How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

If your organisation has suffered a data breach in Singapore, the clock is already ticking. Under the amended Personal Data Protection Act (PDPA), notifiable breaches must be reported to the Personal Data Protection Commission (PDPC) within 3 calendar days of assessing the breach as notifiable — and affected individuals must be told as soon as practicable. Miss that window, and you expose your organisation to financial penalties and reputational damage that are far harder to fix than the breach itself.

At Lunyb, we work with people and small teams every day who find out about a breach the hard way — an exposed email address, a leaked phone number, a customer calling to ask why their data is on a scam site. This guide walks you through exactly how to report a data breach to the PDPC in 2026, what counts as notifiable, and how Lunyb's privacy tools help you detect exposure early, document it properly, and reduce the damage before regulators get involved.

What Counts as a Notifiable Data Breach in Singapore

A notifiable data breach under Singapore's PDPA is any breach of personal data that (a) results in, or is likely to result in, significant harm to affected individuals, or (b) is, or is likely to be, of a significant scale — generally meaning 500 or more affected individuals.

The PDPC's mandatory breach notification regime took full effect on 1 February 2021 and continues to apply in 2026. If either condition is met, you must notify the PDPC. If significant harm is likely, you must also notify affected individuals.

Examples of Significant Harm

The Personal Data Protection (Notification of Data Breaches) Regulations 2021 list specific categories of personal data that are automatically deemed to cause significant harm if compromised. These include:

Full name or alias combined with NRIC/FIN/passport number
Financial information such as account numbers, credit card details, or CPF balances
Health information, medical diagnoses, or treatment records
Information about children and young persons
Biometric data, insurance claims, and life insurance details
Any information disclosing a person's sexual preferences or private sexual behaviour

Scale-Based Triggers

Even if the leaked data doesn't fall into the "significant harm" categories, a breach affecting 500 or more individuals must still be reported to the PDPC. Note that the 500-person threshold applies to the PDPC notification only — individual notification depends on the harm test.

The PDPC Reporting Timeline: 72 Hours and Beyond

Timing is the single most important compliance factor. Here is the sequence the PDPA expects:

Day 0 — Discovery: You become aware of a potential breach. Begin assessment immediately.
Within 30 days — Assessment: You must take reasonable and expeditious steps to determine whether the breach is notifiable. The PDPC expects most assessments to conclude well within this window.
Within 3 calendar days of assessment: If the breach is notifiable, you must notify the PDPC.
As soon as practicable: Notify affected individuals if significant harm is likely (unless an exception applies).

If you cannot provide full details within 3 days, submit what you have and update the PDPC as the investigation progresses. Silence is not an acceptable strategy.

Step-by-Step: How to Report a Data Breach to PDPC

Step 1: Contain the Breach

Before you file anything, stop the bleeding. Revoke compromised credentials, disconnect affected systems, reset passwords, and preserve logs. Document every action with timestamps — the PDPC will ask what you did and when.

Step 2: Assess Whether It Is Notifiable

Apply the two-part test: significant harm, or 500+ affected individuals. If you are uncertain, document your reasoning. Over-reporting is better than under-reporting — the PDPC treats concealment far more harshly than cautious disclosure.

Step 3: Gather the Required Information

The PDPC notification form asks for:

Organisation name, UEN, and contact person
Date and time the breach occurred and was discovered
Cause of the breach (cyberattack, human error, lost device, insider, etc.)
Type and volume of personal data affected
Number of affected individuals
Potential harm to individuals
Containment, remediation, and preventive measures taken
Whether and how affected individuals have been or will be notified

Step 4: Submit via the PDPC Online Form

File the notification through the PDPC website at pdpc.gov.sg under the "Report a Data Breach" section. The online form is the fastest route and gives you a reference number for follow-up. Keep a copy of the submission and all correspondence.

Step 5: Notify Affected Individuals

When significant harm is likely, affected individuals must be notified in a clear, understandable way through any effective communication channel — email, SMS, letter, or public notice. Your notice should explain what happened, what data was involved, what the person should do (change passwords, watch for scam calls, monitor bank statements), and how to contact your organisation.

Step 6: Follow Up and Update

Breach investigations rarely finish on day 3. As you learn more — root cause, additional affected individuals, new remediation steps — update the PDPC. Keep internal records for at least the period the PDPA requires, and expect the possibility of follow-up queries from the Commission.

When You Don't Have to Notify Individuals

The PDPA recognises two main exceptions to notifying affected individuals (you still notify the PDPC):

Remedial action: You have taken action that renders significant harm unlikely — for example, strong encryption that remains intact, or rapid revocation of leaked credentials before misuse.
Technological protection: The compromised data was protected by a technological measure that makes it unusable, such as modern encryption with keys that were not also compromised.

Law enforcement or the PDPC may also direct you to delay notification if it would prejudice an investigation. Don't assume an exception applies — document the basis clearly and be prepared to defend it.

Why Individual Victims Also Need a Plan — and Where Lunyb Fits In

This guide is written for organisations, but if you are reading it because you were affected by a breach — a customer, employee, or Singapore resident whose details just showed up somewhere they shouldn't — you need a response plan too. The PDPC can discipline the organisation, but it cannot undo the exposure of your email, phone number, NRIC-linked data, or passwords. That part falls to you.

Lunyb is built for exactly this moment. It is a phone privacy and scam-protection app (plus a secure URL shortener and QR platform) that gives Singapore users the tools to detect exposure, lock down accounts, and stop follow-on scams.

How Lunyb Helps Before, During, and After a Breach

Data Breach Alerts: Monitor your email addresses and phone numbers so you get notified when they surface in known breaches — often the first real signal that you've been affected.
Scam Checker and Scam Shield: After a breach, scam calls and phishing messages spike. Lunyb's scam checker lets you paste suspicious SMS, WhatsApp, or email content and get a risk read. Caller protection flags high-risk numbers before you pick up.
Privacy Check: Review which apps on your phone have access to contacts, location, microphone, and photos — a frequent blind spot that regulators like the PDPC increasingly expect individuals and organisations to manage.
Encrypted Password & Photo Vault: Rotate exposed passwords quickly and store them securely, rather than reusing weak credentials across the accounts a breach has just put at risk.
On-device tracker and threat blocking: Lunyb's local DNS shield blocks known malicious domains and trackers at the network level on your device — useful when attackers try to lure breach victims to credential-harvesting sites.
Photo Guard reverse-image check: If personal images were part of the exposure, you can check where they may already be surfacing online.
Browsing-history eraser and security score: Clean up residual traces and get a running score that tells you what to fix next.

For organisations, Lunyb is also useful for the people you're required to notify. Pointing affected customers to a proper protection app — rather than just telling them to "stay vigilant" — shows genuine remediation and can be referenced in your PDPC notification as part of the help you are offering individuals.

Common Mistakes That Make a PDPC Report Worse

Mistake 1: Waiting Until the Investigation Is Complete

The 3-day clock starts when you assess the breach as notifiable, not when you have perfect information. File on time with what you know and update later.

Mistake 2: Underestimating the Number of Affected Individuals

Many organisations report an initial low number, only to revise upward weeks later. The PDPC notices. If you are not confident, say so in the form and commit to updating.

Mistake 3: Vague Notifications to Individuals

"Some of your data may have been affected" is not enough. Specify the data categories, the likely risks, and concrete actions — change this password, watch for calls claiming to be from this bank, enable two-factor authentication.

Mistake 4: Treating the Breach Report as the End of the Story

The PDPC often looks at the organisation's overall PDPA compliance after a breach: appointed DPO, written policies, training records, access controls. A breach notification without evidence of a baseline program invites a tougher outcome.

PDPC Breach Reporting at a Glance

Trigger	Notify PDPC	Notify Individuals	Deadline
Significant harm likely	Yes	Yes	PDPC within 3 days; individuals as soon as practicable
500+ affected individuals, no significant harm	Yes	Not required	Within 3 days of assessment
Under 500 affected, no significant harm	Not required	Not required	Still document internally
Remedial action makes harm unlikely	Yes	Not required (exception)	Within 3 days; document the exception

Penalties for Non-Compliance

Failure to notify the PDPC of a notifiable breach is itself a breach of the PDPA. Financial penalties for serious PDPA breaches can reach up to 10% of an organisation's annual turnover in Singapore (for organisations with annual Singapore turnover exceeding S$10 million) or S$1 million, whichever is higher. Beyond fines, the PDPC can issue directions requiring specific remediation steps, and decisions are published — meaning your customers, partners, and competitors will read about it.

Build Your Breach Response Before You Need It

The best time to prepare a PDPC breach response is before anything happens. A practical checklist:

Appoint a Data Protection Officer and publish their contact details.
Maintain an up-to-date inventory of personal data and where it lives.
Have a written incident response plan with named owners and escalation paths.
Run tabletop exercises at least annually, including a mock PDPC notification.
Equip employees with scam detection tools so phishing — a leading cause of breaches — is less likely to succeed.
Monitor leaked credentials for your domain and your executives' personal accounts.

This is where Lunyb becomes part of the baseline, not just the cleanup. Getting employees onto a privacy app that handles data breach alerts, scam checking, and password hygiene reduces the volume of incidents that ever reach notifiable scale. For the breaches that do, you'll have a shorter timeline between "something happened" and "we know what happened" — which is often the difference between a clean PDPC report and a messy one.

Your Next Step

Whether you're the organisation that has to file the report or the individual whose data is suddenly out there, don't treat a breach as a one-time event. Set up proactive monitoring, lock down your accounts, and give yourself a real chance of catching the next incident on day one instead of day thirty.

Head to lunyb.com to take the free privacy quiz, or download the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Shield, and Privacy Check today. Plans start from around US$19.99/month, renew until cancelled, and you can cancel anytime online — no sales call, no lock-in.

Frequently Asked Questions

How long do I have to report a data breach to the PDPC?

You must notify the PDPC within 3 calendar days of assessing that a breach is notifiable. Assessment itself should be completed expeditiously — the PDPC expects most assessments to conclude within 30 days of discovery.

Do I need to report every data breach?

No. Only breaches that are likely to cause significant harm to individuals, or that affect 500 or more individuals, must be reported to the PDPC. However, you should document every incident internally and review your assessment logic.

What happens if I report a breach late or not at all?

Failure to notify is itself a PDPA breach and can attract financial penalties of up to 10% of annual Singapore turnover (for organisations with turnover above S$10 million) or S$1 million, whichever is higher, along with published enforcement decisions and directions to remediate.

How do I know if my personal data was exposed in a breach?

The affected organisation should notify you if significant harm is likely. You can also monitor your own email and phone number using Lunyb's Data Breach Alerts, which checks exposures against known breach datasets and tells you when something new appears.

Can Lunyb help my organisation with PDPA compliance?

Lunyb is a consumer-facing privacy and scam-protection app, not a legal compliance product. However, deploying Lunyb to employees reduces phishing success rates, catches exposed credentials early, and gives your workforce a practical tool to recommend to breach-affected customers as part of your remediation — all of which support the spirit of PDPA accountability.