PDPA Data Breach Notification: The 3-Day Rule Explained

What counts as a data breach

A data breach is any unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data, or the loss of a device or storage medium holding personal data where that is likely to happen. Annex A of the PDPC's guide on managing and notifying data breaches lists common causes. For a small business the usual ones are:

• a hacked email account, where the attacker could read customer emails and attachments;
• an email or spreadsheet with customer details sent to the wrong person;
• a lost or stolen laptop or phone that wasn't encrypted;
• ransomware that encrypted or copied files containing personal data;
• a website form, booking tool or cloud folder left open to the public;
• a supplier (a data intermediary) who processes data for you and suffers a breach.

Not every breach is notifiable, but every breach needs to be assessed and the assessment documented.

When a breach is notifiable: the two tests

The PDPC describes significant harm broadly: physical, psychological, emotional, economic and financial harm, harm to reputation, and other harms a reasonable person would identify. If you can't work out exactly how many people are affected, the PDPC's guide says to notify when you have reason to believe the number is at least 500.

The PDPC also offers a free self-assessment tool to help you decide whether your breach is notifiable.

The timeline: 30 days to assess, 3 days to notify

The 3 days are calendar days, so weekends and public holidays count. The clock starts when you decide the breach is notifiable, not when it happened, but you can't stretch the assessment to delay it.

Data intermediaries (for example, an IT vendor or a payroll provider processing data for you) must tell you when they detect a breach. Your contracts with them should say how quickly.

What to do in the first 72 hours: C.A.R.E.

The PDPC's guide organises the response into four steps: Contain, Assess, Report and Evaluate.

1. Contain: stop the leak. Reset passwords and sign out sessions on a hacked account, remove public access to an exposed folder, recall a misdirected email and ask the recipient to delete it, or remotely lock a lost device.
2. Record the basics for the initial appraisal: the cause and whether it is still ongoing, the number of people affected, the types of personal data, the systems involved, and what you have done so far.
3. Assess: work out whether it meets either notification test, and keep notes of how you decided.
4. Report: if notifiable, submit the PDPC notification within 3 calendar days of that decision, then notify affected individuals if significant harm is likely.
5. Tell others where relevant: the police for criminal acts such as hacking or ransomware, your bank, your insurer, and any sectoral regulator such as MAS or MOH.
6. Evaluate: once it's over, review what went wrong and fix it, from policies and training to the suppliers involved.

If the breach started with a hacked mailbox, our guide to what to do when business email is hacked covers the containment steps in detail.

Telling affected individuals

The PDPC's guide says notification to individuals should be clear and easy to understand, so people can protect themselves, for example by changing passwords, cancelling a card or watching their accounts. A good notice covers:

• what happened and when, in plain language;
• what personal data was involved;
• what you have done to contain it and reduce harm;
• what they can do to protect themselves;
• who to contact for questions (your data protection officer).

Send it through a channel you know reaches them (email, SMS or letter), and never include links that could be confused with phishing. Criminals often follow a public breach with fake "breach notification" emails.

Getting ready before anything happens

The PDPC's guide recommends having a data breach management plan, with clear roles, a reporting line for staff, and periodic exercises or walkthroughs. For a small business, that comes down to:

• A named data protection officer whose contact details are published. See our guide to appointing a DPO.
• A one-page plan: who to call, who decides whether it's notifiable, where the PDPC form is, and the 3-day deadline written in bold.
• A simple data inventory, so you can tell quickly what personal data a hacked account or lost laptop held.
• Basic protections that make breaches less likely and less harmful: MFA on email, encrypted laptops, tested backups and least-privilege access.
• Clauses with suppliers requiring them to notify you promptly of breaches.

Do it yourself or get help?

Many small businesses can handle a minor incident, such as one misdirected email, with the PDPC's self-assessment tool and guide. For anything involving many customers, sensitive data or a cyber attack, speak to a lawyer who advises on data protection; IT Sorted is not a law firm and does not give legal advice.

We help with the preparation and the technical side. The Incident & Ransomware Response Plan (S$390) includes the PDPC breach-notification steps and 3-day timeline, playbooks and a contact sheet. The PDPA Compliance Pack (S$690) adds a data inventory, privacy policy and a breach response plan. If an email account has been taken over, Hacked Email Recovery (S$290) locks the attacker out and gives you a written timeline for your breach assessment.