PlaybookSingaporePDPA Breach Notification

Singapore PDPA Breach Notification Playbook

This playbook applies when an incident may involve unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data under Singapore's PDPA.

It turns PDPC guidance into assessment steps, notification thresholds, owner handoffs, evidence records, and cited escalation checks.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

Singapore PDPA breach response starts with fast containment, then a documented assessment of whether the incident is a notifiable data breach. A breach is notifiable when it is likely to result in to affected individuals, or when it reaches by involving the personal data of 500 or more individuals. Once the organisation determines that a breach is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days, and notify affected individuals where required as soon as practicable, at the same time as or after notifying the PDPC.

Section 1

1. Triage and contain the incident

Open the playbook when there are credible grounds to believe a has occurred. The intake record should cover who discovered the incident, when it was discovered, the systems and vendors involved, whether a data intermediary reported it, and whether personal data was accessed, copied, altered, disclosed, lost, or disposed of without authorisation.

Security or incident response should contain the incident before the notification decision is final: isolate affected systems where appropriate, block further unauthorised access, preserve logs and forensic copies, and record the containment steps already taken or planned. If the organisation is a data intermediary, route the incident immediately to the organisation or public agency for which it processes the personal data.

Incident lead: owns the live timeline, containment status, recovery blockers, and stakeholder bridge.
Security lead: preserves system events, affected-system logs, forensic copies, indicators, and containment actions.
Privacy or DPO lead: confirms whether personal data is involved and starts the PDPA notifiable-breach assessment.
Vendor owner: confirms whether a processor, platform provider, or other data intermediary has evidence needed for the assessment.
Communications lead: prepares holding lines but does not send affected-individual or public statements before the PDPC sequencing check.

Sources for this answer

Guide on Managing and Notifying Data Breaches Under the PDPA

Supports the playbook's initial containment, data intermediary handoff, evidence preservation, and incident response roles.

PDPC Self-assessment for Organisations Experiencing Data Breaches

Defines a personal data breach and confirms that organisations should assess whether a breach is notifiable before reporting.

Section 2

2. Assess whether the breach is notifiable

Once the organisation has credible grounds to believe a breach occurred, the assessment clock should be visible in the incident record. The PDPA requires reasonable and expeditious assessment. PDPC guidance uses 30 calendar days as the expected assessment period, says an organisation that needs longer should be ready to explain why, and requires the assessment steps to be documented. The 30-day period is PDPC guidance for completing the assessment; the binding three-calendar-day notification period starts only after the organisation determines that the breach is notifiable.

The assessment should answer two threshold questions. First, is the breach likely to result in to affected individuals, including because prescribed personal data under the notification regulations is compromised? Second, does the breach involve the personal data of 500 or more individuals, or is there reason to believe the number is at least 500 even if the final count is not yet confirmed?

route: document the affected data classes, the affected individual groups, the likely physical, psychological, emotional, economic, financial, reputational, or other harm, and the basis for treating the data as prescribed personal data where relevant.
route: count confirmed affected individuals and record any estimate supporting a belief that at least 500 individuals are affected.
Unclear route: use the PDPC self-assessment tool as a decision aid and record why the team did or did not notify.
Late assessment risk: if the assessment cannot be completed within 30 calendar days, keep a written explanation for the time taken or required.
Decision output: record the notifiable or not-notifiable conclusion, approving reviewer, evidence relied on, and any uncertainty that must be updated later.

Sources for this answer

Guide on Managing and Notifying Data Breaches Under the PDPA

Grounds the 30-calendar-day assessment expectation, significant-harm route, significant-scale route, and requirement to document assessment steps.

PDPC Report Your Organisation's Data Breach

Confirms that notification is legally required when a breach is likely to cause significant harm or affects a significant scale of individuals.

PDPC Self-assessment for Organisations Experiencing Data Breaches

Supports use of the PDPC self-assessment tool when determining whether a breach is notifiable.

Section 3

3. Notify the PDPC and affected individuals

If the breach is notifiable, open the notification workstream immediately. The PDPC notice is due as soon as practicable and no later than three calendar days after the organisation determines the breach is notifiable. The first day of the three-day period starts on the day after that determination.

Affected individuals are notified where required as soon as practicable, at the same time as or after notifying the PDPC. Individual notification is not required where a statutory exception applies, including where timely remedial action makes unlikely or a technological measure makes the affected data inaccessible or unintelligible. Those exceptions concern notice to individuals; they do not cancel a required notice to the PDPC. The Commission may still direct individual notification. If the breach is likely to attract widespread public attention or interest, notify the PDPC first before affected individuals and before any public or media statement.

PDPC notice packet: date and circumstances of awareness, how the breach occurred, affected-individual count, affected personal data classes, potential harm, chronology of response steps, mitigation and remediation actions, public or affected-individual communication plan, and authorised representative contact details.
Affected-individual notice packet: how the organisation became aware, the personal data classes affecting that individual, potential harm, steps already taken or planned, protective steps the individual can take, and at least one authorised contact for help.
Late-notification record: if PDPC notification is not made within three calendar days after determining the breach is notifiable, record the reasons and supporting evidence.
No-individual-notice record: if affected individuals will not be notified, record the remedial-action exception, technological-measure exception, other written-law prohibition, waiver, or other ground relied on, plus the supporting evidence, in the PDPC notification.
Other regulators: sectoral regulator or law enforcement notification does not supersede PDPA notification to the PDPC or affected individuals where the PDPA requires it.

Sources for this answer

PDPC Required to Notify the PDPC

Supports the three-calendar-day PDPC notification requirement and affected-individual sequencing.

Guide on Managing and Notifying Data Breaches Under the PDPA

Lists the information expected in PDPC notifications, affected-individual notifications, late-notification explanations, and no-individual-notice grounds.

PDPC Guidance on Notification to Affected Individuals

Supports notifying affected individuals as soon as practicable and notifying the PDPC first for breaches likely to attract widespread public attention.

PDPC Report Your Organisation's Data Breach

Provides the public PDPC reporting route for organisations that have determined a breach is notifiable.

Section 4

4. Preserve the evidence record and improve the plan

The playbook should produce an evidence bundle that can be read without reconstructing the incident from chat threads. Keep the bundle aligned to the PDPC notification fields, the affected-individual notice fields, and the post-breach evaluation questions.

After containment, notification, and recovery, complete a post-breach review. The review should identify the root cause, exploited weakness, missed monitoring signs, short-term and long-term containment actions, backup and recovery status, vendor responsibilities, senior-management involvement, and whether the data breach management plan or response training needs to change.

Minimum record: incident summary, discovery source, first-awareness date, affected systems, affected data classes, affected-individual count or estimate, harm assessment, notifiability decision, reviewer approval, PDPC notification timestamp, and affected-individual notification timestamp where applicable.
Technical evidence: system events, security alerts, affected-system logs, forensic copies, containment steps, eradication steps, patches, account disables, password resets, backup restoration, and monitoring plan.
Governance evidence: role assignments, DPO or privacy review, legal review of exceptions or restrictions, vendor or data intermediary notices, sectoral regulator checks, board or senior-management updates, and communications approvals.
Lessons learned: root cause, underlying control weakness, whether existing procedures were followed, whether audits or training missed the issue, and plan changes assigned to named owners.

Sources for this answer

Guide on Managing and Notifying Data Breaches Under the PDPA

Supports the evidence bundle, post-breach evaluation, root-cause review, and cyber incident response records.

Guide on Managing and Notifying Data Breaches Under the PDPA

Supports ongoing use of PDPC breach-management guidance to identify, prepare for, manage, and report data breaches.

Recommended next step

Turn the Singapore PDPA breach playbook into assigned work

This Singapore PDPA playbook helps create assessment tasks, owner assignments, evidence requests, notification packets, and post-breach remediation records in Sorena.

Assessment workflow

Open Assessment Autopilot for Singapore PDPA

Convert breach facts into notifiability questions, owner tasks, and evidence fields.

Explore next step

Research workflow

Review Singapore PDPA source evidence

Use Research Copilot to answer follow-up breach-notification questions with cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review assessment thresholds, notification sequencing, evidence gaps, and next actions with Sorena.

Explore next step

Primary sources

References and citations

Guide on Managing and Notifying Data Breaches Under the PDPA

pdpc.gov.sg

Referenced sections

Supports the evidence bundle, post-breach evaluation, root-cause review, and cyber incident response records.

"documented and/or preserved include"

Guide on Managing and Notifying Data Breaches Under the PDPA

pdpc.gov.sg

Referenced sections

Supports ongoing use of PDPC breach-management guidance to identify, prepare for, manage, and report data breaches.

"mandatory Data Breach Notification Obligation under the PDPA"

PDPC Guidance on Notification to Affected Individuals

pdpc.gov.sg

Referenced sections

Supports notifying affected individuals as soon as practicable and notifying the PDPC first for breaches likely to attract widespread public attention.