ShareAndGoShareAndGo

Compliance

PDPA data breach notification, step by step.

Singapore organisations have a Data Breach Notification Obligation under the Personal Data Protection Act. It sets out when you must assess a breach, when you must tell the Personal Data Protection Commission, and when you must tell the people affected.

This playbook follows the PDPC's own Guide on Managing and Notifying Data Breaches under the PDPA, revised in March 2021, and quotes its timeframes directly. It is a practical outline, not legal advice. Your data protection officer and legal adviser should lead any real incident.

Get startedSee security

Before anything happens: have a plan

The PDPC's guide recommends that organisations prepare a data breach management plan before they need it. Part I of the guide sets out good practices for identifying and preparing for breaches, and Part II covers responding to them. In practice, the plan should say who leads, how they are contacted, who else is brought in, and where the record of each incident is kept.

A plan is only useful if the people in it know about it. Make sure your DPO, your senior management and your IT provider have read it, and that it is somewhere they can find it in a hurry.

The four stages the PDPC describes

  1. 1

    Contain

    Stop further compromise and take mitigating action after an initial appraisal of the extent of the breach.

  2. 2

    Assess

    Find the root cause where possible, check containment is working, and decide whether the breach is notifiable.

  3. 3

    Report

    Notify the PDPC if the breach is notifiable, and affected individuals where required.

  4. 4

    Evaluate

    Review the response and consider what can prevent a repeat.

Step 1: start the assessment, and write everything down

According to the guide, once an organisation has credible grounds to believe a data breach has occurred, whether through its own discovery, an alert from the public or notification by its data intermediary, it must take reasonable and expeditious steps to assess whether the breach is notifiable, within 30 calendar days. The guide says any unreasonable delay in assessing a breach is itself a breach of the obligation.

The guide also says the organisation must document all the steps it takes in the assessment. If you cannot finish within 30 days, it says you should be prepared to explain to the PDPC why the assessment is taking longer.

If you use a service provider that processes personal data for you, the guide explains that data intermediaries are required to notify the organisation they act for when they detect a breach. Make sure your contracts and contacts make that easy.

Step 2: apply the two tests

The guide sets out two criteria. A breach is notifiable if either applies.

Significant harm

A breach is notifiable if it is likely to result in significant harm to the affected individuals. The guide explains that the Personal Data Protection (Notification of Data Breaches) Regulations 2021 prescribe personal data, or classes of personal data, that are deemed to result in significant harm if compromised. Where a breach involves any of that prescribed data, the organisation must notify both the affected individuals and the PDPC. Read the regulations, or ask your adviser, for the list.

Significant scale

A breach is also notifiable to the PDPC if it involves the personal data of 500 or more individuals, even if none of the prescribed data is involved. If you cannot establish the exact number, the guide says you should notify the PDPC when you have reason to believe at least 500 people are affected, and update the number later.

Step 3: notify within the timeframes

Once you determine that a breach is notifiable, the guide says you must notify the PDPC as soon as practicable, and in any case no later than three calendar days. The three days start from the determination, not from when you first learned of the breach. The guide gives an example: if an organisation determines on 1 January that a breach is notifiable, it must notify the PDPC by 4 January.

Where affected individuals must be notified, the guide says to do so as soon as practicable, at the same time as or after notifying the PDPC. The PDPC's guide gives an online form for notifications and a phone number for urgent major cases during working hours.

If notification to the PDPC is late, the guide says you must give the reasons and supporting evidence, and that those reasons go toward the gravity of the contravention.

Step 4: what goes in the notification

The guide lists the information the notification to the PDPC must include. In summary:

  • The facts: when and how you became aware, how the breach occurred, how many individuals are affected, what personal data is involved and the potential harm.
  • Your handling: a chronological account of the steps taken after you became aware, including your assessment that the breach is notifiable.
  • Your actions to eliminate or mitigate harm, and to address the failure that caused the breach.
  • Your plan, if any, to inform affected individuals or the public, and how individuals can protect themselves.
  • Contact details of at least one authorised representative, who need not be the DPO.

Almost every item depends on good records. A chronological account is easy to write if every access to the affected documents was logged against a named person. It is very hard if the documents moved by email attachment.

Step 5: evaluate and improve

After the immediate response, review what happened and what you will change. The PDPC's handbook on How to Guard Against Common Types of Data Breaches is a good starting point. It identifies five common gaps from past cases, including configuration issues such as folder permissions, phishing, and weak account and password management.

How ShareAndGo helps with the record

For documents you share through ShareAndGo, the audit log records every view, upload, download, invitation and change against a named person, chained so alterations are detectable. You can export it as a spreadsheet to build the chronology the PDPC asks for. Revoking access is one click and takes effect on the person's next request.

ShareAndGo processes the documents you upload on your behalf, as a data intermediary. You remain the organisation responsible for deciding whether a breach is notifiable and for notifying. Your documents, records and files are stored in Singapore, and our privacy page lists the services that run elsewhere.

Frequently asked questions

When does the three-day clock start?
According to the PDPC's guide, from the day the organisation determines the breach is notifiable, with day one being the day after. A determination on 1 January means notifying by 4 January.
Do I have to notify if fewer than 500 people are affected?
You may still have to, if the breach is likely to result in significant harm, for example because it involves the personal data prescribed in the 2021 regulations. Ask your adviser.
Can I notify the PDPC voluntarily?
The PDPC's guide says organisations may also inform the PDPC of a breach voluntarily.

Keep reading

The first 24 hours after a document leak

What to do in the first day, hour by hour.

What a data breach costs an SME

Where the time and money actually go.

The PDPA and sharing documents

The obligations that apply when documents leave your business.