Once an organisation assesses a breach as notifiable, Singapore's PDPA requires notifying the PDPC no later than three calendar days later. Here is what the clock means, what to include, and the penalty exposure.
LowerPlane serves startups in the United States, Singapore, India and worldwide.
Likely to result in significant harm to an affected individual — physical, financial, reputational, emotional.
Affects a significant number of individuals per the PDPC's guidance. Thresholds published by the PDPC apply.
A reasonable, expeditious assessment is required once the organisation becomes aware of a potential breach.
Five steps from detection to PDPC notification and recordkeeping.
What happened, when, and how it was discovered.
Personal data categories affected and approximate number of individuals.
Likely consequences for affected individuals.
Steps taken to contain, remediate, and prevent recurrence.
DPO contact information for the PDPC's follow-up.
For contraventions from 1 October 2022, PDPC financial penalties cap at:
See the incident response plan template.
SOC 2 common criteria CC7.3, CC7.4, CC7.5 and ISO 27001 Annex A.5.24–A.5.26 map directly to a PDPA-ready incident process. If those are already running, the gap to meet PDPA s26D is usually just the notification letter templates and the 3-day clock discipline.
After the organisation assesses the breach as notifiable. The PDPA requires notification to the PDPC no later than three calendar days after that assessment. The assessment itself must be conducted in a reasonable and expeditious manner once the organisation becomes aware of a potential breach.
Not always. The PDPA sets exceptions where notifying affected individuals is not required — for example, when remedial action has been taken that makes it unlikely significant harm will result, or where law-enforcement or other prescribed exceptions apply. Review the specific exceptions in PDPA s26D before relying on them.
For contraventions from 1 October 2022, the PDPC can impose financial penalties up to 10% of annual Singapore turnover for organisations with Singapore turnover above S$10 million, otherwise up to S$1 million.
The PDPC publishes guidance on the harm threshold. Common examples: financial loss, identity theft, loss of employment, loss of insurance, physical or emotional harm, or reputational damage. If a reasonable person would conclude a type of harm is likely to result, the breach is notifiable.
The 3-day clock starts after you assess the breach as notifiable, not when the incident begins. You can investigate before concluding the assessment — but the investigation itself must be reasonable and expeditious. Dragging the assessment deliberately to delay notification exposes the organisation to penalties.
Often yes. If a processor or subprocessor you engaged mishandles personal data for which you remain the controller, the PDPA holds you accountable. Your contracts should require vendors to notify you promptly so the 3-day PDPC clock stays in your control, not theirs.
The PDPA requires notifying the PDPC and affected individuals. Public announcement is not required by law for most breaches, though some scenarios (e.g. loss of contactability of affected individuals) effectively require public notice. Larger breaches often attract press coverage regardless.
The LowerPlane PDPA policy pack ships with the 3-day runbook, the PDPC notification form, and the affected-individual letter template.