PDPA Data Breach Notification: The 3-Day Clock Singapore SMEs Keep Missing

If personal data leaks out of your business, Singapore's Personal Data Protection Act gives you three calendar days to notify the Personal Data Protection Commission once you have assessed that the breach is notifiable, and you must notify the affected individuals as soon as practicable after that. The assessment that comes first should be done expeditiously and, per PDPC guidance, within 30 days of someone in the business becoming aware that something may have gone wrong. For a ten-person company with no legal team, the practical consequence is simple: the decision cannot wait for a meeting. It has to be written down before the year-end lull, so whoever happens to be in the office can start the clock correctly instead of forwarding the problem to someone on leave.

What counts as a notifiable data breach?

Not every mistake is notifiable. A breach has to meet one of two tests.

• Significant harm to the affected individuals. The regulations prescribe the data types presumed to cause this, including NRIC and identity numbers alongside bank account or card details, medical and health information, insurance records, and salary or CPF information.
• Significant scale, which means the breach affects 500 or more individuals, regardless of how sensitive the data is.

The realistic SME versions of this are mundane. A payroll spreadsheet sent to the wrong person on the contact list. A shared drive folder set to "anyone with the link" for a client project and never changed back. A laptop with an unencrypted customer export taken from a car. A recruitment inbox accessed by someone who left in September. Ransomware that encrypts the customer database on the office server.

Encryption matters here. If the lost data was properly encrypted and the key was not compromised, you may reasonably conclude the breach is not likely to cause significant harm. That conclusion is defensible only if you wrote down the reasoning at the time, so record it even when you decide not to notify.

How quickly do you have to tell PDPC and your customers?

Work the timeline backwards from the day someone first notices.

1. Day 0. Any staff member becomes aware of a possible breach. Containment starts the same day: revoke the access, disable the account, pull the public link.
2. Assessment, up to 30 days. Establish what data, how many people, and whether either notification test is met.
3. Within 3 calendar days of that assessment. Notify PDPC if the breach is notifiable. Calendar days, not working days, which is why a breach discovered on the Friday before a long weekend is a problem.
4. Individuals, as soon as practicable, at the same time as PDPC or after. There are narrow exceptions, such as where notifying people would hamper a police investigation or where you have already taken remedial action that makes significant harm unlikely.

The penalty ceiling is no longer symbolic. Since October 2022 the maximum financial penalty is 10% of annual turnover in Singapore, or S$1 million, whichever is higher. For a business turning over S$4 million, the theoretical exposure is the S$1 million floor. The realistic exposure for a small, well-handled, promptly notified breach is far lower, and that gap is exactly what a written procedure protects.

Who makes the call when half the team is on leave?

This is where December turns a compliance question into an operational one. The PDPA requires every organisation to appoint a data protection officer and make that person's business contact details publicly available. In most SMEs the role sits with the office manager or the owner, and there is no named deputy. If that one person is in Penang for two weeks, nobody starts the three-day clock.

Fix it with three lines on one page: who the DPO is, who acts when they are away, and the two numbers to call (your IT support and your insurer or lawyer). Pin it where the staff who would actually spot a breach can see it, which is the operations desk, not the server cupboard.

While you are there, test the restore. A ransomware event is both an availability problem and potentially a notifiable breach, and the backup you have never restored from is a backup you do not have. Restoring one real file from last week's backup takes about twenty minutes and settles the question.

How long should you keep customer and CV data?

The PDPA sets no fixed number of years. The retention limitation obligation says you must stop keeping personal data once it no longer serves the business or legal purpose you collected it for. That sounds vague until you turn it around: the regulator expects you to be able to state your retention period and show that deletion actually happens.

Three anchors give you the floors:

• Tax and accounting records. IRAS requires records supporting your returns to be kept for five years.
• Employee records. The Employment Act requires records for current employees to be kept for two years, and for one year after an employee leaves.
• Unsuccessful job applicants. Nothing obliges you to keep a CV at all. Six to twelve months is the common practice, on the basis that you may want to revisit the shortlist, and only if applicants were told that at the point of applying.

The usual SME failure is not keeping data too briefly. It is the shared inbox holding eleven years of CVs, the old quotation folder with NRIC numbers in it, and the ex-staff laptop in a drawer. Every one of those enlarges a future breach for no business benefit.

What should a small team have on paper before January?

• Named DPO, named deputy, contact details published on your website.
• A one-page breach response sheet with the 30-day and 3-day deadlines on it.
• A retention schedule: customer records, employee records, CVs, marketing lists, with a period against each.
• A dated record of the last deletion run and the last backup restore test.
• An offboarding checklist that removes email, shared drive, accounting and WhatsApp Business access on the leaving date.
• A short note of any breach you assessed and decided not to notify, with the reason.

That is an afternoon of work. It is also the difference between a contained incident and a regulatory finding that your organisation had no process at all.

Frequently asked questions

Do we have to notify PDPC if the data was recovered quickly?

If you took remedial action before any significant harm became likely, you may not need to notify the affected individuals, but the assessment and the notification to PDPC still turn on whether the breach met the harm or scale test when it happened. Document what you recovered, when, and why you concluded harm was unlikely.

Does a single customer's data count as a breach?

It can. The 500-person threshold is only one of the two tests. One record containing an NRIC number together with bank details can meet the significant harm test on its own.

We are a ten-person company. Do we really need a data protection officer?

Yes. The obligation applies regardless of headcount, and it is one of the first things a regulator or a corporate client's vendor assessment looks for. It can be an existing staff member wearing a second hat, as long as the appointment is real and the contact details are published.

This article is general information about Singapore's data protection regime, not legal advice. Confirm the specifics against current PDPC guidance or your own adviser before relying on them.