Data breach notification Singapore: tell the PDPC on time
If personal data may have leaked, the law starts a clock. Assess a suspected breach within 30 days. Once you decide it is notifiable, tell the Personal Data Protection Commission (PDPC) within 3 calendar days. We handle your data breach notification. Singapore’s rules also mean telling affected people where significant harm is likely.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Regulators“Does your notification contain what we need?”It covers when and how the breach was found, how it happened, the number affected, the data involved, the harm and the remedial steps.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Customers“Will the notice tell me how to protect myself?”Notices to individuals are clear and include steps they can take.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Board and shareholders“Could a slow notification make penalties worse?”PDPC says the reasons for a late notification count towards how serious the breach is and how severe the penalty is.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Management“Who signs off the notification?”At least one authorised representative is named. It need not be the DPO.Personal Data Protection Commission (PDPC), read 12 Oct 2026
PDPC states that any unreasonable delay in notifying the relevant parties will be a breach of the Data Breach Notification Obligation.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What you get
- An adviser on the line from the first call
- A written assessment: what leaked, how many people, likely harm
- The notifiable-or-not decision, with reasons on record
- PDPC notification and messages to affected people, drafted with you
- Answers to the PDPC’s follow-up questions, prepared with you
- The breach assessment record, with the date it was decided
- A copy of the notice to the PDPC and to the people affected
500 or more people affected makes a breach notifiable, even when harm seems unlikely. PDPC breach guide (PDF, opens in a new tab) .
How it works
- You
Call 6222 1000 or message us on WhatsApp as soon as you suspect a breach.
- Us
We help you contain the breach, keep evidence and assess it against the PDPC’s tests.
- Result
You notify on time, with a record that shows each decision you made.
Latest on this topic
Common questions
How do I report a data breach to the PDPC?
Through the PDPC’s online notification form, within 3 calendar days of deciding the breach is notifiable. Have the facts ready: what happened, what data, how many people, and what you have done. We prepare the notification with you.
When is a data breach notifiable?
When the breach is likely to cause significant harm to the people affected, or affects 500 or more people. You must assess a suspected breach within 30 calendar days.
Do we have to tell the people affected?
Yes, where significant harm to them is likely. Tell them as soon as practicable, at the same time as the PDPC or after it. We draft the message so it is clear and calm.
What happens if we breach the Personal Data Protection Act (PDPA)?
The PDPC can give directions or a financial penalty of up to S$1 million, or 10% of Singapore turnover for organisations above S$10 million. Across 151 published decisions with a financial penalty, the median was S$11,000. Many cases end with directions or a voluntary undertaking instead.
Latest PDPC case on this topic · 2026-08-05 · Construction, engineering and manufacturing · Voluntary undertaking
Relying on an IT vendor does not remove your responsibility: know how your servers are secured and maintained, and check the vendor is doing it.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)Privacy work is led by a Certified Information Privacy Manager (CIPM), issued by the IAPP.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)