StarLabs Glossary / Grants & Compliance Terms
Mandatory Data Breach Notification
The PDPA rule that says when, and how fast, you must report a personal data breach.
Mandatory data breach notification is the PDPA obligation, in force since 1 February 2021, to assess a suspected personal data breach quickly and report it if it is notifiable. A breach is notifiable if it is likely to cause significant harm or affects 500 or more people. The PDPC must be told within 3 calendar days of that finding.
Grant rules and laws change. Check the official page before you apply or act. This page is general information, not legal or financial advice.
How it works
A data breach is any unauthorised access, collection, use, disclosure, copying, change or disposal of personal data, or the loss of a device or file holding it. It covers hacking and ransomware, but also a laptop left on the MRT or a customer list emailed to the wrong address.
Once you suspect a breach, you must assess it in a reasonable and expeditious manner. PDPC’s guide expects this assessment to be done within 30 calendar days of first becoming aware of it. You are checking two tests:
| Test | Meaning | Who to notify |
|---|---|---|
| Significant harm | The breach is likely to cause significant harm to the people affected. Regulations list classes of data deemed to meet this test, and harm can be financial, physical, emotional or reputational. | PDPC and, unless an exception applies, the affected individuals |
| Significant scale | The breach involves the personal data of 500 or more individuals, even if no listed data type is involved. | PDPC |
If either test is met, the clock starts. You must notify the PDPC as soon as practicable, and no later than 3 calendar days after you determine the breach is notifiable. Where affected individuals must be told, notify them as soon as practicable, at the same time as or after you notify the PDPC. If you cannot yet count the people affected, PDPC says to notify when you have reason to believe it is at least 500. Notifications are made through PDPC’s online data breach e-service.
If you process personal data for another organisation, for example as an outsourced payroll or IT provider, you are a data intermediary. You must tell that organisation about a breach you detect, and it then handles the assessment and reporting.
PDPC’s guide suggests a four-step response: Contain the breach, Assess it, Report it where required, and Evaluate what to change so it does not happen again.
What it means for your business
Three days is short, so prepare before anything goes wrong. Write a one-page breach plan that names your DPO, who to call for IT help, and where the PDPC e-service is. Know which systems hold customer and staff data, and keep logs and backups so you can tell what was taken. Device encryption also matters: a lost laptop with full-disk encryption is a very different story from one without. StarLabs does not decide whether a breach is notifiable or give legal advice. We can help contain an incident on the IT side, such as resetting passwords, isolating infected PCs and restoring from backups, and fix the gaps afterwards.
Common questions
How long do I have to report a data breach in Singapore?
You must notify the PDPC as soon as practicable, and no later than 3 calendar days after determining the breach is notifiable. The 3 days run from that determination, not from when the breach happened.
Do I have to report every breach?
No. You must assess every suspected breach, but only report it if it is likely to cause significant harm or affects 500 or more individuals. You may still inform PDPC voluntarily.
Is a lost company laptop a data breach?
It can be, if it held personal data that could be accessed. Assess what was on it and whether it was protected, for example by encryption, then decide if it is notifiable.
Would you know what was taken if a laptop went missing today?
We set up encryption, backups and access controls before you need them.
Sources: PDPC: Guide on Managing and Notifying Data Breaches, PDPC: Report Your Organisation’s Data Breach, PDPC: Data Protection Obligations
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Grants & Compliance Terms · ← All terms · Common questions
