The Answer in 60 Seconds

Section 26D of the Personal Data Protection Act 2012 (Singapore) requires organisations to notify the Personal Data Protection Commission (PDPC) of a notifiable data breach as soon as practicable, but in any case no later than 3 calendar days after determining that the breach is notifiable. A breach is notifiable if it (a) results in or is likely to result in significant harm to affected individuals, or (b) affects 500 or more individuals. Penalties for breach of PDPA obligations are up to 10% of annual Singapore turnover (for organisations with turnover above S$10 million) or S$1 million, whichever is higher - effective 1 October 2022. Affected individuals must also be notified where significant harm is likely.

The Sourced Detail

The mandatory data breach notification regime is one of the highest-stakes ongoing compliance obligations for any Singapore SME handling personal data. The 3-day clock is short, the penalty exposure is high, and the trigger criteria require interpretation. Understanding exactly what the law requires - not what a vendor's marketing email summarises - is essential.

What Section 26D actually says

Per Section 26D(1) of the PDPA:

"Where an organisation assesses, in accordance with section 26C, that a data breach is a notifiable data breach, the organisation must notify the Commission as soon as is practicable, but in any case no later than 3 calendar days after the day the organisation makes that assessment."

Per Section 26D(2): where the breach is notifiable because it results in, or is likely to result in, significant harm, the organisation must also notify each affected individual in any manner that is reasonable in the circumstances, on or after notifying the Commission. Sections 26D(5) to (7) set out when this does not apply: action taken after the assessment, or a technological measure in place before the breach, makes significant harm to the individual unlikely; a prescribed law enforcement agency instructs, or the PDPC directs, the organisation not to notify; or the PDPC waives the requirement on the organisation's written application.

Section 26B - what counts as a "notifiable data breach"

Per Section 26B of the PDPA, a data breach is notifiable if it:

(a) results in, or is likely to result in, significant harm to an affected individual; or (b) is, or is likely to be, of a significant scale (defined under the regulations as affecting 500 or more individuals).

Significant harm is further defined by reference to the Personal Data Protection (Notification of Data Breaches) Regulations 2021, under which a breach is deemed to result in significant harm if it involves an individual's full name, alias or identification number (such as an NRIC or passport number) together with any of the personal data listed in Part 1 of the Schedule, or an account identifier together with the password or other data used to access that account. Examples include:

  • A credit, charge or debit card number, or a bank account number
  • Account identifier (with password / security code / access code) of any account
  • Account identifier (with biometric data) of any account
  • Specified health information, such as the diagnosis or treatment of HIV, sexually transmitted diseases, schizophrenia or substance abuse, and claims under life or accident and health policies
  • Specified financial information (pay and income, net worth, deposits and withdrawals, loans, debts and creditworthiness)
  • Information about adoption matters
  • Information that identifies a woman or girl in respect of whom a specified sexual offence is alleged, including through details of witnesses or evidence in the court proceedings
  • Specified information about minors

If a breach involves any of these, in one of the combinations described above, for even one individual, it is deemed to cause significant harm and is notifiable on the "harm" limb regardless of the number affected.

The 3-day clock - when it starts

The clock starts on the day the organisation makes the assessment that the breach is notifiable, not on the day the breach is discovered.

Section 26C requires the assessment to be conducted "in a reasonable and expeditious manner", and the PDPC's Advisory Guidelines on Key Concepts in the PDPA say organisations should generally complete it within 30 calendar days.

So the timeline is:

  1. Day 0 - Discovery. Breach is discovered.
  2. Day 0 to ~Day 30 - Assessment under Section 26C. Organisation investigates whether the breach meets either notifiable threshold. Assessment must be expeditious.
  3. Day X - Determination. Organisation determines breach is notifiable.
  4. Day X+3 - PDPC notification deadline. Must be filed within 3 calendar days of the determination.

The PDPC's Guide on Managing and Notifying Data Breaches provides illustrative examples. From the Guide footnotes: "if an organisation determines on 1st January that a data breach is notifiable, it must notify the Commission by 4th January." The first day of the 3-day period starts the day after the determination.

Critical: the assessment cannot be deliberately stretched to delay notification. The PDPC's guidelines say assessments should be done expeditiously because the likelihood of significant harm may increase with time, and that any unreasonable delay in assessing a breach is itself a breach of the notification obligation, on which the PDPC can take enforcement action.

What must be in the notification

Regulation 5 of the Notification of Data Breaches Regulations 2021 sets what the notification must contain, and the declaration on the PDPC's data breach notification form confirms the notification includes it. Together they cover:

  • Organisation details (name, address, contact)
  • Description of the breach and how it occurred
  • Date of the breach (the form allows an estimate)
  • Date the breach was discovered
  • A chronological account of the steps taken after becoming aware of the breach, including the assessment that it is notifiable
  • Number of affected individuals (or estimate)
  • Categories of personal data involved
  • Cause of the breach (technical, human error, malicious act)
  • Containment and remediation steps already taken
  • Steps planned to prevent recurrence
  • Risk of harm assessment
  • Whether and how affected individuals have been notified

Notifying affected individuals - the second clock

Per Section 26D(2), affected individuals must be notified on or after notifying the Commission, and the PDPC's guidelines say this should be "as soon as practicable, at the same time or after notifying the Commission". This does not apply where:

  • The breach is unlikely to result in significant harm to that individual, or
  • The PDPC has directed the organisation not to notify, or
  • Remedial action has been taken that makes significant harm to that individual unlikely, or
  • A technological measure the organisation put in place before the breach makes significant harm to that individual unlikely, or
  • A prescribed law enforcement agency has instructed the organisation not to notify, or
  • The PDPC has waived the requirement on the organisation's written application.

There is no fixed calendar deadline for individual notification - but the PDPC's "as soon as practicable" implies prompt action.

The notification to individuals must contain:

  • A description of the breach
  • The personal data affected
  • The potential harm to the individual
  • Steps taken or to be taken to address the breach
  • Steps individuals can take to mitigate potential harm
  • Contact details for further enquiries

Penalties for breach

Per Section 48J of the PDPA, the maximum financial penalty the PDPC may impose is:

  • For organisations with annual turnover in Singapore exceeding S$10 million: up to 10% of annual turnover in Singapore
  • For other organisations: up to S$1 million

Whichever is higher applies. The 10% turnover penalty is significantly higher than the previous S$1 million ceiling and was introduced effective 1 October 2022.

The PDPC has imposed financial penalties for failures to protect personal data, and its guidance says any unreasonable delay in notifying is a breach of the notification obligation. Recent enforcement decisions are published at pdpc.gov.sg/enforcement-decisions.

Section 26C - the assessment obligation

Section 26C requires organisations to "conduct, in a reasonable and expeditious manner, an assessment of whether a data breach is a notifiable data breach." Neither section 26C nor the Regulations list what the assessment must cover. The PDPC's Guide on Managing and Notifying Data Breaches suggests considering factors such as:

  • The nature of the personal data affected
  • The harm likely to result
  • The steps that can be taken to reduce harm
  • The number of affected individuals

This is not a check-the-box exercise. Organisations should document the assessment process, the facts considered, and the reasoning leading to the notifiable/non-notifiable determination. PDPC may request the assessment record in any subsequent enforcement.

Cyber insurance interaction

A cyber insurance policy typically covers:

  • Breach response costs (forensics, legal, PR)
  • Regulatory investigation defence costs (sometimes including PDPC investigation)
  • Notification and credit monitoring costs
  • Third-party liability for affected individuals
  • Business interruption from cyber events
  • Sometimes: regulatory fines and penalties (subject to insurability under Singapore law and policy wording)

Cyber policies typically have panel forensics, panel legal, panel breach counsel - meaning the insurer will direct you to specific service providers when an incident occurs. Engaging your own forensics or lawyers without insurer authorisation often means the insurer will not reimburse.

The PDPC notification itself is the organisation's obligation, not the insurer's - but the breach counsel typically helps draft the notification.

Common Mistakes / What Goes Wrong

  1. Thinking the 3-day clock starts from breach discovery. It starts from the day of the determination that the breach is notifiable. But the assessment must be expeditious - you cannot delay determining to delay notifying.
  2. Treating the 500-individual threshold as the only trigger. Even a breach affecting one individual is notifiable if that one individual's personal data falls within the "significant harm" categories (such as a name or NRIC number held together with card or bank account numbers, specified medical conditions or life or health insurance claim details, or an account log-in with its password).
  3. Notifying PDPC without notifying affected individuals. Section 26D(2) is a separate obligation. Failing to notify individuals is a separate breach.
  4. Relying on the cyber insurer to file the notification. The legal obligation is on the organisation, not the insurer.
  5. Not documenting the Section 26C assessment. PDPC may request the record in any subsequent investigation. An undocumented assessment is hard to defend.
  6. Notifying late "to be sure" of the scope. Late is worse than provisional. PDPC accepts initial notifications with available information; updates are normal.

What This Means for Your Business

The PDPA breach notification regime is binary at the moment of breach. Either you have an incident response plan that works, or you don't. The plan needs to address:

  1. Detection - how do you know a breach has occurred? Logging, monitoring, vendor reporting requirements, employee reporting channels.

  2. Assessment - who runs the Section 26C analysis, and to what timeline? Assign accountability. The Data Protection Officer (DPO), whom section 11(3) of the PDPA requires an organisation to designate, or senior management.

  3. Notification - who files with PDPC, and who notifies individuals? Pre-draft templates. Pre-identify affected-individual contact channels.

  4. Cyber insurance integration - is the insurer's incident hotline saved offline (not on systems that may be encrypted)? Engage panel forensics within the insurer's notification window.

  5. Tabletop exercise - has the team rehearsed? The PDPC's Guide on Managing and Notifying Data Breaches says periodic exercises or walkthroughs should be conducted so that key people in the data breach management plan are familiar with their roles.

The 3-day clock means the response cannot be invented during a crisis. It has to be drawn down from a plan that already exists, supported by an insurance policy that is already in force, with vendors already on retainer.

Questions to Ask Your Adviser

  1. Does my Cyber policy cover PDPC notification costs and regulatory investigation defence costs?
  2. Who is on the insurer's panel for forensics, legal, and breach counsel - and is the panel acceptable to me before I have an incident?
  3. Are regulatory fines and penalties (subject to insurability) covered or excluded?
  4. What does the policy require for notifying the insurer of an incident, and within what time?
  5. Does the policy cover third-party claims from affected individuals, and what are the sub-limits?

Related Information

Published 4 May 2026. Source verified 4 May 2026.