Singapore PDPA Breach Notification Thresholds

The Singapore PDPA breach notification threshold is not a single headcount rule. A breach can be notifiable because it is likely to result in significant harm to affected individuals, or because it is of significant scale.

Significant scale is the clearer numeric threshold: the Personal Data Protection (Notification of Data Breaches) Regulations 2021 prescribe 500 affected individuals. PDPC guidance states that an organisation should notify the Commission when it has reason to believe the affected count is at least 500, even if the actual count is still being established.

The 500-individual test does not supersede the significant harm test. A smaller breach can still be notifiable if the compromised personal data falls within the prescribed significant-harm categories or otherwise presents significant harm.

Start with the data involved, not the incident label. The Regulations deem significant harm where the breach involves an individual's full name, alias, or identification number together with prescribed personal data classes in the Schedule, subject to the Schedule's limits.

The Regulations also deem significant harm where the breach involves all required account-access elements: an account identifier, such as an account name or number, and a password, security code, access code, response to a security question, biometric data, or other data required to access or use the account.

PDPC guidance describes significant harm broadly, including physical, psychological, emotional, economic, financial, reputational, and other harms that a reasonable person would identify as possible outcomes of the breach.

PDPC guidance expects organisations with credible grounds to believe a breach occurred to take reasonable and expeditious steps to assess whether it is notifiable, generally within 30 calendar days. The organisation must document all steps taken in the assessment.

The assessment record should be complete enough to support the final notification or non-notification decision. For a notifiable breach, the Regulations require a chronological account of steps taken after awareness of the breach, including the organisation's assessment that the breach is notifiable.

If a data intermediary discovers a breach while processing personal data for another organisation or public agency, the intermediary should be treated as a source of the incident alert and the controller organisation still needs the threshold assessment record.

The Commission notification clock starts after the organisation determines that the breach is notifiable. PDPC guidance states that the Commission must be notified as soon as practicable and no later than three calendar days after that determination.

The first day of the three-day period starts on the day after the organisation makes the notifiable-breach determination. PDPC's example says a breach determined notifiable on 1 January must be notified to the Commission by 4 January.

Affected individuals, where notification is required, must be notified as soon as practicable, at the same time as or after notifying the Commission. PDPC also says that breaches likely to attract widespread public attention or interest should be notified to the Commission before affected individuals or public/media statements.