BREACH NOTIFICATION UNDER PDPA

Question 1

What are the breach notification requirements in Singapore?

Answer 1

Mandatory requirement since 2021. Notifying affected individuals immediately if sensitive personal data is involved. PDPC should be notified ASAP for breaches that might cause public concern or where there is a risk of harm to a group of affected individuals.

Question 2

What constitutes a data breach under the PDPA?

Answer 2

Unauthorized access - collection - use - disclosure - copying - modification - disposal - or similar risks involving personal data.

Question 3

When must organizations notify the PDPC and affected individuals about a data breach?

Answer 3

Notify the PDPC as soon as practicable but no later than 72 hours after becoming aware of the breach. Notify affected individuals as soon as practicable after determining that the breach meets the criteria for notification.

Question 4

What should the breach notification include?

Answer 4

Nature and extent of the breach - Types of personal data involved - Measures taken or to be taken to address the breach - Advice for affected individuals on what they can do to protect themselves

Question 5

What are some exceptions to the notification requirement?

Answer 5

If the organization has taken measures to prevent misuse of the compromised data (e.g. - encryption) - notification may not be required. - If subsequent measures have been taken to mitigate the risk of significant harm - notification to affected individuals may be deemed unnecessary.

Question 6

What must organizations maintain regarding data breaches?

Answer 6

A record of all data breaches - regardless of whether they meet the criteria for notification - should be available for inspection by the PDPC upon request.