Data breach response Singapore: the clock has started
Our data breach response team in Singapore helps you contain the breach, keep the evidence and assess it within 30 days. If it is notifiable, we prepare your notice to the Personal Data Protection Commission (PDPC) and the message to the people affected, so you report on time.
Notifiable breach? You must tell the PDPC within three calendar days.PDPC breach guide (PDF, opens in a new tab)
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Regulators“Did you assess the breach quickly enough?”The breach is assessed within 30 calendar days, as PDPC expects.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Regulators“Did you notify us on time?”Notifiable breaches are reported no later than 3 calendar days after assessment (s26D(1)).Singapore Statutes Online (PDPA), read 12 Oct 2026
- Customers“Will you tell me if my data is exposed?”Affected individuals are notified as soon as practicable, at the same time as PDPC or after it.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Management“What do we do in the first hour?”There is a Contain, Assess, Report, Evaluate (C.A.R.E.) plan with named roles.Personal Data Protection Commission (PDPC), read 12 Oct 2026
PDPA s26D(1): once a breach is assessed as notifiable, PDPC must be told no later than 3 calendar days after that assessment. Missing this deadline is a breach of the PDPA’s Data Breach Notification Obligation.
Singapore Statutes Online (PDPA), read 12 Oct 2026When a breach must be reported
Latest on this topic
Common questions
What should we do in the first hours?
Contain it, keep the evidence and start the assessment. Do not wipe systems before logs are saved. Use our 24/7 breach helpline and an adviser walks you through it.
Do we have to report every breach?
No. A breach is notifiable if significant harm to the people affected is likely, or if 500 or more people are affected. Record every breach and your assessment either way.
Can you tell the PDPC for us?
We prepare the notification with you and help answer the PDPC’s follow-up questions. The notification is made in your organisation’s name.
Latest PDPC case on this topic · 2026-09-21 · Security and facilities services · Voluntary undertaking
Service accounts with VPN access need the same protection as staff logins: stolen credentials gave attackers file-server access to staff, ex-staff and contractor data.
Read the PDPC decision of 21 September 2026, on pdpc.gov.sg (opens in a new tab)Privacy work is led by a Certified Information Privacy Manager (CIPM), issued by the IAPP.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser calls you back. For an incident happening now, use the 24/7 breach helpline.
Download a one-page brief for your management or board (PDF, 68 KB)