How to Report a Data Breach to PDPC Singapore: 2026 Step-by-Step Guide

If your organisation has just discovered a data breach in Singapore, the clock is already ticking. Under the Personal Data Protection Act (PDPA), you may be legally required to notify the Personal Data Protection Commission (PDPC) within three calendar days, and affected individuals as soon as practicable. Miss that window and you are looking at reputational damage, regulatory scrutiny, and financial penalties that can reach up to 10% of annual turnover in Singapore for organisations with turnover exceeding S$10 million.

At Lunyb, we help individuals and small teams monitor personal data exposure, catch scam fallout from leaks, and build the kind of proactive habits that make a breach less likely and recovery far faster. This guide walks you through exactly how to report a data breach to the PDPC in 2026 — and how Lunyb fits into your incident response and post-breach monitoring.

What Counts as a Notifiable Data Breach in Singapore?

A notifiable data breach is a security incident involving personal data that either causes, or is likely to cause, significant harm to affected individuals, or that involves personal data of 500 or more individuals. If either threshold is met, PDPC notification is mandatory.

The PDPA's Mandatory Data Breach Notification regime, in force since 1 February 2021, sets out two clear tests:

• Significant harm test: The breach involves prescribed categories of personal data — such as full name with NRIC, financial account details, health information, or children's data — that could result in identity theft, fraud, physical harm, or emotional distress.
• Significant scale test: The breach affects 500 or more individuals, regardless of the data type.

Not every incident is notifiable. If the data was strongly encrypted, remediation was immediate, or the risk of harm is genuinely low, you may still need to log the incident internally but may not trigger the notification duty. When in doubt, document your reasoning and lean toward reporting.

Common Breach Scenarios in Singapore

• Lost or stolen laptops containing customer NRICs
• Misconfigured cloud storage buckets exposing records
• Phishing attacks that compromise staff email accounts
• Ransomware encrypting customer databases
• Insider misuse of HR or payroll records
• Vendor or processor breaches that cascade to your data

The PDPC Reporting Timeline You Cannot Miss

Singapore's breach notification timeline is tight and specific. Here is the sequence every organisation should memorise:

1. Day 0 — Discovery: You become aware of a potential breach. Start documentation immediately.
2. Within 30 days — Assessment: Conduct a credible, expeditious assessment to determine whether the breach is notifiable. The PDPC expects this to be as fast as reasonably possible, not stretched to the full 30 days without justification.
3. Within 3 calendar days — PDPC notification: Once you assess the breach as notifiable, you must inform the PDPC within 72 hours.
4. As soon as practicable — Notify affected individuals: Unless an exception applies (such as active law enforcement investigation or the data being rendered inaccessible via remediation).

These deadlines run in parallel with your technical containment. You do not get extra time because your IT team is still patching systems.

Step-by-Step: How to Report a Data Breach to the PDPC

Here is the exact process to follow once you have confirmed a notifiable breach.

Step 1: Contain the Breach

Before anything leaves your organisation, stop the bleeding. Isolate affected systems, revoke compromised credentials, disable leaked API keys, and preserve logs and forensic evidence. Document every action with timestamps — the PDPC will ask.

Step 2: Assemble Your Incident Response Team

Pull together your Data Protection Officer (DPO), IT lead, legal counsel, communications, and a senior business owner. Appoint a single incident commander so decisions do not get lost in Slack threads.

Step 3: Conduct the Notifiability Assessment

Answer these questions in writing:

• What personal data was involved, and how many individuals are affected?
• Was the data encrypted, pseudonymised, or in plain text?
• What is the realistic risk of identity theft, financial fraud, or other harm?
• Has the data already been accessed, copied, or exfiltrated?

Step 4: Submit the PDPC Online Breach Notification Form

Go to the PDPC website and log in to the Data Breach Notification portal using Corppass. The form asks for:

1. Organisation details and DPO contact information
2. Date and time of breach discovery
3. Nature and cause of the breach
4. Types of personal data involved
5. Number of affected individuals
6. Containment and remediation steps already taken
7. Plans for notifying affected individuals
8. Preventive measures going forward

Submit within 3 calendar days of concluding the breach is notifiable. If you are missing information, submit what you have and update the PDPC as facts develop — do not wait for a perfect report.

Step 5: Notify Affected Individuals

Unless an exception applies, notify affected individuals in a way they are likely to see — email, SMS, in-app notification, registered letter, or public announcement if direct contact is impractical. Your notification should include:

• A plain-English description of the breach
• The types of personal data involved
• Likely consequences and risks
• Steps you have taken to contain and remediate
• Concrete actions the individual can take to protect themselves
• Contact details for follow-up questions

Step 6: Cooperate With PDPC Follow-Up

The PDPC may request additional information, interview staff, or conduct an investigation. Respond promptly, be transparent, and demonstrate the improvements you have made. Organisations that cooperate openly and remediate quickly tend to receive more favourable outcomes than those that stonewall.

What the PDPC Expects to See in Your Report

The PDPC is not looking to punish honest organisations that respond well. They are looking for evidence of a mature, accountable programme. Your report should demonstrate:

Why Lunyb Belongs in Your Breach Response Plan

Reporting a breach to the PDPC is one half of the job. The other half is helping affected individuals — including yourself, your staff, and your customers — actually protect themselves afterwards. This is where Lunyb earns its place in your incident response toolkit.

Lunyb is a phone privacy and scam-protection app that gives individuals the tools to monitor exposure, spot scam follow-ups, and lock down their accounts after a breach. For DPOs, business owners, and anyone whose personal data has been caught up in an incident, it is the practical, consumer-side complement to the regulatory process.

Data Breach Alerts for Email and Phone

Lunyb monitors your email addresses and mobile numbers against known breach corpora and tells you when your details show up in a new exposure. If your organisation is breached — or if your personal data is caught in someone else's breach — you want to know quickly, not six months later when a scammer calls.

Scam Checker and Scam Shield

Breaches are followed by a surge of targeted scam attempts. Victims receive phishing emails, fake "bank security" calls, and smishing links referencing real transactions. Lunyb's Scam Checker lets you paste in a suspicious message or link and get an assessment in seconds, while Scam Shield helps filter risky callers before they ever reach you.

Privacy Check and Security Score

Our Privacy Check reviews the permissions on your phone and surfaces apps with unnecessary access to your location, contacts, microphone, or camera. The security score gives you a single number to track as you tighten things up — useful for staff onboarding or post-incident hardening.

Encrypted Password and Photo Vault

After a breach, password rotation is non-negotiable. Lunyb includes an encrypted vault so you and your team can generate strong, unique passwords and store sensitive photos (think ID copies you had to send for KYC) without leaving them in camera roll or email.

Data Broker Exposure Help and Photo Guard

Lunyb helps you reduce the footprint that data brokers and aggregators maintain on you, and Photo Guard performs reverse-image checks so you can see where your photos have surfaced online — valuable when you suspect identity misuse after a breach.

On-Device Tracker and Threat Blocking

Lunyb uses an on-device, network-level shield (encrypted DNS) to block known trackers, scam domains, and malicious links without routing your traffic through a third-party tunnel. It is private, local, and quietly effective.

Plans and Transparency

Lunyb plans start from about S$19.99 (USD equivalent) per month and renew until you cancel — and you can cancel anytime from the website. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. No lock-in, no surprises.

Building a Breach-Ready Organisation Before It Happens

The best breach report is the one you never have to file. Here is what mature Singapore organisations put in place well before an incident:

1. Written incident response plan: Clear roles, decision trees, and contact lists. Rehearsed at least annually.
2. Data inventory: You cannot report what you do not know you hold. Map personal data by system, purpose, and retention period.
3. Vendor due diligence: Your processors can breach your data. Contracts should require prompt notification to you.
4. Access controls and MFA: Most reported breaches trace back to a credential compromise that MFA would have blocked.
5. Staff training: Phishing simulations, DPO office hours, and clear reporting channels for suspected incidents.
6. Personal digital hygiene: Encourage staff to use tools like Lunyb for their own accounts — compromised personal email is a common entry point into corporate systems.

Common Mistakes Organisations Make When Reporting

• Waiting until the investigation is complete. The 3-day clock starts when you assess the breach as notifiable, not when forensics finishes.
• Under-scoping the affected population. It is better to notify a slightly wider circle than to miss people and have to issue a second notice.
• Legalese in customer notifications. Affected individuals need clear, actionable language — not disclaimers.
• Blaming the vendor without owning the outcome. You are still the data controller. The PDPC expects accountability.
• Skipping the follow-up fixes. A breach report with no credible preventive plan invites deeper scrutiny.

Your Next Step

If you are in the middle of an incident right now, work through Steps 1 to 6 above, submit through the PDPC portal, and keep documentation flowing. If you are preparing for a future incident — or you want to protect yourself and your team from the scam waves that follow every breach — Lunyb is built for exactly that.

Take the free privacy quiz on lunyb.com to see where your personal exposure sits today, then download the Lunyb app from the App Store or Google Play to turn on breach alerts, scam checking, and the encrypted vault. Pair it with a disciplined PDPC-aligned incident response plan and you will be in genuinely good shape in 2026.

For related reading on secure link sharing (useful when communicating breach notices to customers), see our honest review of Lunyb's privacy-first URL shortener and our comparison piece Rebrandly Review 2026: Is It Worth the Price (or Try Lunyb)?.

Frequently Asked Questions

How long do I have to report a data breach to the PDPC?

You must notify the PDPC within 3 calendar days of assessing that the breach is notifiable. The assessment itself should be conducted as expeditiously as reasonably possible, typically within 30 days of discovery. Affected individuals should be notified as soon as practicable thereafter.

What personal data triggers the "significant harm" test?

Prescribed categories include full name combined with NRIC or passport number, financial account details, health and medical information, information about vulnerable individuals including children, and account credentials. Exposure of these categories is generally presumed to risk significant harm.

Do I still need to notify if the data was encrypted?

If the personal data was rendered inaccessible through strong encryption or other technical measures, and the decryption keys were not also compromised, you may fall within an exception to notifying affected individuals. You should still assess and document the incident, and in many cases still inform the PDPC.

Can Lunyb help my organisation report breaches to the PDPC?

Lunyb is a consumer-focused privacy and scam-protection app, not a regulatory filing tool. It does not file reports on your behalf. What Lunyb does is help individuals — including your staff and customers — monitor their own exposure, catch scam follow-ups, and lock down accounts after an incident, which is a critical part of the human side of breach response.

What happens if I fail to notify the PDPC?

Failure to notify a notifiable breach is itself a breach of the PDPA and can attract financial penalties, directions to remediate, and reputational consequences. Penalties for organisations with annual turnover exceeding S$10 million can reach up to 10% of that turnover. Timely, transparent reporting almost always results in a better outcome than delay or concealment.