How to Report a Data Breach to PDPC Singapore: Complete 2026 Guide

If your organisation has suffered a data breach in Singapore — or you are an individual whose personal data has been leaked — knowing how to report it to the Personal Data Protection Commission (PDPC) quickly and correctly matters. Under the Personal Data Protection Act (PDPA), notifiable breaches must be reported within strict timelines, and getting the steps wrong can mean bigger fines, slower recovery, and more harm to the people whose data was exposed.

This guide walks you through the full PDPC breach notification process in 2026, plus what individuals can do if their email, phone number, or passwords have been caught up in a leak. We will also show where Lunyb fits in as the fastest way to find out what data of yours is already exposed and lock down accounts before scammers get there first.

What Counts as a Notifiable Data Breach in Singapore

A notifiable data breach under the PDPA is any unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data that is likely to result in significant harm to affected individuals, or that involves personal data of 500 or more individuals.

The PDPC's Mandatory Data Breach Notification regime has been in force since 1 February 2021 and still applies in 2026. If your breach meets either threshold, you must notify the PDPC — this is not optional.

Breaches that trigger notification

Leaks of NRIC, FIN, passport, or other national identifiers
Exposure of financial information such as bank account or credit card details
Leaks of health, insurance, or medical records
Disclosure of private communications, photos, or sensitive personal content
Any breach affecting 500 or more individuals, even if the data is less sensitive

Breaches that usually do not require PDPC notification

Breaches contained within your organisation where no external access occurred and risk of harm is low
Loss of encrypted data where the encryption key remains secure
Information already publicly available and not combined with other identifiers

Even in these cases, you should still document the incident internally. If you later discover the breach was wider than you thought, you will need that paper trail.

PDPC Breach Reporting Timelines You Must Hit

The PDPA sets clear, non-negotiable timelines. Miss them and you expose your organisation to enforcement action.

Assess within 30 calendar days. Once you have reason to believe a breach has occurred, you have up to 30 days to assess whether it is notifiable.
Notify the PDPC within 3 calendar days. From the moment you determine the breach is notifiable, you have 72 hours to notify the Commission.
Notify affected individuals. You must inform affected individuals on or after notifying the PDPC, unless an exception applies (for example, if law enforcement instructs otherwise or if remedial action makes harm unlikely).

These clocks run in parallel with your containment work. You do not get to delay notification just because the investigation is ongoing — partial information submitted on time is better than complete information submitted late.

How to Report a Data Breach to PDPC: Step-by-Step

Here is the full workflow organisations should follow when a breach is discovered.

Step 1: Contain the breach immediately

Isolate affected systems from the network
Revoke compromised credentials and API keys
Preserve logs and forensic evidence — do not wipe or reinstall yet
Change passwords on all linked administrative accounts
Engage your IT security team or external incident responders

Step 2: Assess the scope and severity

Within the 30-day assessment window, determine exactly what personal data was involved, how many individuals are affected, how the breach occurred, and the likely harm. Document everything — the PDPC will ask.

Step 3: Submit the PDPC breach notification

Notifications are submitted through the official PDPC website at pdpc.gov.sg via the online Data Breach Notification form. You will need:

Organisation details and Data Protection Officer (DPO) contact
Date and time the breach was discovered
Date and time the breach occurred (if known)
Description of the breach and how it happened
Categories and volume of personal data involved
Number of individuals affected
Potential harm to individuals
Containment and remedial actions taken or planned
Plan for notifying affected individuals

Step 4: Notify affected individuals

Use clear, plain-language communication. Tell them what happened, what data was involved, what you are doing about it, and what they should do — such as changing passwords, watching for phishing, and monitoring their accounts.

Step 5: Remediate and report back

Fix the root cause. If the PDPC requests follow-up information or opens an investigation, cooperate fully. Keep internal records for at least the duration required by your sector's regulator.

What Individuals Should Do If Their Data Is in a Breach

If you are on the receiving end of a breach notification — or you suspect your data is floating around on the dark web — the PDPC process is not yours to run. Your job is to protect yourself before the leaked data gets used against you.

Immediate actions after a breach

Change the password on the affected account and any account that reused that password
Enable two-factor authentication on email, banking, and SingPass
Watch for phishing SMS, WhatsApp messages, and calls referencing your real details
Check your bank and credit card statements for unusual activity
Report scam attempts to the ScamShield helpline on 1799
Review which of your accounts, emails, and phone numbers have appeared in known breaches

That last step is where most people get stuck. There are dozens of public breach databases, and checking each one manually is slow and incomplete. That is exactly what Lunyb was built to solve.

How Lunyb Helps You Act Fast After a Singapore Data Breach

Lunyb is a phone privacy and scam-protection app that gives Singapore users the tools to find out what is already exposed and lock it down — all in one place. If you have just been told your data was part of a breach, Lunyb saves you hours of manual checking and gives you a clear action plan.

Data Breach Alerts for email and phone

Add your email addresses and Singapore mobile number to Lunyb's Data Breach Alerts. We continuously scan known breach corpuses and tell you exactly which services leaked your data, when, and what categories were exposed (passwords, addresses, dates of birth). When a new breach surfaces that includes you, you get alerted — you do not have to go hunting.

Scam Checker for phishing after a breach

The weeks after a breach are peak phishing season. Scammers know your name, your bank, and sometimes your NRIC. Lunyb's Scam Checker lets you paste any suspicious SMS, WhatsApp message, or link and get a quick read on whether it is a scam before you click. Combine that with Scam Shield caller protection and you cut off the most common follow-up attacks.

Password and Photo Vault

If the breach exposed a reused password, you need to rotate credentials across every account that used it. Lunyb's encrypted Password Vault stores strong, unique passwords locally so the next breach only affects one account — not twenty. The Photo Vault does the same for sensitive images and documents like IC scans and insurance papers.

Privacy Check and Security Score

Our Privacy Check reviews which apps on your phone have access to your contacts, location, microphone, and photos — a common path for data to leak in the first place. Your Security Score gives you a single number to improve, with clear next actions, so you always know what to fix next.

On-device tracker and threat blocking

Lunyb includes an on-device encrypted DNS shield that blocks trackers, malicious domains, and known scam infrastructure at the network level — without slowing your phone down. It is a quiet layer of defence that keeps working even when you are not thinking about it.

Optional Leak Protection

For users who want deeper exposure help — including data-broker style removal assistance — Lunyb offers optional Leak Protection billed separately from the main plan. You can pause it any time without cancelling your main Lunyb subscription.

Lunyb vs Manual Breach Response: What You Actually Get

Task	Doing It Manually	With Lunyb
Check if email is in a breach	Search multiple public databases one by one	Continuous monitoring with alerts
Check if phone number is exposed	Very limited free options in Singapore	Included in Data Breach Alerts
Verify suspicious SMS or link	Guess, or Google the sender	Scam Checker gives an instant read
Block scam callers	Report numbers one at a time	Scam Shield blocks known scam patterns
Rotate reused passwords	Try to remember every account	Password Vault surfaces reuse
Review app permissions	Manually open every app's settings	Privacy Check in one screen
Block trackers and malicious domains	Not practical without technical setup	On-device encrypted DNS shield

Lunyb plans start from about $19.99/month and renew until cancelled. You can cancel any time online — no phone calls, no retention gauntlet. That transparency is why we recommend starting with the free privacy quiz on lunyb.com before you commit.

Common PDPC Reporting Mistakes to Avoid

Waiting for the investigation to finish

You do not have the luxury of a complete picture. Submit what you know within 72 hours of determining the breach is notifiable and file updates as you learn more.

Under-reporting the scope

If you later discover more individuals were affected, you must update the PDPC. Trying to minimise the number up front almost always comes back worse.

Vague notifications to individuals

Telling customers there was "a security incident" without telling them what data was involved breaks trust and does not satisfy the PDPA. Be specific.

Forgetting your DPO obligations

Every organisation in Singapore must appoint a Data Protection Officer and publish their contact. If you do not have one, fix that before your next breach — not during it.

Ignoring individual follow-up

Even after you notify the PDPC, your obligation to help affected individuals continues. Point them to resources like ScamShield (1799) and practical tools like Lunyb's breach alerts and scam protection so they can protect themselves.

Take Action Now

Whether you are the organisation that suffered the breach or an individual who was notified, the next 72 hours matter more than the next 72 days. Organisations: file the PDPC notification, communicate clearly, and remediate the root cause. Individuals: change your passwords, enable two-factor authentication, and get continuous monitoring so you are never the last to know.

Start with the free privacy quiz on lunyb.com — it takes about two minutes and tells you exactly where your exposure is. Then download the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Checker, and Scam Shield in a few taps.

Breaches are not going away. Being ready for the next one is the only answer.

Frequently Asked Questions

How long do I have to report a data breach to PDPC?

You have up to 30 calendar days to assess whether a breach is notifiable, and 3 calendar days (72 hours) from the moment you determine it is notifiable to submit the report to the PDPC.

What is the penalty for not reporting a data breach in Singapore?

Failure to notify the PDPC of a notifiable breach can result in financial penalties under the PDPA, alongside separate penalties for the underlying breach itself. The Commission may also issue directions requiring remediation and public disclosure.

Do I need to report a breach if the data was encrypted?Do I need to report a breach if the data was encrypted?

Generally no, provided the encryption remains intact and the decryption keys were not also compromised. You should still document the incident internally in case the situation changes.

How can I check if my personal data has been leaked in a breach?

Lunyb's Data Breach Alerts continuously monitor your email addresses and phone number against known breach corpuses and notify you when new exposures appear. Start with the free privacy quiz at lunyb.com to see your current exposure.

Does Lunyb replace reporting to PDPC?

No. PDPC reporting is a legal obligation on organisations that suffer a breach. Lunyb helps individuals (and employees inside organisations) monitor their personal exposure, catch scams faster, and lock down accounts after a breach — it sits alongside your legal and compliance work, not in place of it.