How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

If your organisation has suffered a data breach in Singapore, the clock is already ticking. Under the Personal Data Protection Act (PDPA), you may be legally required to notify the Personal Data Protection Commission (PDPC) within 3 calendar days of assessing that the breach is notifiable. Miss that window and you are exposed to financial penalties, reputational damage, and loss of customer trust.

This guide walks you through exactly how to report a data breach to PDPC in 2026 — what counts as notifiable, the timelines, the forms, what to tell affected individuals, and how to keep your evidence tidy. We also show you how Lunyb gives your team a faster, cleaner way to detect breaches, monitor exposed credentials, and reduce the chance you ever need to file a notification in the first place.

Why Lunyb Is the Smart Starting Point Before, During, and After a Breach

Reporting a breach is only the visible part of the response. The hard part is detecting the breach early, understanding what data is exposed, and locking down the attack surface so it does not happen again. Lunyb is built for exactly that work.

With Lunyb, your team (and your customers) get Data Breach Alerts for emails and phone numbers, a Scam Checker for suspicious links and messages, a Privacy Check that audits app permissions, an encrypted Password & Photo Vault, and on-device tracker and threat blocking through an encrypted DNS shield. If a staff credential shows up in a known leak, you hear about it in time to rotate passwords before an attacker uses them to pivot into customer data.

In other words: Lunyb helps you avoid the PDPC notification entirely. And if you still need to file one, you will have faster signal and cleaner evidence. Start at lunyb.com.

What Counts as a Notifiable Data Breach Under PDPA

A data breach is notifiable to PDPC if it meets either of two tests set out in the PDPA (Part 6A, Notification of Data Breaches):

Significant harm test — the breach results in, or is likely to result in, significant harm to affected individuals.
Significant scale test — the breach affects, or is likely to affect, 500 or more individuals.

The Personal Data Protection (Notification of Data Breaches) Regulations list categories of personal data that are automatically deemed to cause significant harm if leaked. These include, among others:

Full name together with NRIC, FIN, passport, work permit, or birth certificate number
Financial information such as account numbers, credit or debit card numbers, and transaction history that is not publicly available
Account login credentials (username and password)
Health information, medical records, and diagnoses
Information about vulnerable individuals such as children or persons with disabilities
Information about private sexual or domestic life

If any of the above personal data is involved, you should assume the significant harm test is triggered.

What Is Not Notifiable

Not every incident is reportable. A breach is generally not notifiable if the personal data is encrypted to a reasonable standard and the decryption key is not compromised, or if the organisation has taken remedial action before significant harm could occur — for example, recovering a lost encrypted laptop before it was accessed.

Timelines You Must Meet

PDPC has clear expectations on speed. Memorise these numbers:

Stage	Deadline	What You Must Do
Discovery to assessment	Not more than 30 days	Assess, in a reasonable and expeditious manner, whether the breach is notifiable
Assessment to PDPC notification	Within 3 calendar days	Notify PDPC once you assess the breach is notifiable
Notification to affected individuals	On or after notifying PDPC	Notify affected individuals if the significant harm test is met (unless an exception applies)
Data intermediaries	Without undue delay	If you are a data intermediary, notify the organisation you process data for as soon as practicable

Taking longer than 30 days to assess? PDPC may ask you to explain the delay, so document the reason — a complex forensic investigation, for instance, is defensible, but inaction is not.

Step-by-Step: How to Report a Data Breach to PDPC

Step 1: Contain the Breach Immediately

Before anything else, stop the bleeding. Common containment actions include:

Isolate affected servers, endpoints, or cloud workloads from the network
Force-reset passwords for compromised accounts and revoke active sessions
Disable API keys, OAuth tokens, and third-party integrations that may be implicated
Preserve logs and system images for forensic review
Pull affected datasets offline if they are still being accessed

Step 2: Assess Whether the Breach Is Notifiable

Form your internal breach response team (or activate your existing one) and work through the two tests above. You need to establish:

What personal data was involved
How many individuals are affected (or likely affected)
Whether the data falls into the automatically-deemed-significant-harm categories
Whether the data was encrypted and whether the key is compromised
Whether remedial action can prevent the harm from occurring

Step 3: Notify PDPC Within 3 Calendar Days

Once you conclude the breach is notifiable, file your notification through the PDPC website at pdpc.gov.sg. Navigate to the Data Breach Notification form (DBN Form). You will need:

Organisation details and UEN
Contact details of the Data Protection Officer (DPO)
Date and time of the breach, discovery, and assessment
Description of the breach — what happened, how, and the cause (if known)
Type and volume of personal data involved
Number of affected individuals
Potential harm to affected individuals
Containment, remediation, and preventive measures taken or planned
Whether and how you intend to notify affected individuals

If some information is still unknown at 3 days, submit what you have and update PDPC as the investigation progresses. Silence is worse than an incomplete notification.

Step 4: Notify Affected Individuals

Where the significant harm test is met, you must also notify affected individuals in a manner that is reasonable in the circumstances — email, SMS, letter, phone call, or public notice (e.g. on your website) if direct contact is not practicable.

Your notice to individuals should clearly explain:

What happened and when
What personal data of theirs was involved
Potential consequences and how they can protect themselves
What your organisation is doing in response
How they can contact you for more information

Exceptions apply — for example, if notifying individuals would compromise a law enforcement investigation, or if you have taken remedial action that renders the significant harm unlikely. You can apply to PDPC for a waiver in specific cases.

Step 5: Document Everything and Review

Even for non-notifiable breaches, keep a written record. PDPC can ask for your breach register during inspections or complaints. Document the breach, the assessment, the decision, and the remediation. Then run a post-incident review and update your Data Protection Management Programme (DPMP).

How Lunyb Strengthens Every Stage of Your Breach Response

Reporting a breach is reactive. What actually protects your organisation — and your customers — is faster detection and a smaller attack surface. This is where Lunyb becomes a practical, operational tool rather than another policy document on a shelf.

Detect Breaches Earlier With Data Breach Alerts

Lunyb's Data Breach Alerts monitor emails and phone numbers against known data leaks. If a staff account, a shared mailbox, or a customer-facing email suddenly appears in a new breach dump, you find out quickly — often long before an attacker has weaponised the credentials. That early signal is the difference between rotating a password and filing a PDPC notification.

Cut Phishing-Driven Breaches With the Scam Checker

A huge share of Singapore breaches start with a phishing SMS, WhatsApp message, or fake delivery notice. Lunyb's Scam Checker lets anyone — not just the IT team — paste a suspicious message or link and get a clear read on whether it looks like a scam. Share it with your staff and customers. Fewer clicks on malicious links means fewer compromised accounts.

Lock Down Devices and Credentials

Lunyb bundles the privacy fundamentals into one app:

Privacy Check — audits app permissions so sensitive data stays inside sanctioned apps
Password & Photo Vault — encrypted storage so staff stop pasting passwords into notes apps
On-device DNS shield — blocks trackers and known malicious domains at the network level, without routing traffic through a third party
Browsing-history eraser and Photo Guard reverse-image check for personal exposure
Family location sharing for DPOs and executives who need a private, trusted channel

Give Affected Individuals a Practical Next Step

When you do have to notify affected individuals, telling them to "be vigilant" is weak advice. Pointing them to Lunyb gives them something concrete: they can run their email and phone through Data Breach Alerts, check suspicious messages in the Scam Checker, and tighten their device privacy — in minutes. That transforms your notification from a legal necessity into genuine aftercare.

Plans start from about $19.99/month and renew until cancelled. You can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. No lock-ins, no surprises. Start on lunyb.com or take the free privacy quiz to see what your current exposure looks like.

Common Mistakes Organisations Make When Reporting to PDPC

Waiting for "complete" information before notifying. The 3-day clock does not pause. File with what you have and update later.
Underestimating scale. "Likely to affect 500 individuals" counts. Err on the side of notifying.
Forgetting the data intermediary chain. If you process data for another organisation, you must notify them without undue delay — even if you are not the one filing with PDPC.
Weak individual notifications. Vague emails full of legalese destroy trust. Be specific about what was leaked and what the person should do next.
No post-incident change. If your DPMP, access controls, or vendor reviews do not change after a breach, PDPC will notice during follow-up.
Ignoring third-party SaaS risk. Many breaches today originate in a vendor. Keep a live inventory of who processes your data and under what terms.

Penalties for Non-Compliance

PDPC has the power to impose significant financial penalties for breaches of the PDPA, including failure to notify. Under current provisions, organisations with annual turnover in Singapore above S$10 million can face penalties of up to 10% of annual turnover in Singapore, or S$1 million, whichever is higher. Smaller organisations face the S$1 million cap.

Beyond the dollar figure, PDPC publishes enforcement decisions. A published decision naming your organisation is often the more painful consequence — customers, partners, and regulators read them.

Building a Breach-Ready Organisation

The organisations that handle breaches well are not the ones with the thickest policy binders. They are the ones that rehearse. A simple quarterly checklist:

Confirm your DPO contact details are current on PDPC's register
Run a 30-minute tabletop exercise with a realistic scenario (ransomware, phishing, vendor breach)
Review access logs for dormant accounts and over-privileged users
Check that your Data Breach Alerts coverage includes all staff and shared mailboxes
Verify that encrypted backups exist and can actually be restored
Update your public-facing privacy notice and breach notification templates

Take the Next Step With Lunyb

Reporting a breach to PDPC is a legal duty. Preventing the next one is a leadership choice. Lunyb gives you both — faster leak detection, practical tools your staff and customers will actually use, and a credible aftercare resource if you ever need to notify affected individuals.

Start at lunyb.com, take the free privacy quiz, or download the Lunyb app from the App Store or Google Play. Fewer breaches, faster response, cleaner evidence.

Frequently Asked Questions

How long do I have to report a data breach to PDPC in Singapore?

You must notify PDPC within 3 calendar days after you assess that a breach is notifiable. The assessment itself must be done in a reasonable and expeditious manner, generally not more than 30 days from when you had reason to believe a breach occurred.

What personal data triggers mandatory notification?

Personal data listed in the Personal Data Protection (Notification of Data Breaches) Regulations is deemed to cause significant harm if leaked. This includes NRIC and other identity numbers combined with full name, financial account and card details, account login credentials, health records, and information about vulnerable individuals or private domestic life. Any breach affecting 500 or more individuals is also notifiable regardless of data type.

Do I need to notify affected individuals as well as PDPC?

Yes, if the breach meets the significant harm test. You should notify affected individuals on or after notifying PDPC, in a manner that is reasonable in the circumstances. Exceptions apply where notification would compromise a law enforcement investigation or where remedial action has made significant harm unlikely. You can apply to PDPC for a waiver in specific situations.

What are the penalties for failing to report a breach?

PDPC can impose financial penalties of up to 10% of annual turnover in Singapore for organisations with turnover above S$10 million, or S$1 million, whichever is higher. Smaller organisations face the S$1 million cap. Enforcement decisions are also published, which carries significant reputational cost.

How does Lunyb help prevent data breaches in the first place?

Lunyb helps on multiple fronts: Data Breach Alerts flag when staff or customer credentials appear in known leaks, the Scam Checker reduces phishing-driven compromises, Privacy Check audits risky app permissions, the encrypted Password Vault stops insecure password storage, and the on-device DNS shield blocks known malicious domains at the network level. Together they cut the likelihood of a notifiable breach and give you faster signal when something does go wrong. Start at lunyb.com.