Singapore PDPA Breach Notification Playbook

Open the playbook when there are credible grounds to believe a personal data breach has occurred. The intake record should cover who discovered the incident, when it was discovered, the systems and vendors involved, whether a data intermediary reported it, and whether personal data was accessed, copied, altered, disclosed, lost, or disposed of without authorisation.

Security or incident response should contain the incident before the notification decision is final: isolate affected systems where appropriate, block further unauthorised access, preserve logs and forensic copies, and record the containment steps already taken or planned. If the organisation is a data intermediary, route the incident immediately to the organisation or public agency for which it processes the personal data.

Once the organisation has credible grounds to believe a breach occurred, the assessment clock should be visible in the incident record. The PDPA requires reasonable and expeditious assessment. PDPC guidance uses 30 calendar days as the expected assessment period, says an organisation that needs longer should be ready to explain why, and requires the assessment steps to be documented. The 30-day period is PDPC guidance for completing the assessment; the binding three-calendar-day notification period starts only after the organisation determines that the breach is notifiable.

The assessment should answer two threshold questions. First, is the breach likely to result in significant harm to affected individuals, including because prescribed personal data under the notification regulations is compromised? Second, does the breach involve the personal data of 500 or more individuals, or is there reason to believe the number is at least 500 even if the final count is not yet confirmed?

If the breach is notifiable, open the notification workstream immediately. The PDPC notice is due as soon as practicable and no later than three calendar days after the organisation determines the breach is notifiable. The first day of the three-day period starts on the day after that determination.

Affected individuals are notified where required as soon as practicable, at the same time as or after notifying the PDPC. Individual notification is not required where a statutory exception applies, including where timely remedial action makes significant harm unlikely or a technological measure makes the affected data inaccessible or unintelligible. Those exceptions concern notice to individuals; they do not cancel a required notice to the PDPC. The Commission may still direct individual notification. If the breach is likely to attract widespread public attention or interest, notify the PDPC first before affected individuals and before any public or media statement.

The playbook should produce an evidence bundle that can be read without reconstructing the incident from chat threads. Keep the bundle aligned to the PDPC notification fields, the affected-individual notice fields, and the post-breach evaluation questions.

After containment, notification, and recovery, complete a post-breach review. The review should identify the root cause, exploited weakness, missed monitoring signs, short-term and long-term containment actions, backup and recovery status, vendor responsibilities, senior-management involvement, and whether the data breach management plan or response training needs to change.