SingaporeMust a data breach be notified to the PDPC?
Yes, organisations in Singapore must notify the PDPC of a data breach that poses a risk of significant harm to affected individuals or is likely to materially affect the public interest.
What the Law Says
The Personal Data Protection Act 2012 (PDPA) imposes a mandatory data breach notification obligation on organisations in Singapore.
Section 26D of the PDPA requires an organisation to notify the Personal Data Protection Commission (PDPC) as soon as practicable — and in any event within 3 calendar days — after becoming aware that a data breach has occurred and meets either of two conditions: (1) it poses a risk of significant harm to affected individuals, or (2) it is likely to materially affect the public interest.
This duty applies to all organisations covered by the PDPA, including businesses, non-profits, and government agencies handling personal data in Singapore. The notification must include prescribed details such as the nature of the breach, categories and volume of personal data involved, and remedial measures taken.
Statutory TextAn organisation must notify the Commission of a data breach as soon as practicable, and in any event within 3 calendar days after the organisation becomes aware that the data breach has occurred and that the data breach is one that is required to be notified under subsection (2).
— Personal Data Protection Act 2012, s. 26D — Notification of data breaches
What to Do
Assess whether the breach poses a risk of significant harm to individuals or materially affects the public interest.
If yes, prepare a notification with required details (e.g., nature of breach, data types affected, mitigation steps).
Submit the notification to the PDPC via the Breach Notification Portal within 3 calendar days of becoming aware.
Notify affected individuals if the breach is likely to result in significant harm to them (separate obligation under s. 26E).
Sources
Same Question, Other Jurisdictions
Canada
Australia
Ireland
European Union
India
South Korea
UK
US-California
US-New York
JapanNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.