How to Report a Data Breach to PDPC Singapore: A Complete 2026 Guide

Reporting a data breach to the Personal Data Protection Commission (PDPC) is a legal obligation under Singapore's Personal Data Protection Act (PDPA). Since the mandatory data breach notification regime came into effect on 1 February 2021, organisations have had clear timelines and criteria to follow when personal data is compromised. This guide walks you through exactly how to report a data breach to PDPC, what qualifies as a notifiable breach, and the practical steps to stay compliant.

What Is a Notifiable Data Breach Under Singapore's PDPA?

A notifiable data breach is a security incident that results in unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data, and meets specific thresholds set out in the PDPA. Not every breach is notifiable, but organisations must assess every incident to determine whether reporting obligations apply.

Under Section 26B of the PDPA, a data breach must be notified to the PDPC if it:

• Results in, or is likely to result in, significant harm to affected individuals; or
• Is of a significant scale, meaning it affects 500 or more individuals.

What Counts as "Significant Harm"?

The Personal Data Protection (Notification of Data Breaches) Regulations 2021 specify categories of personal data that are presumed to cause significant harm if compromised. These include:

• Full name combined with NRIC, FIN, or passport numbers
• Financial information such as credit card details and bank account numbers
• Health information and medical records
• Information about adoption matters or children's welfare
• Account credentials that could enable unauthorised access to systems

Who Must Report a Data Breach to PDPC?

All organisations in Singapore that collect, use, or disclose personal data in the course of business are subject to the PDPA. This includes companies of all sizes, non-profits, and even sole proprietors handling customer data. Data intermediaries (processors) must notify the data controller without undue delay once they become aware of a breach, while the data controller bears the primary responsibility for reporting to the PDPC.

Data Breach Notification Timelines You Must Follow

Timeliness is critical. The PDPA sets strict deadlines once an organisation determines that a breach is notifiable:

Action	Deadline	Who to Notify
Assess the breach	Within 30 days of becoming aware	Internal assessment
Notify PDPC	As soon as practicable, no later than 3 calendar days	Personal Data Protection Commission
Notify affected individuals	As soon as practicable (same time or after PDPC notification)	Affected individuals
Data intermediary notifies controller	Without undue delay	Data controller

Missing these deadlines can lead to enforcement action, including financial penalties of up to S$1 million or 10% of annual turnover in Singapore, whichever is higher, for organisations with annual local turnover exceeding S$10 million.

Step-by-Step: How to Report a Data Breach to PDPC

Follow this structured process when a breach is discovered. Having a documented incident response plan in place well before an incident occurs will make execution smoother.

1. Contain the breach immediately. Isolate affected systems, revoke compromised credentials, disable breached accounts, and stop any ongoing data exfiltration. Preserve evidence for forensic review.
2. Convene your incident response team. This typically includes your Data Protection Officer (DPO), IT security, legal counsel, and senior management. Document the time of discovery and who was notified internally.
3. Assess the scope and severity. Identify what personal data was affected, how many individuals are impacted, the cause of the breach, and whether the data is likely to cause significant harm. You have up to 30 days to complete this assessment, but act faster where possible.
4. Determine notification obligations. If the breach meets the 500-individual threshold or involves data likely to cause significant harm, both PDPC and affected individuals must be notified.
5. Submit the breach notification to PDPC. Use the online data breach notification form on the PDPC website (pdpc.gov.sg). You will need to log in via Corppass. Submit within 3 calendar days of determining the breach is notifiable.
6. Notify affected individuals. Communicate clearly in plain language. Include what happened, what data was involved, what the organisation is doing in response, and what steps individuals should take to protect themselves.
7. Remediate and document. Implement security fixes, update policies, retrain staff, and maintain detailed records of the incident, response actions, and lessons learned.
8. Cooperate with PDPC follow-ups. The Commission may request further information or conduct an investigation. Respond promptly and thoroughly.

What Information Must the PDPC Notification Include?

The PDPC's online notification form requires detailed information. Preparing this in advance speeds up submission:

• Organisation details and DPO contact information
• Date and time the breach was discovered
• Date and time the breach occurred (if known)
• Description of how the breach happened (cause and method)
• Types and volume of personal data affected
• Number of individuals affected
• Potential harm to affected individuals
• Containment measures already taken
• Planned remediation and prevention measures
• Whether and how affected individuals have been or will be notified

If some details are still being investigated, you can submit an initial notification and provide updates later. Do not delay notification simply because the investigation is incomplete.

When You Don't Need to Notify Affected Individuals

While PDPC notification is mandatory for qualifying breaches, there are limited exceptions to notifying affected individuals:

• Technological protection: If the compromised data was encrypted or otherwise rendered unreadable, and the risk of harm is effectively eliminated.
• Remedial action: If the organisation has taken action that makes it unlikely the breach will result in significant harm.
• Prescribed law enforcement circumstances: Where notification would prejudice an investigation or compromise national security, and PDPC has directed otherwise.

You must still notify the PDPC and document your justification for not informing individuals.

Common Causes of Data Breaches in Singapore

Understanding typical breach vectors helps you prioritise defences. According to PDPC enforcement decisions, the most common causes include:

Breach Cause	Typical Example	Prevention Focus
Phishing and credential theft	Employee clicks malicious link, attacker accesses CRM	MFA, email filtering, staff training
Misconfigured cloud storage	Public S3 bucket exposing customer records	Cloud security posture reviews
Ransomware	Encrypted file servers with customer PII	Backups, patching, endpoint protection
Lost or stolen devices	Unencrypted laptop with employee records	Full-disk encryption, remote wipe
Human error	Mass email with CC instead of BCC	Process controls, DLP tools
Insider misuse	Staff downloading data before resignation	Access reviews, audit logging

Building a Breach Response Plan Before It Happens

The best time to prepare for a breach is before one occurs. A solid response plan typically includes:

1. Clear roles and responsibilities: Appoint a DPO (mandatory under the PDPA) and define who leads incident response.
2. Detection capabilities: Deploy logging, monitoring, and intrusion detection so you discover breaches quickly.
3. Documented procedures: Write down containment, assessment, notification, and communication steps.
4. Pre-drafted templates: Prepare template notifications to PDPC, customers, staff, and media.
5. Vendor contacts: Keep forensic investigators, legal counsel, and PR advisors on standby.
6. Regular drills: Run tabletop exercises at least annually to test the plan.

Reducing Risk with Smart Link and Data Hygiene

Many breaches start with simple weaknesses: oversharing data in public URLs, embedding personal identifiers in query strings, or using uncontrolled share links in marketing and support workflows. Using a privacy-focused link management platform like Lunyb lets you create short, trackable links with access controls and expiration dates, so sensitive URLs don't linger in inboxes and chat logs forever. For more on how Lunyb handles data responsibly, see our honest review of Lunyb, or compare options in our 2026 buyer's guide to URL shorteners.

Penalties for Non-Compliance

The PDPC takes breach notification seriously. Since the financial penalty cap was raised in 2022, organisations face substantially higher exposure:

• Up to S$1 million, or
• 10% of annual turnover in Singapore for organisations with local turnover exceeding S$10 million — whichever is higher.

Beyond fines, the Commission can issue directions requiring organisations to take specific remedial actions, publish breach details, or undergo compliance audits. Reputational damage, customer attrition, and civil claims from affected individuals under the private right of action can further compound costs.

Recent PDPC Enforcement Trends

Recent PDPC decisions highlight several recurring themes organisations should learn from:

• Weak access controls on administrative portals continue to drive large-scale breaches.
• Failure to patch known vulnerabilities within reasonable timeframes is treated as negligence.
• Insufficient oversight of data intermediaries (vendors) is attributed back to the data controller.
• Delayed notification — even by a few days — is explicitly cited as an aggravating factor.
• Strong, documented response actions can reduce financial penalties.

Checklist: Are You Ready to Report a Breach?

1. ✅ Have you appointed a DPO and published their contact details?
2. ✅ Do you have an incident response plan with named owners?
3. ✅ Are your Corppass credentials ready for PDPC form submission?
4. ✅ Can you identify what personal data you hold, where, and who has access?
5. ✅ Do you have logging and detection to spot a breach within hours, not weeks?
6. ✅ Have you drafted notification templates for PDPC and individuals?
7. ✅ Have you conducted a tabletop exercise in the past 12 months?

If you answered "no" to any of these, address them now — not when you're already in the middle of a crisis.

Frequently Asked Questions

1. How quickly must I report a data breach to PDPC Singapore?

Once you have determined that a breach is notifiable, you must notify the PDPC as soon as practicable and no later than 3 calendar days. You have up to 30 days from discovery to complete your assessment of whether the breach is notifiable, but regulators expect you to move faster whenever possible.

2. Do I need to report a breach if the data was encrypted?

If the compromised personal data was properly encrypted and the encryption keys were not also compromised, the risk of significant harm may be considered eliminated. You may not need to notify affected individuals, but you should still assess and document the incident. When in doubt, consult the PDPC or legal counsel.

3. What is the threshold of 500 individuals based on?

The 500-individual threshold applies to the total number of individuals whose personal data is affected by the breach, regardless of the type of data involved. Even if the data is not inherently sensitive, a breach affecting 500 or more individuals is automatically notifiable to the PDPC under the "significant scale" criterion.

4. What happens after I submit the notification?

The PDPC will acknowledge the notification and may request additional information. Depending on severity, they may open an investigation under Section 50 of the PDPA. Cooperate fully, provide requested documentation, and continue your remediation. Outcomes range from no further action to directions, financial penalties, or published decisions.

5. Can small businesses be fined for not reporting a breach?

Yes. All organisations handling personal data in Singapore are subject to the PDPA, regardless of size. While penalties are calibrated to the organisation's circumstances, small businesses have been fined for failing to notify or implement reasonable security arrangements. Having basic policies, a designated DPO, and a response plan is the minimum expected standard.

Final Thoughts

Reporting a data breach to PDPC isn't just about ticking a compliance box — it's about demonstrating accountability to the individuals whose data you were trusted to protect. Build the processes now, train your team, and treat every incident as an opportunity to strengthen your security posture. When a breach does occur, speed, transparency, and documented response actions are your best allies in minimising harm and regulatory consequences.