How to Report a Data Breach to PDPC Singapore: A Complete 2026 Guide

If your organisation suffers a data breach in Singapore, you may have a legal obligation to notify the Personal Data Protection Commission (PDPC) within strict timelines. Since the Personal Data Protection Act (PDPA) was amended in 2021 to include mandatory breach notification, understanding exactly when and how to report is critical to avoiding penalties of up to S$1 million (or 10% of annual turnover for larger organisations).

This guide walks you through the entire process of reporting a data breach to PDPC Singapore, including the notification thresholds, deadlines, required information, and practical steps to take before, during, and after a breach.

What Is a Notifiable Data Breach Under the PDPA?

A notifiable data breach is an incident involving the unauthorised access, use, disclosure, copying, modification, or disposal of personal data that meets specific severity criteria defined by the PDPA. Not every security incident triggers mandatory notification — the breach must meet one of two thresholds.

Under Section 26A of the PDPA and the Personal Data Protection (Notification of Data Breaches) Regulations 2021, a data breach is notifiable if it:

1. Results in, or is likely to result in, significant harm to an affected individual; OR
2. Is of a significant scale, meaning it affects 500 or more individuals.

What Counts as "Significant Harm"?

The PDPC has prescribed specific categories of personal data that, if compromised, are deemed likely to cause significant harm. These include:

• Full name or alias combined with NRIC, FIN, work permit, or passport number
• Financial information such as bank account numbers, credit card details, or income records
• Health information including medical records, diagnoses, and treatment details
• Information about vulnerabilities (e.g., disabilities, mental health conditions)
• Private sexual or intimate information
• Account credentials that could enable access to financial accounts

Who Must Report a Data Breach to PDPC?

Any organisation that collects, uses, or discloses personal data in Singapore is subject to the PDPA's breach notification obligations. This includes:

• Private sector companies of all sizes
• Non-profit organisations handling personal data
• Data intermediaries (processors) — though they must notify the data controller, not PDPC directly
• Foreign companies that process personal data of individuals in Singapore

Public agencies are governed separately under the Public Sector (Governance) Act and are not covered by PDPA notification rules.

Breach Notification Timeline: The 72-Hour and 3-Day Rules

Singapore's PDPA sets strict timelines for both assessing and reporting data breaches. Missing these deadlines can lead to financial penalties and reputational damage.

Step 1: Assessment Within 30 Days

Once your organisation has reason to believe a breach has occurred, you must assess within 30 calendar days whether it is notifiable. This assessment should be documented thoroughly.

Step 2: Notify PDPC Within 3 Calendar Days

If the breach is determined to be notifiable, you must inform the PDPC as soon as practicable, and no later than 3 calendar days after making that determination.

Step 3: Notify Affected Individuals

Where the breach is likely to cause significant harm, you must also notify affected individuals on or after notifying PDPC, unless an exception applies (e.g., law enforcement advises against it, or you have taken remedial action that renders harm unlikely).

Step-by-Step: How to Report a Data Breach to PDPC

Follow this sequence when reporting a notifiable breach:

1. Contain the breach immediately. Isolate affected systems, revoke compromised credentials, and stop ongoing unauthorised access.
2. Convene your incident response team. Include IT, legal, communications, and your Data Protection Officer (DPO).
3. Conduct a preliminary assessment. Determine the nature, scope, and sensitivity of the data involved.
4. Document everything. Record the timeline of discovery, assessment steps, and decisions made.
5. Access the PDPC Data Breach Notification Form. Visit the PDPC website at pdpc.gov.sg and locate the online breach notification portal.
6. Complete and submit the form within 3 calendar days of determining the breach is notifiable.
7. Notify affected individuals through appropriate channels (email, letter, SMS, or public notice).
8. Follow up with PDPC as additional information becomes available or as requested.

Information Required in the PDPC Notification Form

The notification form requests comprehensive details about the breach. Prepare the following before you start:

How to Notify Affected Individuals

When a breach is likely to cause significant harm, affected individuals must be notified in a clear and comprehensible manner. Your notification should include:

• A description of the breach, including when it occurred
• The types of personal data involved
• The potential consequences for the individual
• Steps your organisation has taken in response
• Actions the individual should take to protect themselves (e.g., change passwords, monitor accounts)
• Contact details for further enquiries

When You Don't Have to Notify Individuals

You may be exempt from notifying individuals if:

• You have taken remedial action that makes significant harm unlikely
• The affected personal data was subject to a technological protection measure (e.g., strong encryption)
• A law enforcement agency or PDPC instructs you not to notify

Common Causes of Reportable Breaches in Singapore

Based on PDPC's published enforcement decisions, the most frequent breach causes include:

• Phishing attacks leading to credential compromise
• Ransomware infections affecting customer databases
• Misconfigured cloud storage exposing data publicly
• Lost or stolen devices containing unencrypted personal data
• Insider threats and unauthorised employee access
• Third-party vendor compromises affecting shared data
• Accidental email disclosure (e.g., CC instead of BCC on mass emails)

Penalties for Non-Compliance

Failing to notify PDPC of a notifiable breach, or failing to notify affected individuals when required, can result in significant financial penalties.

Beyond financial penalties, non-compliance can trigger reputational damage, customer loss, and civil claims from affected individuals under Section 48O of the PDPA.

Best Practices to Prepare for a Potential Breach

Preparation is the single most effective way to meet PDPC's tight 3-day reporting window. Here are the key practices every organisation should implement:

1. Appoint a Data Protection Officer (DPO)

The PDPA requires every organisation to designate a DPO. This person should be trained in incident response and empowered to make rapid decisions.

2. Maintain a Data Inventory

Know what personal data you hold, where it's stored, who has access, and how it flows through your systems. This dramatically accelerates breach assessment.

3. Develop a Data Breach Response Plan

Document your incident response procedures, including roles, escalation paths, and communication templates. Test the plan with tabletop exercises at least annually.

4. Implement Strong Technical Controls

Encryption at rest and in transit, multi-factor authentication, access logging, and endpoint protection reduce both the likelihood and impact of breaches. Encrypted DNS and private browsers can further harden your perimeter.

5. Secure External Links and Communications

Phishing often starts with a malicious link. Using a trusted link management platform like Lunyb for your branded short links helps customers verify legitimate communications and reduces impersonation risks. For a deeper look at link management options, see our 2026 buyer's guide to URL shorteners.

6. Train Your Staff Regularly

Human error causes the majority of breaches. Quarterly awareness training on phishing, data handling, and reporting procedures is essential.

7. Vet Your Data Intermediaries

Your organisation remains liable for breaches at your processors. Include breach notification clauses, audit rights, and security standards in all contracts.

What Happens After You Submit the Notification?

Once you submit the form, PDPC will acknowledge receipt and may:

• Request additional information or clarification
• Open an investigation under Section 50 of the PDPA
• Issue directions requiring corrective action
• Impose financial penalties if non-compliance is found
• Publish an enforcement decision on the PDPC website

Cooperation with PDPC throughout the process — including voluntary disclosure of mitigating steps — is typically viewed favourably and can reduce potential penalties.

Case Study: Learning from Published Enforcement Decisions

PDPC regularly publishes enforcement decisions on its website. Reviewing these cases reveals common pitfalls:

• Delayed internal reporting leading to missed deadlines
• Inadequate documentation of containment efforts
• Failure to notify individuals despite clear significant harm
• Weak contractual terms with data intermediaries
• Lack of basic security measures like password policies or patch management

Organisations that demonstrated proactive remediation, cooperation, and genuine improvement typically received reduced penalties or warnings instead of fines.

FAQ: Reporting a Data Breach to PDPC Singapore

Do I need to report every data breach to PDPC?

No. You only need to notify PDPC if the breach meets the notifiability threshold — either it is likely to cause significant harm to affected individuals, or it affects 500 or more individuals. However, you should still document all breaches internally, even non-notifiable ones.

What is the deadline for reporting a data breach to PDPC?

You must notify PDPC as soon as practicable, and no later than 3 calendar days after determining that the breach is notifiable. The preceding assessment to make that determination should be completed within 30 days of becoming aware of the incident.

Can I be fined for not reporting a data breach?

Yes. Failing to notify PDPC of a notifiable breach can result in financial penalties of up to S$1 million, or 10% of your annual turnover in Singapore if that turnover exceeds S$10 million. Additional penalties may apply for failing to notify affected individuals.

Do I need to notify affected individuals even if I notify PDPC?

Generally, yes — if the breach is likely to cause significant harm, you must notify affected individuals. Exceptions apply if remedial actions have rendered harm unlikely, the data was strongly encrypted, or if PDPC or law enforcement directs otherwise.

What if the breach happened at my data intermediary (vendor)?

You, as the data controller, remain responsible for notifying PDPC. Your data intermediary must notify you "without undue delay" so you can meet your obligations. This is why strong contractual breach-notification clauses with vendors are essential.

Where do I submit the data breach notification form?

The notification form is available on the official PDPC website (pdpc.gov.sg) under the "Report a Data Breach" section. The form is submitted online, and you will receive an acknowledgement after submission.

Final Thoughts

Reporting a data breach to PDPC Singapore is a time-sensitive, high-stakes process. The 3-day notification window leaves no room for improvisation — organisations that fare best are those that have prepared in advance with a documented incident response plan, trained staff, and strong technical controls. Treat breach preparedness as an ongoing programme, not a one-time project, and you'll be positioned to respond effectively if the worst happens.

If you're building or reviewing your organisation's data protection framework, pair strong internal processes with trusted external tools — from encrypted communications to verified branded links — to reduce both the likelihood and impact of a reportable incident.