Singapore PDPA Breach Notification Thresholds

The Singapore PDPA breach notification threshold is not a single headcount rule. A breach can be notifiable because it is likely to result in significant harm to affected individuals, or because it is of significant scale.

Significant scale is the clearer numeric threshold: the Personal Data Protection (Notification of Data Breaches) Regulations 2021 prescribe 500 affected individuals. PDPC guidance states that an organisation should notify the Commission when it has reason to believe the affected count is at least 500, even if the actual count is still being established.

The 500-individual test does not supersede the significant harm test. A smaller breach can still be notifiable if it results in, or is likely to result in, significant harm. Conversely, a breach affecting at least 500 individuals must be notified to the PDPC even when affected-individual notification is not required on the harm facts.

Start with the data involved, not the incident label. The Regulations deem significant harm where the breach involves an individual's full name, alias, or identification number together with prescribed personal data classes in the Schedule, subject to the Schedule's limits. For this rule, identification number includes an identity card number, passport number, another government-issued identity document number used as evidence of nationality or residence, and a foreign identification number.

The Regulations also deem significant harm where the breach involves all required account-access elements: an account identifier, such as an account name or number, and a password, security code, access code, response to a security question, biometric data, or other data required to access or use the account.

PDPC guidance describes significant harm broadly, including physical, psychological, emotional, economic, financial, reputational, and other harms that a reasonable person would identify as possible outcomes of the breach.

PDPC guidance expects organisations with credible grounds to believe a breach occurred to take reasonable and expeditious steps to assess whether it is notifiable, generally within 30 calendar days. The organisation must document all steps taken in the assessment.

The assessment record should be complete enough to support the final notification or non-notification decision. For a notifiable breach, the Regulations require a chronological account of steps taken after awareness of the breach, including the organisation's assessment that the breach is notifiable.

If a data intermediary has credible grounds to believe a breach occurred while processing personal data for another organisation or public agency, it must notify that organisation or public agency without undue delay. The engaging organisation conducts the notifiability assessment and keeps the threshold decision record.

The Commission notification clock starts after the organisation determines that the breach is notifiable. PDPC guidance states that the Commission must be notified as soon as practicable and no later than three calendar days after that determination.

The first day of the three-day period starts on the day after the organisation makes the notifiable-breach determination. PDPC's example says a breach determined notifiable on 1 January must be notified to the Commission by 4 January.

Affected individuals, where notification is required, must be notified as soon as practicable, at the same time as or after notifying the Commission. PDPC also says that breaches likely to attract widespread public attention or interest should be notified to the Commission before affected individuals or public/media statements.