Singapore PDPA Breach thresholds

A Singapore PDPA data breach is notifiable if either threshold is met: the breach is likely to result in significant harm to affected individuals, or it affects a significant scale of individuals. PDPC guidance states that organisations do not need to report every breach, but they must assess whether the breach is notifiable.

In implementation terms, start every incident record with four facts: what personal data was affected, how the breach occurred, how many individuals are affected or likely affected, and whether the data type or circumstances create likely significant harm.

The Notification of Data Breaches Regulations deem a breach to result in significant harm when it involves specified combinations of personal data. The core statutory examples are a full name, alias, or identification number together with prescribed personal data in the Schedule, or account access data such as an account identifier together with a password, security code, access code, security-question response, biometric data, or other account-access credential.

For a working incident triage, classify the affected fields before deciding the notice path. If account access credentials or prescribed identity-linked data are involved, escalate the incident as a likely significant-harm case unless counsel or the DPO documents a supported reason otherwise.

A data breach is of significant scale when it involves the personal data of 500 or more affected individuals. PDPC guidance says the organisation must notify the Commission when a breach affects 500 or more individuals even if the breach does not involve prescribed personal data that would otherwise trigger the significant-harm test.

If the exact count is unknown, use a reasonable initial estimate. PDPC guidance says organisations should notify the Commission when they have reason to believe the affected number is at least 500 and may later update the Commission with the actual number.

Once the organisation has credible grounds to believe a data breach occurred, PDPC guidance says it must take reasonable and expeditious steps to assess whether the breach is notifiable within 30 calendar days. If the assessment cannot be completed within 30 days, the organisation should be ready to explain the time taken or required.

After the organisation determines that the breach is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days. PDPC guidance states that the three-day period starts on the day after the determination that the breach is notifiable.

PDPC guidance says organisations must notify affected individuals as soon as practicable, at the same time as or after notifying the PDPC. For breaches likely to attract widespread public attention or interest, the PDPC affected-individual guidance says to notify the PDPC first before notifying individuals or issuing a public or media statement.

The affected-individual notice should be practical rather than merely formal. The Regulations require information about how the organisation became aware of the breach, the affected personal data, potential harm, actions taken or planned, steps the individual may take to reduce harm, and business contact information for an authorised representative.

Keep evidence that proves the assessment was timely, source-linked, and based on the data actually affected. PDPC guidance says organisations must document all steps taken in assessing whether a breach is notifiable, and the Regulations require the PDPC notice to include a chronological account of steps taken after awareness of the breach.

The minimum useful record is an incident chronology, data-field inventory, affected-individual count or estimate, significant-harm analysis, significant-scale analysis, notifiability determination time, PDPC notification time, affected-individual notification plan, mitigation actions, and any late-notification explanation with supporting evidence.