Singapore PDPA Breach Notification Workflow

Treat both suspected and confirmed personal data breaches as intake events. PDPC guidance says an assigned individual or group should be notified when suspected or confirmed breaches are detected, and that the data breach management team should act according to assigned roles.

If a vendor is processing personal data as a data intermediary, the workflow should capture whether it is notifying the customer organisation without undue delay. The customer organisation remains responsible for assessing notifiability and making any PDPC or individual notifications required under the PDPA.

Once the organisation has credible grounds to believe that a data breach has occurred, the workflow should require reasonable and expeditious assessment of whether the breach is notifiable under the PDPA. PDPC guidance uses 30 calendar days as the expected assessment period. An organisation that needs longer should be ready to explain the time taken, and an unreasonable delay can breach the Data Breach Notification Obligation.

The assessment record should separate two questions: whether the breach is likely to result in significant harm to affected individuals, and whether it is of significant scale.

The notification decision depends on why the breach is notifiable. A breach likely to cause significant harm requires notification to the PDPC and affected individuals unless an exception, prohibition, waiver, or other written law changes the individual-notification position. The individual-notification exceptions include timely remedial action that makes significant harm unlikely and a technological measure that makes the affected data inaccessible or unintelligible. The Commission may still direct the organisation to notify individuals. A breach that only meets the significant-scale threshold requires notification to the PDPC even if it does not involve prescribed personal data.

For affected individuals, the workflow should not release messages before confirming the PDPC sequencing. PDPC guidance says affected individuals must be notified as soon as practicable, at the same time or after notifying the PDPC. For breaches likely to attract widespread public attention or interest, PDPC says to notify PDPC first before notifying individuals or issuing public or media statements.

The workflow should produce two evidence packets: one for PDPC and one for affected individuals when individual notification is required. The PDPC packet is broader because it must explain the breach facts, the chronology after awareness, the notifiability assessment, harm mitigation, remediation, any plan to inform affected individuals or the public, and the authorised representative.

The affected-individual notice should be clear and practical. It should tell the affected person what happened, what personal data classes relating to them were affected, potential harm, what the organisation has done or will do, and what the individual can do to reduce misuse risk.

Closure should not mean only that the form was filed. PDPC guidance expects organisations to evaluate the response and consider changes that prevent similar breaches. The closeout record should connect the root cause, containment actions, notification decisions, evidence preserved, remediation owner, and follow-up controls.

Use the post-breach review to test whether the workflow itself worked: whether the breach management plan was activated quickly, whether roles and communications were clear, whether vendor responsibilities were defined, whether logs and forensic evidence were preserved, and whether containment and recovery actions were audited.