How to Report a Data Breach to PDPC Singapore: A Complete Guide

If your organisation or personal data has been compromised in Singapore, the Personal Data Protection Commission (PDPC) expects you to act quickly, and so should you. This guide walks through exactly how to report a data breach to PDPC under the Personal Data Protection Act (PDPA), what the Commission looks for, and how Lunyb gives individuals and small teams a faster, calmer way to detect exposure, lock down accounts, and respond with confidence.

We are Lunyb, a privacy and scam-protection platform. We build the tools we wish everyone had before a breach happens: data breach alerts tied to your email and phone, a Scam Checker for suspicious messages and links, an encrypted Password and Photo Vault, and on-device threat blocking. If you want to stop reading, start with the free privacy quiz at lunyb.com and come back to the step-by-step below.

What counts as a reportable data breach in Singapore

A data breach under the PDPA is any unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data. Not every incident must be reported to PDPC, but the threshold is lower than many people assume.

The two reporting triggers under the PDPA

Since the mandatory data breach notification regime came into force on 1 February 2021, an organisation must notify PDPC if the breach:

Results in, or is likely to result in, significant harm to affected individuals, or
Is of a significant scale, which PDPC defines as affecting 500 or more individuals.

Examples PDPC treats as significant harm

Leaked NRIC numbers, passport numbers, or other national identifiers.
Financial information such as bank account or credit card details.
Health, medical, or insurance information.
Login credentials that could unlock other accounts.
Children's personal data or information about vulnerable individuals.

What individuals should know

If you are an individual whose data has been exposed, you are not the one required to notify PDPC, the organisation that held your data is. But you can and should file a complaint with PDPC if an organisation mishandles your data or fails to notify you. You should also take immediate steps to protect yourself, which is where Lunyb fits in.

The PDPC data breach reporting timeline

The clock matters. PDPC expects prompt action, and delays are themselves a compliance issue.

Within 30 days of discovery: Assess whether the incident is a notifiable breach.
Within 3 calendar days of assessing it as notifiable: Notify PDPC.
As soon as practicable: Notify affected individuals, unless an exception applies (for example, the data was encrypted to a sufficient standard, or law enforcement has asked you to hold off).

Miss these windows and you risk financial penalties, directions from the Commission, and reputational damage. Hit them cleanly and you demonstrate accountability, which is exactly what PDPC rewards.

How to report a data breach to PDPC: step by step

Here is the practical workflow organisations and sole proprietors in Singapore should follow when reporting a breach.

Step 1: Contain the breach

Before you notify anyone, stop the bleeding. Disconnect compromised systems, revoke exposed credentials, disable affected user accounts, and preserve logs. If an employee lost a device, remote-wipe it. If a phishing email tricked a staff member, reset their password and check for forwarding rules.

Step 2: Assess the scope and severity

Document what happened, when it was discovered, what data categories are involved, how many individuals are affected, and whether the data was encrypted. This assessment drives whether you must notify PDPC and the affected individuals.

Step 3: Prepare your notification

PDPC's online Data Breach Notification form asks for:

Organisation name, UEN, and contact details of the Data Protection Officer (DPO).
Date and time the breach occurred and was discovered.
Description of the breach, including cause and attack vector if known.
Categories and volume of personal data involved.
Number of affected individuals.
Containment and remediation measures already taken.
Plan to notify affected individuals.

Step 4: Submit via the PDPC website

Go to the PDPC Singapore website and locate the Data Breach Notification form under the Report a Breach section. You will log in via Singpass or Corppass depending on whether you are an individual filer or filing on behalf of an organisation. Submit the form within 3 calendar days of concluding the breach is notifiable.

Step 5: Notify affected individuals

Communicate clearly, in plain language. Tell people what data was exposed, what you are doing about it, and what steps they can take, such as changing passwords, watching for phishing, and monitoring financial statements. Point them to tools like Lunyb for ongoing monitoring if the exposure includes email addresses or phone numbers.

Step 6: Document everything and follow up

Keep a written breach register even for non-notifiable incidents. PDPC can request this during an investigation. After remediation, update your data protection policies, retrain staff, and run a post-incident review.

What PDPC looks at when assessing your response

The quality of your response often matters as much as the breach itself. PDPC's enforcement decisions repeatedly highlight the same factors.

Factor PDPC considers	What a strong response looks like
Speed of containment	Systems isolated and credentials revoked within hours, not days.
Timeliness of notification	PDPC notified within 3 days of assessment; individuals notified promptly.
Clarity of communication	Plain-language letter or email with concrete next steps for affected people.
Preventive measures before the breach	Encryption, access controls, staff training, and a named DPO on record.
Remediation after the breach	Policy updates, technical hardening, and ongoing monitoring.

What to do if you are an affected individual

If you receive a breach notification letter, or you suspect your data is out there, do not wait. The faster you act, the smaller the blast radius.

Change the password on the affected account and any account that shared the same password.
Turn on two-factor authentication wherever it is offered.
Check your email and phone number against known breach databases.
Watch for phishing in the weeks after a breach — scammers often use leaked data to craft convincing messages.
Monitor your bank and SingPass activity for anything unusual.
File a complaint with PDPC if you believe an organisation mishandled your data.

How Lunyb helps you detect breaches early and respond fast

Reporting a breach to PDPC is the formal half of the job. The other half, the half that protects you week to week, is knowing when your data leaks in the first place and shutting down the fallout before it spreads. That is exactly what we built Lunyb for.

Data Breach Alerts for your email and phone

Lunyb continuously checks your email addresses and phone numbers against known breaches and tells you what was exposed, where it came from, and what to do next. Instead of discovering a leak when strange charges appear, you find out on day one and can rotate passwords before anyone exploits them.

Scam Checker for suspicious messages and links

After a breach, phishing attempts spike. Scammers already have your name, maybe your NRIC, and they craft messages that look official. Paste the message or link into Lunyb's Scam Checker and get a clear read on whether it is safe, suspicious, or a known scam pattern. It is a thirty-second habit that stops a very bad day.

Scam Shield and caller protection

Fraud calls and SMS scams are the number one complaint across Singapore. Lunyb's Scam Shield helps screen calls and flag risky SMS so you are not making decisions while a stranger pressures you on the phone.

Encrypted Password and Photo Vault

Reused passwords are how one breach becomes five. Lunyb's encrypted vault stores unique passwords and sensitive photos locally and encrypted, so the next leak does not cascade into every other account you own.

Privacy Check and on-device threat blocking

Privacy Check surfaces which apps on your phone have access to what, so you can revoke permissions you never meant to grant. Our on-device, network-level threat blocking (a local DNS shield, not a tunnelled service) quietly blocks trackers and known-malicious domains while you browse, with no account juggling required.

Photo Guard, data-broker exposure help, and family location sharing

Reverse-image checks help you see where your photos have travelled. Our data-broker style exposure help walks you through reducing the surface area that scammers and spam networks use against you. And family location sharing keeps the people you love accounted for without handing their location to a third-party advertiser.

Plans start from about $19.99/month and renew until cancelled. You can cancel anytime online, and optional Leak Protection is billed separately and can be paused without cancelling the main plan. That transparency is deliberate: we would rather earn the next month than trap you.

A simple before-and-after breach checklist

Stage	Do this yourself	How Lunyb helps
Before a breach	Use unique passwords, enable 2FA, limit app permissions.	Password Vault, Privacy Check, security score, DNS-level blocking.
Moment of exposure	Watch for notification letters and unusual activity.	Data Breach Alerts tied to your email and phone.
Immediate response	Rotate passwords, enable 2FA, revoke sessions.	Vault stores new credentials; Scam Checker vets follow-up messages.
Ongoing recovery	Monitor accounts for weeks, reduce data-broker footprint.	Continuous alerts, exposure help, Scam Shield for fraud calls.

Common mistakes organisations make when reporting to PDPC

Waiting to be sure before notifying. The rule is 3 days from assessment, not 3 days from certainty.
Vague individual notifications that fail to tell people what was exposed or what to do.
No named DPO. Every organisation handling personal data in Singapore must appoint one and publish contact details.
Treating it as IT's problem. Breach response is legal, operational, and communications, not just technical.
No written breach register. Even non-notifiable incidents should be logged.

Where Lunyb fits for small businesses and solo operators

Not every organisation has a dedicated security team. If you are a small business, a freelancer, or a founder in Singapore, Lunyb gives you a baseline of protection that scales with you: breach monitoring for your business email and phone, a vault for shared credentials, scam checking for the sketchy invoices in your inbox, and a security score that tells you what to fix next. It is the practical layer between you and the kind of incident that triggers a PDPC notification in the first place.

If you are exploring tools for your business beyond privacy, we also cover link and QR workflows in reviews like Rebrandly Review 2026: Is It Worth the Price (or Try Lunyb)? and Is Lunyb Legit? Honest Review of the Privacy-First URL Shortener (2026). The same account covers privacy tools and our link shortener and secure QR platform.

Your next step

Reporting a breach to PDPC is a process you can absolutely handle with this guide. Preventing the next one, and catching it early when it happens, is where Lunyb pays for itself week after week.

Start with the free privacy quiz at lunyb.com to see where your email and phone are already exposed, then download the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Checker, and the encrypted vault. You will know sooner, respond faster, and sleep better.

FAQ

How do I report a data breach to PDPC in Singapore?

Submit the Data Breach Notification form on the PDPC website within 3 calendar days of assessing the breach as notifiable. You will log in via Singpass or Corppass and provide details about the breach, the data involved, the number of affected individuals, and your containment steps. Notifiable breaches are those causing significant harm or affecting 500 or more individuals.

What is the deadline to notify PDPC of a data breach?

Organisations must notify PDPC within 3 calendar days of determining a breach is notifiable. The assessment itself should happen within 30 days of discovery. Affected individuals must be notified as soon as practicable unless a specific exception applies.

Can an individual report a data breach to PDPC?

Yes. If you believe an organisation has mishandled your personal data or failed to notify you of a breach, you can lodge a complaint with PDPC through their website. You should also change affected passwords, enable two-factor authentication, and monitor for scam attempts using tools like Lunyb's Scam Checker.

What personal data is considered sensitive under the PDPA?

PDPC treats information like NRIC and passport numbers, financial details, health and medical records, login credentials, and data about children or vulnerable persons as likely to cause significant harm if leaked. Breaches involving these categories almost always meet the notification threshold.

How does Lunyb help after a data breach?

Lunyb sends Data Breach Alerts the moment your email or phone appears in a known breach, stores new unique passwords in an encrypted vault, flags scam messages and calls that often follow a leak, and blocks known-malicious domains on your device. It is the ongoing monitoring layer that keeps a single breach from spiralling into repeated fraud.