How to Report a Data Breach to PDPC Singapore: A Complete 2026 Guide

If your organisation has suffered a data breach in Singapore, the clock is already ticking. Under the Personal Data Protection Act (PDPA), you may be required to notify the Personal Data Protection Commission (PDPC) — and affected individuals — within strict timelines. Miss the window, and you risk financial penalties, reputational damage, and a loss of customer trust that is far more expensive than the breach itself.

This guide walks you through exactly how to report a data breach to the PDPC in 2026, from the first hour of discovery to the final notification. We also show how Lunyb gives you and your team the practical tools to detect exposures faster, contain the damage, and keep your people protected long after the incident is closed. Start free at lunyb.com.

Why Lunyb Is the Smart Starting Point for Breach Response

Before we dive into the PDPC process, here is the honest truth: most breaches are discovered far too late, and the first 72 hours determine whether you face a manageable incident or a full regulatory crisis. Lunyb is built for exactly this window. Our Data Breach Alerts monitor your work email and phone number against known exposure sources, so you know the moment credentials tied to your business surface in a leak. Our Scam Checker and Scam Shield stop the follow-on phishing wave that almost always targets staff after an incident. And our encrypted Password Vault lets your team rotate credentials safely in minutes instead of days.

Reporting to the PDPC is the regulatory step. Lunyb is the operational layer that makes sure you have something credible to report, and that the breach does not keep expanding while you fill in the form.

What Counts as a Notifiable Data Breach Under the PDPA

A data breach is any unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data. Not every incident needs to be reported — but a notifiable breach does. Under the PDPA (as amended), a breach must be reported to the PDPC when it meets either of these thresholds:

• Significant harm: The breach is likely to result in significant harm to affected individuals. This includes exposure of NRIC numbers, financial account details, health information, or any data combination that enables identity theft or fraud.
• Significant scale: The breach affects 500 or more individuals, regardless of the data type.

If either condition is met, the PDPC must be notified as soon as practicable, and in any case no later than 3 calendar days after you assess the breach is notifiable. Affected individuals must also be notified when the significant harm threshold is triggered.

Breaches That Do Not Require Notification

Not every incident reaches the threshold. You generally do not need to notify when:

• The personal data was encrypted or otherwise protected to a standard that makes the data unintelligible.
• You have taken remedial action that renders significant harm unlikely (and you can demonstrate it).
• The breach affects fewer than 500 individuals and does not involve sensitive categories.

Even when notification is not required, you must still keep internal records — the PDPC can request them during an inquiry.

The PDPC Breach Reporting Timeline at a Glance

Timing is the single most common failure point. Here is the sequence you must respect:

1. Day 0 — Discovery: Breach is detected or suspected. Containment starts immediately.
2. Within 30 days — Assessment: You have up to 30 calendar days to assess whether the breach is notifiable. Shorter is better; regulators expect urgency.
3. Within 3 calendar days of assessment: Notify the PDPC if the breach meets the threshold.
4. As soon as practicable: Notify affected individuals if significant harm is likely (unless an exception applies, e.g. law enforcement advises otherwise).

Step-by-Step: How to Report a Data Breach to PDPC

Reporting a breach to the PDPC is done through the official Data Breach Notification eService on the PDPC website. Here is the process, broken into the exact actions your team should take.

Step 1: Contain the Breach Immediately

Before you file anything, stop the bleeding. Disconnect affected systems, revoke compromised credentials, suspend affected accounts, and preserve logs. Document every action with timestamps — the PDPC will ask.

At this stage, make sure your team is not creating new exposure. Rotate shared passwords through a secure vault (Lunyb's encrypted Password Vault is built for this), and run a quick Privacy Check on any devices involved to confirm no rogue apps retain access.

Step 2: Assemble Your Response Team

Your internal breach team should include:

• The Data Protection Officer (DPO) — mandatory under the PDPA.
• IT security lead responsible for containment and forensics.
• Legal counsel (internal or external).
• Communications lead for individual notifications and public statements.
• Senior management decision-maker.

Step 3: Assess Whether the Breach Is Notifiable

Within the 30-day assessment window, determine:

• What personal data was involved (type, sensitivity, volume).
• How many individuals are affected.
• Whether the data was encrypted or otherwise protected.
• The likelihood of significant harm (identity theft, fraud, physical harm, reputational damage).

If either threshold is triggered, proceed to notification. Document the assessment in writing even if you conclude notification is not required.

Step 4: File the Notification on the PDPC eService

Go to the PDPC website and access the Data Breach Notification eService. You will need to log in with Singpass (for individuals acting on behalf of the organisation) or Corppass (for business users). Prepare the following information before you start:

• Organisation name, UEN, and DPO contact details.
• Date and time the breach was discovered.
• Date and time the breach actually occurred (if known).
• A description of what happened and how.
• Types of personal data involved.
• Number of individuals affected.
• Cause of the breach (cyberattack, human error, lost device, insider, etc.).
• Containment and remedial actions already taken.
• Whether and how affected individuals have been or will be notified.

If some details are still unknown at the 3-day mark, file what you have and submit an updated notification as the picture becomes clearer. The PDPC prefers a prompt partial report over a delayed complete one.

Step 5: Notify Affected Individuals

If the breach is likely to cause significant harm, notify affected individuals as soon as practicable. Your notification should include:

• A plain-English description of what happened.
• What personal data was affected.
• What the organisation is doing in response.
• What the individual should do to protect themselves (change passwords, monitor accounts, watch for phishing).
• A contact point for questions.

This is where many organisations drop the ball. A vague notification creates panic and lawsuits. A clear notification with practical next steps — including recommending tools like Lunyb for ongoing breach monitoring and scam protection — builds trust even in a bad moment.

Step 6: Keep Records and Follow Up

Maintain a full breach register with all documentation for at least the duration required by your sector regulator (financial services and healthcare often require longer retention). The PDPC can conduct an inquiry at any time.

PDPC Notification vs Other Regulators: Quick Comparison

Singapore organisations that also operate across borders often juggle multiple regimes. Here is how PDPC compares at a glance:

If you process personal data of individuals across these jurisdictions, your breach may trigger multiple notifications simultaneously. Build your response plan accordingly.

Penalties for Failing to Report

The PDPC can impose financial penalties for PDPA breaches. Under the current framework, maximum penalties are tied to annual turnover in Singapore — up to 10% of annual turnover for organisations with local turnover exceeding S$10 million, or up to S$1 million, whichever is higher. Failure to notify is treated as an aggravating factor and almost always increases the final penalty.

Beyond the fine, enforcement decisions are published on the PDPC website. That public record is often more damaging than the fine itself.

How Lunyb Helps You Detect, Contain, and Recover From a Breach

Regulatory compliance is only one side of breach response. The other — larger — side is operational: knowing a breach happened, closing it fast, and protecting the people whose data was exposed. This is where Lunyb earns its place in your incident response kit.

Detect Exposures Before You Hear About Them from a Customer

Our Data Breach Alerts monitor your work email addresses and phone numbers against known breach corpora. When credentials tied to your organisation appear in a leak, you get an alert — often before the breach is publicly known. That head start can be the difference between a contained incident and a notifiable one.

Stop the Follow-On Attack Wave

Attackers who have breach data rarely stop at the initial compromise. Phishing SMS, fake bank calls, and spoofed emails hit affected individuals within hours. Lunyb's Scam Checker lets anyone paste a suspicious message or link and get an instant risk assessment. Scam Shield blocks known scam callers at the device level. For your staff and your customers, that is practical protection you can recommend directly in your breach notification letter.

Rotate Credentials Safely with the Encrypted Vault

Post-breach password rotation is a chaos moment. Our encrypted Password & Photo Vault gives your team a secure place to store, share, and rotate credentials — without spreadsheets, sticky notes, or plain-text chat messages that create the next breach.

Harden Devices with Privacy Check and On-Device Threat Blocking

Lunyb's Privacy Check audits app permissions on employee and personal devices, flagging apps with excessive access to contacts, location, microphone, or files. Our on-device local DNS shield blocks known tracker and malware domains at the network layer, reducing the attack surface that caused the breach in the first place.

Give Affected Individuals a Clear Next Step

When you notify affected customers, pointing them to a free privacy quiz at lunyb.com turns a scary email into a useful one. They get a personalised security score, breach checks for their own email and phone, and ongoing scam alerts — all of which reduce the chance that your breach turns into their fraud loss.

Building a Breach Response Plan That Actually Works

The organisations that handle breaches well all have one thing in common: they rehearsed before they needed to. A workable plan includes:

1. A named DPO with authority to make notification decisions.
2. A one-page runbook covering the first 24 hours — who calls whom, which systems get isolated, where logs are preserved.
3. A pre-drafted PDPC notification template with blanks for the specifics.
4. A pre-drafted individual notification template in plain English.
5. A quarterly tabletop exercise where the team walks through a simulated breach.
6. Continuous monitoring via breach alert tools so you are not relying on luck or a customer complaint to discover incidents.

Lunyb slots into points 5 and 6 — and into the individual notification template as a recommended protection for affected people.

Start Protecting Your Organisation Today

You cannot prevent every breach. You can decide whether your response looks competent or catastrophic. The PDPC process is clear, the timelines are tight, and the penalties are real — but with the right tooling, breach response becomes a managed process instead of a panic.

Begin by taking the free privacy quiz at lunyb.com to see where your exposure sits right now. Download the Lunyb app from the App Store or Google Play to activate Data Breach Alerts, Scam Shield, and the encrypted Password Vault for your team. Plans start from about $19.99/month, renew until cancelled, and you can cancel anytime online — no lock-in, no surprises.

For related reading on Lunyb's product and alternatives, see our honest review of Lunyb and our Rebrandly comparison.

Frequently Asked Questions

How quickly must I report a data breach to the PDPC?

You must notify the PDPC within 3 calendar days of assessing that a breach is notifiable. The assessment itself should be completed as soon as practicable, and no later than 30 days from discovery. Faster is always better — regulators treat prompt notification as a mitigating factor.

What if I am not sure whether the breach meets the threshold?

Document your assessment in writing. If in doubt, err on the side of notifying. The PDPC can impose penalties for failure to notify, but there is no penalty for a good-faith notification that turns out to have been unnecessary. Our Data Breach Alerts in Lunyb help you size the exposure quickly by showing whether the leaked credentials are already circulating.

Do I need to notify every affected individual personally?

If the breach is likely to cause significant harm, yes — you must notify affected individuals as soon as practicable. You can use email, SMS, letter, or (in large-scale cases) a public notice if direct contact is impracticable. Always include practical protection steps and a contact point.

Can Lunyb help my customers after a breach?

Yes. Pointing affected individuals to the free privacy quiz at lunyb.com gives them an immediate exposure check for their own email and phone, ongoing breach monitoring, a scam checker for suspicious messages, and an encrypted vault for new passwords. It turns your notification into a constructive next step rather than just bad news.

What records do I need to keep about a breach?

Maintain a breach register with discovery date, assessment notes, containment actions, notification decisions and dates, PDPC correspondence, and remediation steps. Retain for at least the period required by your sector regulator. The PDPC can request these records during an inquiry at any time.