Breach preparedness: data breach tabletop exercises for your leaders
A data breach tabletop exercise lets your leaders make the hard calls once in practice, before a real breach forces them. We run simulation exercises for the data breach committee, the audit committee of the board, and the chief technology or information officer (CTO or CIO). Each group finds the gaps in its part of the plan.
2,000+ hours of PDPA and information security training delivered by our trainers
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Management“Does everyone know their role in a breach?”PDPC recommends regular exercises or walkthroughs so key people know their roles.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Board and shareholders“Will our plan work under pressure?”The Cyber Security Agency says an incident response plan that has been thought through and rehearsed is key to containing an incident.Cyber Security Agency of Singapore (CSA), read 12 Oct 2026
- Regulators“Have you tested your breach response plan?”PDPC’s own checklist asks whether response plans were tested regularly.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Insurers“When was your incident response plan last reviewed?”Insurer proposal forms ask for the review dates of the incident response and continuity plans.MSIG Insurance (Singapore) Pte Ltd, read 12 Oct 2026
PDPC says any unreasonable delay in assessing a data breach is a breach of the Data Breach Notification Obligation. A team that has never rehearsed risks missing the 30-day assessment and 3-day notification deadlines.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What you get
- A realistic breach scenario built for your business and systems
- A data breach committee simulation: assess, contain, decide and record
- An audit committee session on oversight, escalation and questions to ask
- A CTO or CIO walk-through of containment, evidence and recovery
- A written list of gaps and an updated breach plan
- The exercise scenario and the decisions made
- A list of fixes to your breach plan, with owners
In 2025, an Australian court ordered a pathology group to pay A$5.8 million over a breach it was slow to assess. OAIC.
How it works
- You
Name the people who would decide, oversee and respond in a real breach.
- Us
We run each simulation, add new facts as it unfolds and note every decision.
- Result
Each group has practised its role, and your plan has fewer gaps.
Latest on this topic
Common questions
What is a breach simulation exercise?
A discussion-based rehearsal. A facilitator presents an incident in stages, and each group talks through what it would do. Nothing is switched off; the aim is to test decisions, roles and the plan.
Why include the audit committee and the CTO or CIO?
Because a breach tests more than the response team. The audit committee oversees risk and asks the hard questions; the CTO or CIO leads containment and recovery. Rehearsing each role shows where hand-offs break down.
Is there a legal deadline to meet?
Yes. Under the Personal Data Protection Act (PDPA), assess a suspected breach within 30 calendar days, and tell the Personal Data Protection Commission (PDPC) within 3 calendar days once you decide it is notifiable. Rehearsed teams make those calls faster.
How often should we run one?
At least once a year, and again after a big change such as a new system, vendor or committee member.
Latest PDPC case on this topic · 2026-08-05 · Construction, engineering and manufacturing · Voluntary undertaking
Relying on an IT vendor does not remove your responsibility: know how your servers are secured and maintained, and check the vendor is doing it.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)Training is delivered by qualified adult educators (ACLP and DACE), issued by the Institute for Adult Learning.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)