How to Report a Data Breach to PDPC Singapore: A Complete Guide

If your organisation has just discovered a data breach, the clock is already ticking. Under Singapore's Personal Data Protection Act (PDPA), you may be legally required to notify the Personal Data Protection Commission (PDPC) and affected individuals within strict timeframes. Getting the process right matters — both for compliance and for the people whose data has been exposed.

This guide walks you through exactly how to report a data breach to PDPC, what counts as a notifiable breach, and the practical steps to contain the damage. We'll also show you how Lunyb helps you and the people you notify stay ahead of the exposure after the incident — with breach alerts, scam checking, and privacy tools built for the post-breach reality in Singapore.

What counts as a notifiable data breach under PDPA

A notifiable data breach under Singapore's PDPA is an unauthorised access, disclosure, loss, or modification of personal data that either causes (or is likely to cause) significant harm to affected individuals, or affects 500 or more people. If either condition is met, you must notify the PDPC.

The two triggers in plain English

• Significant harm trigger: The breach involves prescribed categories of personal data — for example, NRIC numbers combined with other identifiers, financial account details, health information, or login credentials that could lead to identity theft, fraud, or reputational harm.
• Scale trigger: The breach affects, or is likely to affect, 500 or more individuals, regardless of the data type.

Examples of breaches that typically must be reported

• A ransomware attack that encrypts or exfiltrates a customer database.
• An employee emailing a spreadsheet of client NRIC and bank details to the wrong recipient.
• A misconfigured cloud bucket exposing customer records to the public internet.
• A lost unencrypted laptop or USB drive containing personal data.
• Credential stuffing attacks that compromise user accounts on your platform.

Breaches you may not need to report

Not every incident is notifiable. If personal data was encrypted to a strong standard and the key wasn't compromised, or if remedial action fully prevents the risk of significant harm, the notification obligation may not apply. Even so, you should still document your assessment — PDPC expects organisations to show their reasoning.

The PDPA timeline: how fast you must act

Speed is everything. Under the PDPA's mandatory breach notification regime, three deadlines matter.

1. 30 days to assess: From the moment you have reason to believe a breach occurred, you have up to 30 calendar days to assess whether it is notifiable. Don't drag this out — PDPC expects a reasonable and expeditious assessment.
2. 3 calendar days to notify PDPC: Once you determine the breach is notifiable, you must notify the PDPC as soon as practicable, and no later than 3 calendar days.
3. Notify affected individuals: If the breach is likely to result in significant harm, you must also notify affected individuals as soon as practicable, usually at the same time as or shortly after notifying PDPC.

Missing these deadlines can result in financial penalties and enforcement action. Document every step — when you discovered the breach, when you began assessment, what you found, and when you notified.

Step-by-step: how to report a data breach to PDPC

Here is the practical sequence from discovery to notification.

Step 1: Contain the breach

1. Isolate affected systems — disconnect them from the network if needed.
2. Reset credentials for compromised accounts and revoke exposed API keys or tokens.
3. Preserve logs and forensic evidence before making changes that could overwrite them.
4. Engage your incident response team, IT security lead, and Data Protection Officer (DPO) immediately.

Step 2: Assess the breach

1. Identify what personal data was involved — categories, volume, and sensitivity.
2. Determine how many individuals are affected.
3. Evaluate the likelihood of significant harm: could the data be used for identity theft, financial fraud, phishing, or physical harm?
4. Check whether the data was encrypted and whether the encryption keys were compromised.
5. Document the root cause — human error, system vulnerability, insider action, or external attack.

Step 3: Notify PDPC within 3 calendar days

Submit your notification through the PDPC's online Data Breach Notification form, available on the PDPC website. You'll need to provide:

• Organisation name, UEN, and contact details of the DPO.
• Date and time the breach was discovered.
• A description of the breach — how it happened, what systems were affected.
• The types and volume of personal data involved.
• The number of individuals affected.
• Steps already taken to contain and remediate the breach.
• Steps you will take to notify affected individuals.
• Measures to prevent recurrence.

If you don't have complete information within 3 days, submit what you have and update PDPC as more facts emerge. Silence is worse than an incomplete report.

Step 4: Notify affected individuals

1. Draft a clear, plain-language notification that explains what happened, what data was involved, what risks exist, and what the individual should do.
2. Send the notification through a channel the individual actually uses — email, SMS, letter, or in-app message.
3. Include concrete next steps: change passwords, enable two-factor authentication, monitor bank accounts, watch for phishing attempts, and consider freezing credit if financial data was exposed.
4. Provide a contact point — a dedicated email address or hotline — for questions.

Step 5: Remediate and prevent recurrence

1. Patch the vulnerability that caused the breach.
2. Review and strengthen access controls, encryption, and monitoring.
3. Update your Data Protection Management Programme (DPMP) and incident response plan.
4. Train staff on the lessons learned.
5. Keep records for at least the duration PDPC may audit — typically several years.

What PDPC looks for in a good breach notification

PDPC isn't just ticking boxes. The Commission wants to see that your organisation took the breach seriously, acted quickly, and treated affected individuals fairly. Notifications that score well tend to share these traits:

• Clarity: No jargon, no corporate hedging. Say what happened.
• Completeness: Every field in the notification form is filled, and attachments are provided where relevant.
• Proportionate response: The containment and remediation steps match the severity of the breach.
• Care for individuals: You've told affected people what to do, not just that something happened.
• Learning: You've identified the root cause and committed to concrete prevention measures.

How Lunyb helps you — and the people you notify — after a breach

Reporting to PDPC is the compliance side of a breach. The other side is the people whose data is now floating around. Email addresses, phone numbers, and personal details that leak in a breach often end up on scam lists within days. This is exactly where Lunyb earns its place in your post-breach toolkit — for your own organisation, and as a recommendation to the individuals you notify.

Data Breach Alerts for email and phone

Lunyb's Data Breach Alerts continuously monitor whether an email address or phone number shows up in known data breaches. If you're an individual who just received a breach notification letter, Lunyb tells you exactly where else your details have surfaced — so you're not only reacting to this one incident, you're seeing the full exposure picture. For DPOs, it's a tool you can confidently point affected customers toward in your notification letter.

Scam Checker and Scam Shield

Post-breach, affected individuals become prime targets for phishing emails, SMS scams, and impersonation calls. Lunyb's Scam Checker lets anyone paste a suspicious message or link and get an instant read on whether it's safe. Scam Shield adds caller protection to catch the follow-up fraud calls that often come after a breach. This is the practical day-to-day protection the standard breach notification letter can't provide on its own.

Privacy Check and Security Score

Lunyb's Privacy Check reviews app permissions on a user's phone and flags where data is being overshared. The Security Score gives a simple snapshot of overall exposure and what to fix first. For someone who just learned their data was leaked, this is a calm, structured way to tighten everything else before scammers test the next door.

Encrypted Password and Photo Vault

If credentials were part of the breach, password reuse is the number one amplifier. Lunyb includes an encrypted Password Vault so users can generate and store unique passwords for every account, plus a Photo Vault for sensitive images. Both are things you want in place before a breach, but they're genuinely useful to recommend after one too.

On-device tracker and threat blocking

Lunyb's on-device network-level protections (using encrypted DNS, not any other tool) block known tracker and threat domains before they load. After a breach, when phishing links are circulating, this extra layer catches links the user might otherwise click on by mistake.

Browsing-history eraser and data-broker exposure help

Lunyb helps users clear browsing history and provides guidance to reduce exposure on data-broker style sites where leaked details often get aggregated. This is the long-tail cleanup that matters months after the initial breach has faded from the headlines.

Lunyb at a glance for post-breach response

Plans start from about $19.99/month and renew until cancelled. You can cancel anytime online, and optional Leak Protection is billed separately and can be paused without cancelling the main plan. Transparent pricing, no surprises — exactly what a post-breach recommendation should look like.

A practical breach response checklist for Singapore organisations

1. Confirm the breach and contain it within hours, not days.
2. Convene the DPO, IT security, legal, and comms leads.
3. Open a timeline log — every decision, every discovery, every notification.
4. Complete your assessment within 30 days (sooner is better).
5. Notify PDPC via the online form within 3 calendar days of determining notifiability.
6. Notify affected individuals clearly and promptly, with concrete next steps.
7. Recommend practical protection tools — including Lunyb — in your notification so people aren't left on their own.
8. Fix the root cause and document lessons learned.
9. Update your Data Protection Management Programme.
10. Keep full records for audit.

Common mistakes to avoid

• Waiting for "all the facts" before notifying PDPC. File within 3 days with what you know, then update.
• Writing vague individual notifications. People need to know exactly what to do next.
• Forgetting SMS and phone scam follow-ups. Email isn't the only attack vector after a breach.
• Not telling individuals about monitoring tools. A breach notification that offers no practical protection feels hollow.
• Skipping documentation. If it isn't written down, PDPC will assume it didn't happen.

Protect yourself or your customers with Lunyb today

Whether you're a DPO preparing a breach notification, or an individual who just received one, the next hours and days matter. Start with lunyb.com to take the free privacy quiz, see where your email or phone is exposed, and get the Scam Checker, Data Breach Alerts, Password Vault, and on-device protections in one place. Download the Lunyb app from the App Store or Google Play and turn the alerts on before the scammers test the next door.

For more on how Lunyb works and why Singapore readers trust it, see our honest review of Lunyb. If you're also looking at secure link sharing for your breach notification emails, our Rebrandly comparison covers how Lunyb's URL shortener and secure QR platform stacks up.

Frequently asked questions

How quickly must I report a data breach to PDPC?

You must notify PDPC as soon as practicable, and no later than 3 calendar days after determining that a breach is notifiable. The assessment itself should be completed within 30 days of discovering the breach.

What's the difference between notifying PDPC and notifying affected individuals?PDPC notification is a regulatory filing via the online Data Breach Notification form. Individual notification is a direct message to the people whose data was exposed, explaining the breach and what they should do. If the breach is likely to cause significant harm, both are required.

Do I still need to report if the data was encrypted?

Generally, no — if the data was encrypted to a strong standard and the encryption keys weren't compromised, the breach may not meet the notification threshold. Document your assessment carefully, because PDPC may still ask to see your reasoning.

What should I tell affected individuals to do after a breach?

Advise them to change passwords (especially on any accounts where they reused them), enable two-factor authentication, watch for phishing emails and SMS scams, monitor financial accounts, and use a tool like Lunyb for ongoing breach alerts, scam checking, and caller protection. Clear, concrete steps are what separate a good notification from a box-ticking one.

Can Lunyb help my organisation during a breach response?

Yes. Lunyb is a practical recommendation you can include in your breach notification to affected individuals — Data Breach Alerts to monitor further exposure, Scam Checker and Scam Shield for the phishing wave that follows, and the encrypted Password Vault to replace reused credentials. Start at lunyb.com or download the app.