Had a data breach? Here's what to do now.
Contain it, work out whether it's notifiable, and meet PDPC's deadlines. If you're our client, call us any time: +65 8837 6575.
Contain it first.
Before anything else, stop the damage spreading. Write down what you do and when, because PDPC may ask for it later.
- Stop the leak. Disconnect the affected computer, disable the compromised account, recall the wrong email, or take the exposed file offline.
- Change passwords on anything that may be affected, and turn on two-step login where you can.
- Tell your DPO straight away, and keep the evidence (emails, logs, screenshots). Don't delete anything.
- Start a record: what happened, when you found out, what data and roughly how many people are involved, and every step you take.
The deadlines that apply.
The PDPA's Data Breach Notification Obligation sets two time limits. Missing them can make a bad situation worse.
- You have reason to believe a breach happened. From this point, you must take reasonable and quick steps to assess it.
- Assess within 30 calendar days whether the breach is notifiable. If it takes longer, be ready to explain why.
- If it is notifiable, tell PDPC within 3 calendar days of deciding that, counting from the next day. Decide on 1 January, and the deadline is 4 January.
- Tell the affected individuals as soon as practicable, at the same time as or after notifying PDPC, unless an exception applies.
Based on PDPC's Guide on Managing and Notifying Data Breaches under the PDPA.
Two tests decide it.
| Test | What it means | What you must do |
|---|---|---|
| Significant harm | The breach is likely to cause significant harm to the people affected. Certain kinds of data are treated as causing significant harm, for example financial or health details tied to someone's name or ID number, or account login details. | Notify PDPC and the affected individuals |
| Significant scale | The breach affects 500 or more people, whatever the data. If you don't know the exact number yet but believe it's at least 500, notify and update the figure later. | Notify PDPC |
| Neither | Fewer than 500 people and no data likely to cause significant harm. | No notification needed, but keep a record of the breach and what you did |
PDPC has a self-assessment tool to help decide. When in doubt, talk to your DPO before the deadline, not after.
How to notify PDPC.
Notification is done online. For a major incident, PDPC also takes urgent calls during working hours.
- Use PDPC's online form at eservice.pdpc.gov.sg.
- Include the facts: what happened, what data, how many people, and when you found out.
- Explain what you've done to contain it and reduce harm, and how you'll tell the people affected.
- Name a contact person PDPC can reach. This is usually your DPO.
Fix the cause, not just the symptom.
PDPC's approach follows four steps: Contain, Assess, Report, Evaluate. The last step is the one most SMEs skip. Work out why it happened, fix the gap, and update your policies and staff training so it doesn't happen again.
If a vendor caused it: a data intermediary (for example your IT provider, payroll or cloud service) must tell you about a breach it finds. Your own deadlines start once you have reason to believe a breach happened, so make sure your contracts require vendors to tell you quickly.
Don't want to face this alone? Our DPO as a Service clients get 24/7 support, including help assessing a breach and filing the PDPC notification.
Questions about data breaches.
Once you've assessed that a breach is notifiable, you must notify PDPC as soon as practicable and no later than 3 calendar days after that assessment. You must complete the assessment itself within 30 calendar days of having reason to believe a breach happened.
No. A breach must be reported to PDPC if it is likely to cause significant harm to the people affected, or if it affects 500 or more people. Breaches that meet neither test don't need to be reported, but you should still record them and what you did.
If the breach is likely to cause significant harm to them, yes, as soon as practicable, at the same time as or after notifying PDPC. There are limited exceptions, which you must explain in your notification to PDPC.
A data intermediary processing data for you must notify you of a breach it detects. You remain responsible for assessing it and notifying PDPC where required, so act as soon as your vendor tells you.
You must give PDPC the reasons for the late notification and supporting evidence. Late or missing notification can count against you if PDPC investigates.
Yes. Our DPO as a Service includes 24/7 advisory support, including helping you assess whether a breach is notifiable and preparing the PDPC notification.
General guidance only, not a substitute for legal advice. Full detail at pdpc.gov.sg.
More from Core Vault.
Never handle a breach alone.
With DPO as a Service, you get a DPO on call 24/7 to help assess and report a breach. From $500 a year.