How to Report a Data Breach to PDPC Singapore: A Complete Guide

If your organisation has suffered a data breach in Singapore, you may be legally required to notify the Personal Data Protection Commission (PDPC) within 72 hours. Since the Personal Data Protection (Amendment) Act 2020 came into force, the data breach notification obligation has become a critical compliance requirement for every organisation handling personal data. This guide explains exactly how to report a data breach to PDPC, what counts as a notifiable breach, and how to manage the incident from detection to closure.

What Is a Data Breach Under Singapore's PDPA?

Under the Personal Data Protection Act (PDPA), a data breach is the unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data, or the loss of any storage medium or device on which personal data is stored where unauthorised access or use is likely. In simple terms, if personal information your organisation controls has been exposed, stolen, leaked, or lost, it qualifies as a data breach.

Not every breach has to be reported. The PDPC only requires notification when the breach meets specific thresholds defined in the law. Understanding this distinction is the first step in responding correctly.

Common Examples of Data Breaches

Ransomware or hacking incidents that compromise customer databases
Lost or stolen laptops, USB drives, or mobile devices containing personal data
Misdirected emails that disclose customer information to wrong recipients
Misconfigured cloud storage exposing files publicly
Insider threats where employees access or exfiltrate data without authorisation
Phishing attacks resulting in compromised user accounts

When Must You Report a Data Breach to PDPC?

You must notify the PDPC if the breach is a notifiable data breach. Under Section 26B of the PDPA, a breach is notifiable when it:

Results in, or is likely to result in, significant harm to affected individuals, OR
Is of significant scale — meaning it affects 500 or more individuals.

If either criterion is met, you must report the data breach to PDPC as soon as practicable, but no later than 3 calendar days (72 hours) from the time you have determined the breach is notifiable.

What Counts as "Significant Harm"?

The PDPC has prescribed categories of personal data whose unauthorised disclosure is deemed to cause significant harm. These include:

Full name combined with NRIC, FIN, work permit, or passport numbers
Financial information such as bank account numbers, credit card numbers, or income details
Health information including medical conditions, diagnoses, or treatment records
Information about adoption, sexual orientation, or domestic abuse
Account credentials such as usernames and passwords
Information about minors

Step-by-Step: How to Report a Data Breach to PDPC

The reporting process follows a clear sequence. Acting promptly and methodically helps minimise harm and demonstrates good-faith compliance.

Step 1: Contain the Breach Immediately

Before doing anything else, stop the bleeding. Disconnect affected systems from the network, revoke compromised credentials, disable affected user accounts, and isolate infected devices. Preserve forensic evidence — do not wipe systems before logs are captured.

Step 2: Assess the Breach Within 30 Days

The PDPA expects organisations to conduct an expeditious assessment — typically within 30 days — to determine whether the incident is a notifiable data breach. Your assessment should answer:

What personal data was affected?
How many individuals are involved?
What is the likelihood of significant harm?
Was the data encrypted or otherwise protected?
Has the data been recovered or rendered unusable?

Step 3: Notify the PDPC Within 72 Hours

Once you have determined the breach is notifiable, you have 3 calendar days to submit a notification. Reports are submitted through the PDPC's online Data Breach Notification form on the official PDPC website (pdpc.gov.sg). You will need:

Organisation details and Data Protection Officer (DPO) contact information
Date and time the breach occurred and was discovered
Description of the breach, including cause
Types and volume of personal data affected
Number of individuals affected
Containment and remediation actions already taken
Planned measures to prevent recurrence
Whether and how affected individuals will be notified

Step 4: Notify Affected Individuals

If the breach is likely to cause significant harm, you must also notify affected individuals on or after notifying PDPC. Notification should be clear, in plain language, and include:

What happened and when
What personal data was involved
What the organisation is doing about it
What individuals can do to protect themselves
Contact details for further enquiries

Notification to individuals is not required if remedial action has been taken that makes significant harm unlikely, or if a prescribed law enforcement agency or the PDPC instructs you to withhold notification.

Step 5: Document and Remediate

Keep complete records of the incident, assessment, decisions made, and actions taken. The PDPC may request these documents during follow-up enquiries. Implement long-term fixes — patching vulnerabilities, retraining staff, updating policies, and strengthening access controls.

Notification Timeline at a Glance

Phase	Action Required	Deadline
Detection	Identify and contain the breach	Immediately
Assessment	Determine if breach is notifiable	Within 30 days (expeditiously)
PDPC Notification	Submit breach report to PDPC	Within 3 calendar days of determination
Individual Notification	Inform affected individuals	On or after PDPC notification (if significant harm likely)
Remediation	Implement preventive measures	Ongoing

Penalties for Non-Compliance

Failing to notify the PDPC of a notifiable data breach is a serious offence. Under the amended PDPA, financial penalties can reach up to 10% of an organisation's annual turnover in Singapore (for organisations with turnover exceeding S$10 million) or S$1 million, whichever is higher. Beyond fines, non-compliance can result in directions from the PDPC, reputational damage, civil lawsuits from affected individuals, and loss of customer trust.

Common Compliance Mistakes

Waiting too long to assess whether a breach is notifiable
Failing to appoint or properly empower a Data Protection Officer
Underestimating the scope of affected data
Notifying PDPC but forgetting to inform affected individuals
Lacking incident response documentation
Not having a written data breach response plan

How to Prepare Before a Breach Happens

The best time to plan a breach response is before one occurs. Singapore organisations should build a proactive data protection programme that includes the following elements.

1. Appoint a Data Protection Officer (DPO)

Every organisation in Singapore is required to designate at least one DPO. Make sure their contact details are registered with ACRA and published on your website.

2. Develop a Data Breach Response Plan

Document who does what, when, and how during an incident. Include escalation paths, communication templates, legal counsel contacts, and a checklist aligned with PDPC requirements.

3. Conduct Regular Risk Assessments

Map where personal data lives, who has access, and how it flows through your systems. Identify high-risk areas and patch them before they become breach vectors.

4. Train Employees

Most breaches start with human error — a clicked phishing link, a misaddressed email, or a misconfigured share. Regular training significantly reduces this risk.

5. Use Secure Tools for Data Sharing

When sharing links to documents, dashboards, or customer portals, use trusted tools with proper access controls and audit trails. A reputable link management platform like Lunyb can help by providing trackable, controllable short links with analytics — useful for ensuring that sensitive communications reach the right audience and can be revoked if needed. You can read more in our honest review of Lunyb.

Breach Notification: Singapore vs Other Jurisdictions

Multinational organisations often need to comply with multiple breach notification regimes. Here is a quick comparison:

Jurisdiction	Regulator	Notification Deadline	Threshold
Singapore	PDPC	72 hours / 3 days	500+ individuals or significant harm
EU (GDPR)	National DPAs	72 hours	Risk to rights and freedoms
UK	ICO	72 hours	Risk to rights and freedoms
Australia	OAIC	As soon as practicable	Likely serious harm
Hong Kong	PCPD	Voluntary (recommended ASAP)	Risk-based

What Happens After You Notify PDPC?

After submitting the data breach notification, the PDPC will acknowledge receipt and may follow up with additional questions. In more serious cases, the Commission may open an investigation. Cooperation, transparency, and demonstrating that you took reasonable steps to prevent and respond to the incident weigh heavily in any enforcement decision.

The PDPC also publishes anonymised summaries of decisions and undertakings on its website. Reviewing these is a useful way to understand how the regulator views various scenarios and what mitigating factors it considers.

Mitigating Factors PDPC Considers

Speed of containment and notification
Voluntary disclosure
Cooperation with investigators
Proactive remediation
Existence of a documented data protection programme
Whether the organisation accepted a voluntary undertaking

Building a Long-Term Privacy Culture

Reporting a breach is reactive. The real goal is to build a culture where breaches are rare and contained quickly when they do happen. This means treating personal data as a liability to be minimised, not just an asset to be exploited. Adopt data minimisation, encrypt sensitive data at rest and in transit, enforce least-privilege access, and audit regularly.

For organisations that handle marketing and communications data, consider how the tools you use for outreach — including link shorteners, email platforms, and analytics — collect and process personal data. Choosing privacy-respecting tools reduces your overall risk surface. Our 2026 buyer's guide to URL shorteners compares popular options on privacy, security, and analytics features.

FAQ: Reporting Data Breaches to PDPC

1. How quickly must I report a data breach to PDPC?

You must notify the PDPC as soon as practicable, and no later than 3 calendar days (72 hours) from the time you determine the breach is notifiable. The clock starts when you have completed your assessment, not necessarily when the breach was discovered, but the assessment itself must be done expeditiously — generally within 30 days.

2. Do I have to report every data breach?

No. Only notifiable data breaches must be reported. A breach is notifiable if it is likely to cause significant harm to affected individuals, or if it affects 500 or more individuals. However, you should still document all breaches internally, even if they are not notifiable, as part of good governance.

3. What if I am not sure whether a breach is notifiable?

If you are uncertain, treat it cautiously and consult with your DPO or legal counsel. You can also voluntarily notify the PDPC — voluntary, prompt disclosure is generally viewed favourably. The PDPC's Guide on Managing and Notifying Data Breaches provides detailed examples to help you decide.

4. What are the penalties for not reporting a notifiable breach?

Financial penalties can reach up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, or S$1 million, whichever is higher. The PDPC may also issue directions requiring specific remediation, and affected individuals may pursue civil action.

5. How do I notify affected individuals?

Notification should be made through a method that is likely to reach the individuals — typically email, SMS, post, or in-app messaging. The communication should explain what happened, what data was involved, what the organisation is doing, and what steps the individual can take to protect themselves. Avoid technical jargon and provide a contact point for follow-up questions.

Final Thoughts

Reporting a data breach to PDPC is not just a legal box-ticking exercise — it is an opportunity to demonstrate accountability, rebuild trust, and strengthen your organisation's defences. By understanding the thresholds, acting quickly, and maintaining proper documentation, you can navigate even the most stressful incidents with confidence. Treat every breach as a lesson, and use it to drive lasting improvements to your data protection programme.