How to Report a Data Breach to PDPC Singapore: A Step-by-Step Guide

If your organisation has suffered a data breach in Singapore, the clock is ticking. Under the Personal Data Protection Act (PDPA), notifiable breaches must be reported to the Personal Data Protection Commission (PDPC) within strict timelines, and failure to comply can result in financial penalties of up to S$1 million or 10% of annual turnover. This guide walks you through exactly how to report a data breach to PDPC Singapore, who needs to be notified, and what information you must provide.

What Counts as a Notifiable Data Breach Under Singapore's PDPA?

A notifiable data breach under Singapore's PDPA is any unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data that is likely to result in significant harm to affected individuals, or that affects 500 or more individuals.

The Personal Data Protection (Notification of Data Breaches) Regulations 2021 came into force on 1 February 2021, making breach notification a legal obligation rather than a voluntary practice. Before you report, you must first determine whether your incident meets the notification threshold.

The Two Notification Thresholds

Your breach is notifiable to the PDPC if it meets either of these criteria:

Significant harm threshold: The breach results in, or is likely to result in, significant harm to an affected individual. The PDPC has prescribed specific categories of personal data where significant harm is deemed to occur.
Scale threshold: The breach affects, or is likely to affect, 500 or more individuals.

Categories of Personal Data Deemed to Cause Significant Harm

The regulations specify prescribed categories, including:

Full name or alias combined with NRIC number, passport number, work permit number, or other national identifiers
Financial information such as bank account numbers, credit card numbers, or transaction details
Account credentials including usernames and passwords
Health information, medical records, and diagnoses
Information about children and young persons
Information about adoption, domestic abuse, or sexual activity
Life insurance policies and claims information

Who Must Report a Data Breach to PDPC?

Any organisation that collects, uses, or discloses personal data in Singapore and that experiences a notifiable breach is legally required to report it. This applies to private sector organisations of all sizes, from small businesses to multinational corporations operating in Singapore.

Data intermediaries (processors handling data on behalf of other organisations) must notify the controlling organisation without undue delay once they become aware of a breach. The controlling organisation is then responsible for making the formal notification to the PDPC and affected individuals.

Mandatory Timelines for Reporting a Data Breach to PDPC

Singapore's PDPA sets strict timelines that organisations must follow once a breach is discovered. Missing these deadlines is one of the most common compliance failures.

Stage	Timeline	Action Required
Assessment	Within 30 calendar days of becoming aware	Determine whether the breach is notifiable
Notification to PDPC	As soon as practicable, no later than 3 calendar days after determining it is notifiable	Submit official breach notification
Notification to individuals	At the same time or after notifying PDPC	Inform affected individuals (unless exceptions apply)
Remediation	Ongoing	Contain breach and prevent recurrence

Step-by-Step: How to Report a Data Breach to PDPC Singapore

Reporting a data breach to the PDPC involves a structured process that begins the moment you discover a potential incident. Follow these steps in order to ensure compliance.

Step 1: Contain the Breach Immediately

Before notification, take steps to stop the breach from spreading. This might include disabling compromised accounts, isolating affected systems, revoking access credentials, or taking servers offline. Document every containment action with timestamps, as the PDPC will ask about this.

Step 2: Assemble Your Breach Response Team

Convene your Data Protection Officer (DPO), IT security team, legal counsel, and senior management. If you do not have a DPO, Singapore law requires every organisation to appoint one. The DPO leads the assessment and acts as the primary contact with PDPC.

Step 3: Assess the Breach Within 30 Days

Conduct a thorough assessment to determine:

What personal data was involved
How many individuals are affected
The cause of the breach (hacking, insider threat, lost device, misconfiguration)
Whether the data falls into prescribed categories causing significant harm
Whether remedial actions have reduced the likelihood of harm

Step 4: Submit the Notification Through PDPC's Online Portal

Once you determine the breach is notifiable, submit the notification within 3 calendar days through the PDPC's online Data Breach Notification form, available at the PDPC website (pdpc.gov.sg). You will need to log in using CorpPass.

Step 5: Notify Affected Individuals

Affected individuals must be notified in a clear and easily understood manner. The notification should explain what happened, what data was involved, potential consequences, and steps individuals can take to protect themselves.

Step 6: Follow Up With Additional Information

If investigation is ongoing when you submit the initial notification, you can provide information that is reasonably available and update the PDPC later. The PDPC expects supplementary submissions as new facts emerge.

Information You Need to Include in Your Notification

The PDPC's breach notification form requires specific details. Preparing this information in advance speeds up submission.

Required Details

Organisation details: UEN, name, contact person (usually the DPO)
Breach description: Nature, cause, date of occurrence, date of discovery
Personal data involved: Categories and estimated volume
Number of affected individuals: Actual or estimated
Potential harm: Assessment of risks to affected individuals
Containment measures: Actions already taken
Remedial plans: Steps to prevent recurrence
Individual notification plan: How and when you will notify affected persons

When You Do Not Need to Notify Affected Individuals

While you must always notify the PDPC for a notifiable breach, there are limited situations where you do not have to notify affected individuals. These exceptions are narrow and should be applied carefully.

Technological protection: If the compromised data was protected by technological measures (such as strong encryption) that render it unlikely the data can be accessed in a meaningful way.
Remedial action taken: If the organisation has taken action that makes it unlikely significant harm will result.
PDPC waiver: The PDPC may direct the organisation not to notify, or law enforcement may request a delay.

Common Mistakes Organisations Make When Reporting Breaches

Based on PDPC enforcement decisions, these are the most frequent errors that lead to penalties even after a breach is reported.

Delayed Discovery and Reporting

Many organisations fail to detect breaches promptly due to inadequate monitoring. The 30-day assessment clock starts when the organisation "becomes aware" of the breach, which the PDPC interprets strictly. Logging and monitoring gaps often result in extended fines.

Under-reporting the Scope

Organisations sometimes report fewer affected individuals or narrower data categories to minimise reputational impact. If subsequent investigation reveals a larger scope, this is treated as an aggravating factor.

Inadequate Individual Notification

Vague, jargon-heavy notifications that fail to clearly explain risks have resulted in enforcement actions. Notifications should be plain English and actionable.

Poor Documentation

Even if a breach is not notifiable, organisations must keep records of the assessment and decision rationale. Lack of documentation is treated as a compliance failure.

Penalties for Non-Compliance

Under the amended PDPA, the PDPC can impose financial penalties of up to S$1 million, or 10% of annual turnover in Singapore for organisations with turnover exceeding S$10 million, whichever is higher. This represents a significant increase from the previous S$1 million flat cap.

Beyond monetary penalties, the PDPC can issue directions requiring organisations to stop collecting personal data, destroy data collected unlawfully, or implement specific security measures. Published enforcement decisions also carry reputational consequences.

Preventing the Next Breach: Practical Security Measures

Reporting a breach is a reactive measure. The best strategy is prevention through proactive security controls aligned with PDPC guidance.

Technical Controls

Encrypt personal data at rest and in transit using industry-standard algorithms
Implement multi-factor authentication for all accounts accessing personal data
Deploy endpoint detection and response tools on devices handling customer information
Use encrypted DNS and secure browsers for staff accessing sensitive systems
Maintain patched, up-to-date systems with centralised vulnerability management

Organisational Controls

Appoint and empower a qualified Data Protection Officer
Conduct regular Data Protection Impact Assessments (DPIAs)
Run annual tabletop exercises simulating a breach response
Train all staff on PDPA obligations and phishing recognition
Maintain an up-to-date data inventory and retention schedule

Vendor and Link Management

Many breaches originate from third-party vendors or malicious links sent to staff. When sharing links internally or externally, use reputable services that offer link scanning, access controls, and audit logs. Platforms like Lunyb provide secure link shortening with analytics, which helps marketing and operations teams track and manage shared URLs while maintaining visibility into click patterns, something especially useful for incident investigations. You can read more in our honest review of Lunyb or compare options in our 2026 buyer's guide to URL shorteners.

Working With the PDPC After Submission

After you submit a notification, the PDPC may open an investigation. Cooperation is both a legal requirement and a mitigating factor in any eventual penalty determination.

Expect requests for additional documentation, including incident timelines, system logs, policy documents, training records, and vendor contracts. Appoint a single point of contact to coordinate all PDPC communications and ensure consistent, accurate responses. Being proactive, transparent, and demonstrating meaningful remediation often results in lighter outcomes.

Frequently Asked Questions

What is the deadline to report a data breach to PDPC Singapore?

You must notify the PDPC as soon as practicable, and no later than 3 calendar days after determining that the breach is notifiable. You have up to 30 calendar days from becoming aware of the breach to complete your assessment of whether it is notifiable.

Do I need to report every data breach to PDPC?

No. Only notifiable breaches must be reported. A breach is notifiable if it is likely to cause significant harm to affected individuals or affects 500 or more individuals. However, you should still document non-notifiable breaches internally, including your assessment rationale.

How do I actually submit the breach notification?

Submit the notification through the PDPC's online Data Breach Notification form on pdpc.gov.sg. You will need to authenticate using CorpPass. The form will walk you through the required fields, and you can upload supporting documents.

What happens if I fail to report a notifiable data breach?

Failure to notify is a breach of the PDPA and can result in financial penalties of up to S$1 million, or 10% of annual turnover in Singapore for larger organisations. The PDPC may also issue directions and publish the enforcement decision, resulting in reputational damage.

Can my data intermediary notify the PDPC on my behalf?

No. The obligation to notify the PDPC rests with the organisation that controls the personal data. Data intermediaries must notify the controlling organisation without undue delay, but the formal notification to PDPC and affected individuals must come from the controller.

Final Thoughts

Reporting a data breach to the PDPC is a structured process that rewards preparation. Organisations with a tested incident response plan, a trained DPO, and clear documentation routinely navigate breach notification with minimal disruption. Those caught unprepared face compressed timelines, incomplete submissions, and higher penalties. Treat the PDPA's breach notification regime not as a bureaucratic burden but as a framework that, properly implemented, protects both your customers and your organisation.