Do we have to notify PDPC about this data breach?

A staff member emailed a client list to the wrong address. A shared drive was public for a fortnight. A laptop is missing. The question is the same every time: is this something we have to report.

Singapore's data breach notification obligation has been mandatory since 1 February 2022. It has two thresholds, and either one triggers a notification to the Personal Data Protection Commission.

Threshold one: significant harm

A breach is notifiable if it is likely to result in significant harm to any affected individual. Even one person is enough. The regulations name the categories of data that are treated as meeting this threshold, and they are the ones a small company holds more often than it realises.

• Identification data combined with financial information, such as bank or card details.
• Health and medical information, including insurance and medical certificates.
• Information about a person's sex life, criminal record or the assessment of their character.
• Employment-related data such as salary, disciplinary records and performance assessments.
• Data that in combination allows someone to be impersonated or defrauded.

When this threshold is met you must notify both PDPC and the affected individuals. Notifying the individual is what allows them to protect themselves, so it is not a step you can defer while you finish investigating.

Threshold two: scale

A breach affecting 500 or more individuals must be notified to PDPC even if you assess the harm as low. At that scale the regulator wants to see it regardless. You are not required to notify each individual on scale alone, only on the significant-harm ground.

The two clocks

1. 01Assessment: from the day you have credible reason to believe a breach has occurred, you have up to 30 calendar days to assess whether it is notifiable. Take the time you need, but record what you did each day.
2. 02Notification to PDPC: once you assess the breach as notifiable, you have 3 calendar days to notify. Calendar, not working, and the count is not paused by a weekend.
3. 03Notification to individuals: on or after notifying PDPC, and as soon as practicable, where the significant-harm threshold is met.

When you do not have to notify the individual

If you have taken remedial action that makes significant harm unlikely, or if the affected data was subject to technological protection such that the breach is unlikely to result in harm, the obligation to notify the individual falls away. Encryption is the common example, and the strength of the protection is the point. You still notify PDPC if the scale threshold is met.

What to have ready before it happens

Every reviewer, insurer and enterprise customer asks for the same four artefacts. None of them takes long, and all four are far harder to produce during an actual incident.

• A one-page breach response process with named roles, including who decides that a breach is notifiable.
• A breach register, with the date of discovery, the assessment, the decision and the reasoning.
• A personal-data inventory, so you can answer "whose data was in that system" in an hour rather than a week.
• A short escalation path for staff, so the person who notices tells someone the same day.

This is a professional assessment, not legal advice and not a statutory audit. If you are inside an active incident and unsure of the threshold, document your assessment as you go and get it reviewed.