How to Report a Data Breach to PDPC Singapore: A Complete 2026 Guide

If your organisation has suffered a data breach in Singapore, you may be legally required to notify the Personal Data Protection Commission (PDPC) within strict timelines. Since the Personal Data Protection Act (PDPA) was amended in 2021, the Mandatory Data Breach Notification (MDBN) regime has made breach reporting a non-negotiable compliance obligation for all organisations handling personal data. This guide walks you through exactly how to report a data breach to PDPC Singapore, what qualifies as a notifiable breach, and how to protect your organisation from penalties of up to S$1 million.

What Is a Data Breach Under Singapore's PDPA?

A data breach under Singapore's Personal Data Protection Act refers to the unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data, or the loss of any storage medium or device containing personal data. The PDPC defines this broadly to cover both malicious attacks (such as hacking or ransomware) and accidental incidents (such as emailing data to the wrong recipient or losing an unencrypted laptop).

Common examples of data breaches in Singapore include:

• Ransomware or malware attacks compromising customer databases
• Phishing attacks resulting in credential theft
• Misconfigured cloud storage buckets exposing personal records
• Lost or stolen devices containing unencrypted personal data
• Insider misuse or unauthorised disclosure by employees
• Accidental emails containing personal data sent to wrong recipients

When Must You Report a Data Breach to PDPC?

Not every data breach must be reported to the PDPC. Under Section 26B of the PDPA, a breach is notifiable if it meets either of two thresholds: (1) it results in, or is likely to result in, significant harm to affected individuals, or (2) it affects 500 or more individuals.

The "Significant Harm" Threshold

The PDPC prescribes specific categories of personal data that are deemed likely to cause significant harm if compromised. These include:

• Full name or alias combined with NRIC, FIN, or passport numbers
• Financial information such as bank account numbers, credit card details, or CPF account information
• Health or medical information, including diagnoses and treatment records
• Information about adoption, mental health, or sexual activities
• Account credentials (usernames and passwords)

The 500-Individual Threshold

Even if the data is not inherently sensitive, you must notify PDPC if the breach affects 500 or more individuals. This is a bright-line rule — no judgement call required.

Key Timelines You Must Follow

Timing is critical when reporting a data breach to PDPC. Missing the deadlines can result in enforcement action and financial penalties. Here is the mandatory timeline under the PDPA:

Action	Deadline	Reference
Assess whether breach is notifiable	Within 30 calendar days of becoming aware	PDPA Section 26C
Notify PDPC	As soon as practicable, within 3 calendar days of assessment	PDPA Section 26D
Notify affected individuals	At the same time or after notifying PDPC (if significant harm)	PDPA Section 26D(2)
Data intermediary notifies controller	Without undue delay	PDPA Section 26C(3)

In short: you have up to 30 days to investigate and assess, then 3 days to report. In practice, PDPC expects organisations to act much faster for serious incidents.

Step-by-Step: How to Report a Data Breach to PDPC

Follow these steps carefully to ensure full compliance with the PDPA's Mandatory Data Breach Notification requirements.

Step 1: Contain the Breach Immediately

Before notification, your first duty is to stop the bleeding. Disconnect affected systems, revoke compromised credentials, isolate infected endpoints, and preserve forensic evidence. Document every action with timestamps — PDPC will ask for this during investigation.

Step 2: Assemble Your Response Team

Your Data Protection Officer (DPO) should lead the response, supported by IT security, legal counsel, communications, and senior management. If you lack in-house expertise, engage an external cybersecurity incident response firm immediately.

Step 3: Assess Whether the Breach Is Notifiable

Within 30 days, determine whether the breach meets the significant harm threshold or the 500-individual threshold. Document your assessment methodology — PDPC may later review how you reached your conclusion.

Step 4: Prepare the Notification

Gather the following information required by PDPC's notification form:

1. Organisation name, UEN, and DPO contact details
2. Date, time, and location of the breach
3. How the breach was discovered
4. Cause of the breach (hacking, human error, insider threat, etc.)
5. Types of personal data compromised
6. Approximate number of individuals affected
7. Containment and remediation measures taken
8. Steps to prevent recurrence
9. Whether affected individuals have been notified

Step 5: Submit the Notification via PDPC's Online Portal

Go to the official PDPC website (pdpc.gov.sg) and navigate to "Report a Data Breach." You will need to log in using Singpass or Corppass. Complete the online form with the information from Step 4 and submit within 3 calendar days of concluding your assessment.

Step 6: Notify Affected Individuals

If the breach is likely to cause significant harm, you must notify affected individuals at the same time as — or as soon as practicable after — notifying PDPC. The notification should be in plain language and include:

• A description of what happened
• The types of data involved
• Potential consequences for the individual
• Steps the individual can take to protect themselves (e.g., changing passwords, monitoring bank statements)
• Contact details for follow-up questions

Step 7: Cooperate With PDPC's Follow-Up

After submission, PDPC may request additional information, conduct interviews, or launch a formal investigation. Respond promptly and transparently. Organisations that cooperate and demonstrate proactive remediation often receive more lenient enforcement outcomes.

Exceptions: When You Don't Have to Notify Individuals

The PDPA recognises two key exceptions to individual notification (though PDPC notification is still required):

• Remedial action taken: If you have taken action that renders it unlikely the breach will cause significant harm (e.g., the data was encrypted and the keys remain secure)
• Technological protection: If technological measures were applied before the breach that make the data unintelligible to unauthorised parties

Additionally, you may delay notification to individuals if law enforcement advises that notification would compromise an ongoing investigation, or if PDPC itself waives the requirement.

Penalties for Non-Compliance

Failure to report a notifiable data breach to PDPC is a serious offence under the PDPA. Penalties include:

Violation	Maximum Penalty
Failure to notify PDPC of a notifiable breach	S$1 million financial penalty
Failure to notify affected individuals	S$1 million financial penalty
Organisations with annual turnover above S$10 million	Up to 10% of annual turnover in Singapore
Obstructing a PDPC investigation	Fine and/or imprisonment

Beyond financial penalties, enforcement decisions are published on the PDPC website, creating significant reputational damage.

How to Prevent Future Data Breaches

Reporting a breach is a legal duty, but preventing one is a business imperative. Here are the most effective controls Singapore organisations should implement:

1. Encrypt Personal Data at Rest and in Transit

Encryption is one of the few measures that can legally reduce the harm classification of a breach. Use AES-256 for storage and TLS 1.3 for transmission.

2. Implement Strong Access Controls

Adopt the principle of least privilege, enforce multi-factor authentication (MFA), and regularly review access logs. Most breaches in Singapore trace back to compromised credentials.

3. Protect the Links You Share

Links shared externally — in marketing emails, invoices, or customer portals — can expose metadata, referrer data, and even redirect patterns that aid attackers. Using a privacy-first link management platform like Lunyb helps your team maintain control over outbound links, apply expiry dates on sensitive documents, and avoid leaking tracking data to third parties. If you want to verify Lunyb's credentials before adopting it, read our honest review of Lunyb for 2026.

4. Train Your Staff Regularly

Human error remains the leading cause of breaches in Singapore. Conduct quarterly phishing simulations and PDPA refresher training for all staff who handle personal data.

5. Appoint and Empower a Data Protection Officer

Every organisation in Singapore is legally required to designate at least one DPO. Ensure this person has the authority, budget, and seniority to actually influence practices — not just a title.

6. Maintain an Incident Response Plan

Document your breach response procedure, run tabletop exercises twice a year, and keep contact details for PDPC, CSA (Cyber Security Agency), and your legal counsel readily accessible.

What Happens After You Notify PDPC?

Once your notification is received, PDPC typically takes one of three paths:

1. Acknowledgement only: For minor breaches with good remediation, PDPC may simply acknowledge and close the file.
2. Request for further information: PDPC may ask follow-up questions to clarify the incident scope and your response.
3. Formal investigation: For serious breaches or systemic issues, PDPC opens a formal investigation that may result in directions, undertakings, or financial penalties.

Throughout the process, transparency and proactive cooperation are your best allies.

FAQ: Reporting a Data Breach to PDPC Singapore

How long do I have to report a data breach to PDPC?

You have up to 30 calendar days to assess whether the breach is notifiable, and once you conclude it is, you must notify PDPC as soon as practicable and no later than 3 calendar days thereafter. For high-severity incidents, PDPC expects notification much sooner.

Do I need to report every data breach to PDPC?

No. You only need to report breaches that (a) are likely to cause significant harm to affected individuals, or (b) affect 500 or more individuals. However, you should still internally document every breach, regardless of size, in case PDPC requests records later.

What if the breach happened at my overseas data processor?

If you are the data controller and the breach involves personal data you collected in Singapore, you remain responsible for notifying PDPC — even if the breach occurred at an overseas vendor. Your contracts with data intermediaries should require them to notify you without undue delay.

Can I be fined even if I notified PDPC on time?

Yes. Timely notification demonstrates good faith, but PDPC can still impose financial penalties if the breach resulted from inadequate security measures or systemic PDPA non-compliance. That said, cooperative organisations typically receive more lenient outcomes than those that delay or conceal incidents.

Where exactly do I submit the notification?

Submit the notification through the PDPC's online portal at pdpc.gov.sg, under the "Report a Data Breach" section. You will need to authenticate using Singpass or Corppass. Keep a copy of your submission confirmation for your records.

Final Thoughts

Singapore's Mandatory Data Breach Notification regime is one of the most clearly defined in Asia, but compliance still catches many organisations off guard. The combination of a 30-day assessment window, 3-day notification deadline, and S$1 million penalty exposure means every organisation handling personal data needs a documented, rehearsed response plan — not just good intentions.

If you take one action today, let it be this: review your incident response plan, confirm your DPO's contact details are current with PDPC, and make sure every staff member knows exactly who to call when something goes wrong. The organisations that handle breaches well are never the ones scrambling for a playbook at 2am — they are the ones who prepared months in advance.