How to Report a Data Breach to PDPC Singapore: 2026 Guide

If your organisation has suffered a data breach in Singapore, you may be legally required to notify the Personal Data Protection Commission (PDPC) within strict deadlines. Since the mandatory data breach notification (DBN) regime took effect on 1 February 2021, failure to report qualifying breaches can result in financial penalties of up to S$1 million (or 10% of annual turnover in Singapore for organisations with turnover above S$10 million). This guide walks you through exactly how to report a data breach to PDPC Singapore, who must be notified, and what information you need to prepare.

What Is a Notifiable Data Breach Under the PDPA?

A notifiable data breach under Singapore's Personal Data Protection Act (PDPA) is an incident involving personal data that either results in significant harm to affected individuals, or affects 500 or more individuals. Not every breach must be reported—only those meeting the notification thresholds set out in Part VIA of the PDPA.

A "data breach" itself is defined broadly and includes:

• Unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data
• Loss of any storage medium or device on which personal data is stored, where unauthorised access or use is likely

The Two Notification Thresholds

Under the PDPA, you must notify the PDPC if the breach:

1. Results in, or is likely to result in, significant harm to any affected individual (for example, identity theft, financial loss, reputational damage, or disclosure of sensitive data like NRIC numbers, financial account details, or health information); OR
2. Affects 500 or more individuals, regardless of whether significant harm is likely.

The Personal Data Protection (Notification of Data Breaches) Regulations 2021 prescribe specific categories of personal data that are automatically deemed to cause significant harm if disclosed—these include full name combined with NRIC, passport numbers, bank account details, credit card information, and medical records.

Reporting Timelines You Must Follow

Singapore's PDPA imposes two distinct timelines once a breach is discovered. Missing either can constitute a separate breach of the law.

Action	Deadline	Trigger
Internal assessment of breach	Within 30 calendar days	From the time you have reason to believe a breach occurred
Notify PDPC	As soon as practicable, no later than 3 calendar days	After assessing the breach is notifiable
Notify affected individuals	As soon as practicable (same time or after PDPC notification)	Where significant harm is likely

The 3-day clock starts after you have completed your assessment and determined the breach is notifiable—not from the moment of discovery. However, PDPC expects organisations to assess breaches expeditiously and will scrutinise delays.

Step-by-Step: How to Report a Data Breach to PDPC

Step 1: Contain the Breach Immediately

Before any notification, take immediate action to contain the incident. This might include:

1. Isolating affected systems from the network
2. Revoking compromised credentials and resetting passwords
3. Recovering lost physical devices where possible
4. Shutting down the vulnerability that caused the breach
5. Preserving evidence and system logs for forensic analysis

Step 2: Assess the Breach

Your Data Protection Officer (DPO) or incident response team must determine:

• What personal data was involved (types, volume, sensitivity)
• How many individuals are affected
• The cause and extent of the breach
• Whether the data was encrypted or otherwise rendered unreadable
• Likely consequences and risk of harm to individuals

Document your assessment thoroughly. PDPC may request this documentation during their review.

Step 3: Determine if the Breach Is Notifiable

Apply the two thresholds. If either is met, you must notify PDPC. If the data was strongly encrypted and the encryption keys were not compromised, the breach may not be notifiable because the risk of harm is significantly reduced—but document this reasoning.

Step 4: Submit the Notification Online

PDPC provides an online Data Breach Notification Form accessible through the PDPC website (pdpc.gov.sg). You can also submit via the eService portal. The form requires:

1. Organisation details: name, UEN, DPO contact information
2. Breach details: date and time of occurrence, date of discovery, how it was discovered
3. Nature of the breach: cause (e.g., hacking, human error, lost device, phishing)
4. Personal data involved: categories and volume of data, number of individuals affected
5. Potential harm: assessment of likely impact
6. Containment measures: actions already taken
7. Remediation plan: steps to prevent recurrence
8. Individual notification plan: whether and how you will notify affected persons

Step 5: Notify Affected Individuals

Where the breach is likely to cause significant harm, you must notify affected individuals in any manner reasonable in the circumstances. This is typically by email, SMS, post, or phone. The notification must include:

• A description of the breach
• The types of personal data involved
• Measures taken or to be taken to address the breach
• Information or steps individuals can take to protect themselves
• Contact details for further enquiries

Individual notification can be waived only in limited circumstances—for example, if PDPC directs otherwise, if a prescribed law enforcement agency instructs you not to, or if you have taken remedial action that makes significant harm no longer likely.

Step 6: Follow Up and Document

After initial notification, PDPC may request additional information. Maintain a complete incident file including timelines, communications, forensic reports, and remediation evidence. This record is essential if PDPC opens an investigation.

Common Causes of Reportable Breaches in Singapore

Based on PDPC enforcement decisions published between 2021 and 2025, the most common causes of notifiable breaches include:

Cause	Example Scenario	Prevention Priority
Phishing and credential theft	Staff click malicious link, attacker accesses CRM	MFA, security awareness training
Ransomware	Encrypted systems with data exfiltration	Patching, endpoint protection, backups
Misconfigured cloud storage	S3 bucket or database left publicly accessible	Cloud security posture management
Human error	Mass email with recipients in To/CC instead of BCC	DLP tools, email controls
Lost or stolen devices	Unencrypted laptop with customer data	Full-disk encryption, MDM
Third-party vendor compromise	Processor suffers breach affecting your data	Vendor due diligence, contractual safeguards

Data Intermediaries: Special Obligations

If your organisation is a data intermediary (processing personal data on behalf of another organisation under a contract), you have a direct statutory obligation to notify the organisation you are processing data for, without undue delay, once you become aware of a breach. The primary organisation then determines whether to notify PDPC. Your contract should clearly set out breach notification procedures, timelines, and cooperation obligations.

Penalties for Non-Compliance

Since the Personal Data Protection (Amendment) Act 2020 came into force, financial penalties have increased significantly:

• Up to S$1 million for organisations with annual turnover of S$10 million or less in Singapore
• Up to 10% of annual turnover in Singapore for larger organisations
• Separate directions may require organisations to stop collecting data, destroy data, or implement specific measures

PDPC also publishes enforcement decisions publicly, which can cause significant reputational damage beyond the financial penalty.

Preparing Before a Breach Happens

The best time to prepare for breach notification is before any incident. Organisations in Singapore should have in place:

1. A Documented Data Breach Management Plan

Your plan should define roles, escalation paths, decision-makers, external counsel and forensic contacts, communication templates, and the assessment framework for notifiability.

2. An Appointed Data Protection Officer

Every organisation in Singapore must appoint a DPO and register their contact details with ACRA. The DPO leads breach response and liaises with PDPC.

3. Technical and Organisational Safeguards

Implement reasonable security arrangements: encryption at rest and in transit, access controls based on least privilege, multi-factor authentication, regular patching, endpoint protection, network segmentation, encrypted DNS resolvers, logging and monitoring, and secure backups. For any customer-facing links your organisation shares—such as marketing campaigns, support tickets, or document delivery—use a reputable link management service like Lunyb that provides HTTPS, link expiry, and access analytics so you can quickly identify suspicious traffic patterns. You can read our honest review of Lunyb and compare it against other options in our 2026 buyer's guide.

4. Regular Training and Drills

Run tabletop exercises simulating ransomware, phishing, and insider incidents at least annually. Staff awareness remains the single biggest factor in preventing breaches.

5. Vendor Management

Audit your data processors. Ensure contracts include PDPA-compliant breach notification clauses, security requirements, audit rights, and cooperation obligations.

What PDPC Looks for in a Good Response

PDPC's enforcement decisions consistently show that organisations receive lighter penalties—or warnings in place of fines—when they:

1. Discover and contain the breach quickly
2. Notify PDPC voluntarily and within the required timeframes
3. Cooperate fully with investigations
4. Notify affected individuals promptly with useful information
5. Implement meaningful remedial measures
6. Demonstrate pre-existing security arrangements that were reasonable, even if not perfect

Conversely, aggravating factors include delayed notification, failure to appoint a DPO, inadequate security arrangements, and prior PDPA infringements.

Quick Reference Checklist

• ☐ Containment measures initiated within hours of discovery
• ☐ Internal assessment completed within 30 days
• ☐ Notifiability decision documented
• ☐ PDPC notified within 3 days of notifiability determination
• ☐ Affected individuals notified (where significant harm likely)
• ☐ Remediation plan developed and implemented
• ☐ Incident file maintained for regulatory review
• ☐ Post-incident review conducted to prevent recurrence

Frequently Asked Questions

Do I need to report a breach if the data was encrypted?

Not necessarily. If personal data was encrypted with strong cryptography and the encryption keys were not compromised, the risk of significant harm is substantially reduced and the breach may not meet the notification threshold. However, you must still assess and document this determination. If the breach affects 500 or more individuals, you may still need to notify PDPC regardless of encryption, unless you can demonstrate the data remains inaccessible.

What happens if I report late or miss the 3-day deadline?

Late notification is itself a breach of the PDPA and can attract separate financial penalties. PDPC has imposed fines on organisations specifically for delayed notification, even where the underlying breach was handled otherwise well. If you realise you are going to miss the deadline, notify as soon as possible and explain the reason for the delay in your submission.

Who in my organisation should submit the notification?

The Data Protection Officer typically submits the notification, but it should be approved by senior management given the legal and reputational implications. For regulated sectors (financial services, healthcare, telecommunications), coordinate with your sector regulator—MAS, MOH, or IMDA—as separate sectoral notification obligations may also apply.

Do I need to notify individuals if I have already notified PDPC?

Yes, if the breach is likely to result in significant harm. PDPC notification and individual notification are separate obligations. You can notify individuals at the same time as, or shortly after, PDPC. Exceptions exist where PDPC or a law enforcement agency instructs otherwise, or where remedial action has eliminated the likelihood of significant harm.

Does the PDPA apply to breaches involving data about non-Singapore residents?

The PDPA applies to the collection, use, and disclosure of personal data by organisations in Singapore, regardless of where the individuals are located. If your Singapore-based organisation suffers a breach involving personal data of individuals overseas, PDPA notification obligations still apply. You may also have obligations under foreign laws such as the EU GDPR, Malaysia's PDPA, or other regional frameworks—assess these in parallel.

Final Thoughts

Reporting a data breach to PDPC is not just a compliance checkbox—it is a structured process designed to protect affected individuals and demonstrate accountability. Singapore's regime is relatively strict but also pragmatic: organisations that respond quickly, transparently, and competently generally receive proportionate treatment. The organisations that face the heaviest penalties are those that delay, obscure, or fail to implement basic security measures. Build your breach response capability now, before you need it, and when the moment comes, you will be ready to act within the deadlines the PDPA requires.