Guide · Buying things · 3 min read
Your personal data and a data breach
What counts as a data breach, when an organisation must report it, and your right to see and correct your data.
In plain English · by laws.sg · not legal advice· Law as at 29 Sep 2026
On this page · 6 parts
The short answer
For a data breach on or after 1 February 2021, an organisation that has reason to believe the breach affected personal data in its possession or under its control must, subject to the rules for data intermediaries, assess whether it is a notifiable data breach, in a reasonable and expeditious manner and in line with any prescribed requirements.
Personal Data Protection Act s 26C
If the organisation assesses, in accordance with the Act, that the breach is notifiable, it must notify the Commission as soon as is practicable, and in any case no later than 3 calendar days after the day it made that assessment.
What counts as a data breach
Under the Act, a data breach means either of these:
the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data
the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur
When it must be reported
Subject to the exception below, a data breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or if it is, or is likely to be, of a significant scale.
Personal Data Protection Act s 26B(1)
The Act makes an exception:
Despite subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.
Who must be told
Once a breach is assessed as notifiable, the organisation must notify the Commission as soon as is practicable, and in any case no later than 3 calendar days after the day it assesses, in accordance with the Act, that the breach is notifiable.
Personal Data Protection Act s 26D(1)
On or after notifying the Commission, and subject to the exceptions in the section, it must also notify each individual affected by a notifiable data breach mentioned in section 26B(1)(a), in any manner that is reasonable in the circumstances.
Personal Data Protection Act s 26D(2)
Those are breaches that result in, or are likely to result in, significant harm to an affected individual.
Personal Data Protection Act s 26B(1)
It does not have to notify an affected individual if, after assessing the breach as notifiable and in line with any prescribed requirements, it takes action that makes significant harm to that individual unlikely.
Seeing and correcting your data
Subject to exceptions in the Act, you can ask an organisation for the personal data about you that it has or controls, and for how the organisation has used or disclosed that data in the year before your request.
Personal Data Protection Act s 21(1)
You can also ask it to correct an error or omission in that data.
Financial penalties
Except for a contravention that is an offence under the Act, if the Commission is satisfied that an organisation has intentionally or negligently contravened a provision of Part 3, 4, 5, 6, 6A or 6B, it can require the organisation, by written notice, to pay a financial penalty. The maximum penalty is to be prescribed, but the Act caps it. For a contravention after section 24 of the Personal Data Protection (Amendment) Act 2020 came into force, by an organisation whose annual turnover in Singapore is more than $10 million, the cap is 10% of that turnover. In any other case, the cap is $1 million.
Laws in this guide
Ask about your situation
Tell us what is going on and we will answer from the law this guide relies on.