the PDPA?

A notifiable data breach is any unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data that meets specific thresholds set by the PDPC. Not every security incident requires notification — only those that cause significant harm or affect a large number of individuals.

Under Section 26B of the PDPA, a data breach must be notified if it:

Results in, or is likely to result in, significant harm to affected individuals; or
Affects 500 or more individuals, regardless of the level of harm.

What Counts as "Significant Harm"?

The PDPC has prescribed specific categories of personal data that are presumed to cause significant harm if compromised. These include:

Full name or alias combined with NRIC, FIN, passport, or work permit numbers
Financial information such as bank account numbers, credit card details, or transaction history
Health information including medical diagnoses, treatments, and prescriptions
Information about adoption, mental health, or sexual orientation
Account credentials such as usernames combined with passwords or security questions

Who Must Report a Data Breach to the PDPC?

Any organisation that collects, uses, or discloses personal data in Singapore is subject to the PDPA's breach notification obligations. This includes private sector companies, non-profit organisations, and even sole proprietors handling personal data.

Data intermediaries (third parties processing data on behalf of another organisation) have a duty to notify the engaging organisation “without undue delay” when they become aware of a breach. The primary obligation to notify the PDPC, however, rests with the organisation that controls the data.

Timeline: When Must You Report a Data Breach?

Timing is one of the most critical compliance aspects of the PDPA's breach notification regime. The clock starts the moment your organisation has reason to believe a breach has occurred.

The Key Deadlines

Within 30 calendar days: Assess whether the breach is notifiable from the time you have reason to believe it occurred.
Within 3 calendar days: Notify the PDPC once you determine the breach is notifiable.
As soon as practicable: Notify affected individuals if the breach is likely to result in significant harm (some exceptions apply).

Failure to meet these deadlines may result in financial penalties of up to S$1 million or 10% of the organisation's annual turnover in Singapore (whichever is higher) for organisations with annual turnover exceeding S$10 million.

Step-by-Step: How to Report a Data Breach to PDPC

Reporting a data breach involves a structured process of containment, assessment, notification, and documentation. Following these steps ensures you remain compliant and protect affected individuals.

Step 1: Contain the Breach

Immediately take steps to limit the scope and impact of the breach. This may include:

Isolating affected systems from the network
Disabling compromised user accounts
Resetting passwords and revoking access tokens
Removing exposed data from publicly accessible locations
Preserving evidence and forensic logs for investigation

Step 2: Assess the Breach

Within 30 days of becoming aware of the incident, conduct a thorough assessment to determine:

The nature and extent of personal data involved
The cause of the breach (cyberattack, human error, system failure, etc.)
The number of individuals affected
The likelihood of significant harm
Whether the breach meets the notification threshold

Step 3: Notify the PDPC Within 3 Days

If the breach is notifiable, submit your report via the PDPC's official online portal at www.pdpc.gov.sg. Navigate to the "Report a Data Breach" section and complete the Data Breach Notification Form.

You'll need to provide:

Organisation details and DPO contact information
Date and time the breach was discovered
Description of the breach and its cause
Types of personal data involved
Estimated number of affected individuals
Steps taken to contain and remediate the breach
Plans for notifying affected individuals

Step 4: Notify Affected Individuals

If the breach is likely to result in significant harm, you must notify affected individuals at the same time or after notifying the PDPC. The notification should be clear, in plain language, and include:

A description of what happened
Types of personal data compromised
Potential consequences for the individual
Steps the individual can take to protect themselves
Contact details for further inquiries

Step 5: Document Everything

Maintain detailed records of the breach, your response, and the rationale behind your decisions. The PDPC may request this documentation during investigations or audits, even for breaches you determine are not notifiable.

Exceptions to Individual Notification

While PDPC notification is generally mandatory for qualifying breaches, you may be exempt from notifying affected individuals in certain situations:

Remedial action taken: If you've taken actions that make significant harm unlikely (e.g., remote wipe of a lost device before access).
Technological protections: If the compromised data was encrypted or otherwise protected, making it unintelligible to unauthorised parties.
Law enforcement requests: If notification would prejudice an ongoing investigation by Singapore authorities.
PDPC waiver: If the PDPC grants a specific waiver based on public interest considerations.

Common Data Breach Scenarios in Singapore

Scenario	Notifiable?	Action Required
Phishing attack exposing 1,000 customer emails and passwords	Yes (500+ individuals)	Notify PDPC and individuals
Lost USB containing 50 patients' medical records	Yes (significant harm)	Notify PDPC and individuals
Email sent to wrong recipient with one person's NRIC	Yes (significant harm)	Notify PDPC and individual
Encrypted laptop stolen, no decryption key compromised	Generally no	Document and assess
Website typo exposing 600 names and contact numbers only	Yes (500+ individuals)	Notify PDPC; individuals if significant harm

How to Prevent Data Breaches

Prevention remains far more cost-effective than remediation. Singapore organisations should implement layered security controls to minimise breach risk.

Technical Safeguards

Encrypt personal data both at rest and in transit
Implement multi-factor authentication on all sensitive systems
Use endpoint detection and response (EDR) solutions
Apply security patches promptly
Segment networks to limit lateral movement
Use encrypted DNS and private browsers for sensitive web activity

Operational Safeguards

Conduct regular staff training on phishing and data handling
Maintain a written incident response plan
Perform regular Data Protection Impact Assessments (DPIAs)
Appoint a competent Data Protection Officer
Audit third-party data processors regularly

Even seemingly minor tools used by your team deserve scrutiny. For instance, if your marketing department uses a link shortener to track campaigns, choose a privacy-conscious service like Lunyb that doesn't sell click data to advertisers. For more on choosing reputable services, see our 2026 buyer's guide to URL shorteners.

The Role of the Data Protection Officer (DPO)

Every organisation in Singapore must appoint at least one DPO whose contact details are publicly available. During a breach, the DPO serves as the primary point of contact with the PDPC and coordinates the internal response.

Key DPO responsibilities during a breach include:

Receiving and triaging the initial breach report from internal teams
Leading the assessment of notification thresholds
Drafting and submitting the PDPC notification
Coordinating individual notifications
Liaising with legal counsel, IT, and senior management
Documenting lessons learned and updating policies

Penalties for Non-Compliance

The PDPC has shown increasing willingness to impose significant financial penalties for breach notification failures. Recent enforcement actions have included fines ranging from S$5,000 for smaller organisations to over S$750,000 for major incidents involving thousands of affected individuals.

Beyond financial penalties, non-compliance can result in:

Mandatory remediation directions from the PDPC
Reputational damage and loss of customer trust
Civil lawsuits from affected individuals
Increased regulatory scrutiny for future operations

Frequently Asked Questions

1. Do I need to report a data breach if I'm not sure it caused significant harm?

You have 30 days from discovery to assess whether a breach is notifiable. If your assessment concludes the breach doesn't meet either threshold (significant harm or 500+ individuals), you're not required to notify the PDPC, but you should document your assessment thoroughly in case of future inquiry.

2. What happens if I miss the 3-day PDPC notification deadline?

Late notifications may attract enforcement action and financial penalties. If you've missed the deadline, notify the PDPC immediately and explain the circumstances. Transparency and prompt remedial action are often considered as mitigating factors during enforcement decisions.

3. Can I notify the PDPC before completing my full assessment?

Yes, and you should if you have reasonable grounds to believe the breach is notifiable. You can submit an initial notification with the information available and update the PDPC as your investigation progresses. Waiting for complete information at the expense of timeliness is not advisable.

4. Are overseas data breaches affecting Singapore residents notifiable?

Yes. If your organisation is subject to the PDPA and the breach affects personal data of individuals in Singapore, you must comply with the notification obligations regardless of where the breach physically occurred or where the data was stored.

5. How should I notify affected individuals if I don't have their current contact information?

Use any reasonable means available, including email, postal mail, SMS, or phone calls. If direct contact isn't possible, the PDPC may accept public notification through your website, social media, or newspaper advertisements. Document your efforts to reach each individual.

Final Thoughts

Reporting a data breach to the PDPC is a structured but time-sensitive process. By understanding the notification thresholds, meeting the 30-day assessment and 3-day notification deadlines, and maintaining clear documentation throughout, your organisation can manage breaches responsibly while staying compliant with Singapore's PDPA.

Preparation is the foundation of effective breach response. Establish your incident response plan now, train your team regularly, and ensure your DPO has the authority and resources to act decisively when an incident occurs. The few hours invested in preparation today can save your organisation millions in penalties and reputation damage tomorrow.