SingaporePersonal Data Protection Act, data breach notification
Personal Data Protection Act 2012, Part 6A, ss.26A-26E, as added by Act 40 of 2020
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- none
What it requires
- An app that experiences a data breach affecting an individual's personal data in Singapore must assess whether the breach is likely to cause significant harm or is of significant scale, and if so must notify the PDPC as soon as practicable and in any case within 3 calendar days of that assessment, and must also notify each affected individual unless a statutory exception applies.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commission of Singapore (PDPC) (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/other-guides/guide-on-managing-and-notifying-data-breaches-under-the-pdpa-15-mar-2021.pdf
- Guidance body
- Personal Data Protection Commission of Singapore (PDPC)
- Open questions
- What shows that an organisation has taken "reasonable and expeditious steps" to assess whether a suspected data breach is notifiable when the assessment runs past 30 calendar days?
What it makes you log
Logging duty
Section 26C requires an organisation that has reason to believe a breach occurred to assess, reasonably and expeditiously, whether it is notifiable, and section 26D requires notice to the Commission within 3 calendar days of that assessment and to affected individuals. Neither section names a record of the assessment: section 26C(4) leaves the manner of the assessment to prescribed requirements in subsidiary legislation that this row does not cite, so any documentation duty there is outside this row. A duty to notify without a duty to keep a record is not a log.
- Kind
- None
- As of
What this law does
Part 6A, added by the 2020 amendment, makes a data breach notifiable if it results in, or is likely to result in, significant harm to an affected individual, or is or is likely to be of significant scale; an internal-only breach is deemed not notifiable.
The organisation must notify the PDPC as soon as practicable, and in any case no later than 3 calendar days after assessing the breach is notifiable, and must also notify each affected individual, subject to exceptions where technological measures render significant harm unlikely or a law-enforcement agency or the PDPC directs otherwise.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .