Personal Data Protection Act 2012 · 2020 Revised Edition · Part 6A · Notification of Data Breaches
26C. Duty to conduct assessment of data breach
Feedback & supportIn plain English
This section covers data breaches on or after 1 February 2021. An organisation that suspects a breach of personal data it holds must promptly assess whether the breach is notifiable. Unless an exception applies, a data intermediary must promptly report a breach to the organisation it processes data for, which must assess it.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Last amended by an amending law of 2020.
This section applies to a data breach that occurs on or after 1 February 2021.
data breach
“data breach”, in relation to personal data, means —(a)the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or(b)the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
Subject to subsection (3), where an organisation has reason to believe that a data breach affecting personal data in its possession or under its control has occurred, the organisation must conduct, in a reasonable and expeditious manner, an assessment of whether the data breach is a notifiable data breach.
organisation
“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —(a)formed or recognised under the law of Singapore; or(b)resident, or having an office or a place of business, in Singapore;
Where a data intermediary (other than a data intermediary mentioned in section 26E) has reason to believe that a data breach has occurred in relation to personal data that the data intermediary is processing on behalf of and for the purposes of another organisation —
data intermediary
“data intermediary” means an organisation which processes personal data on behalf of another organisation but does not include an employee of that other organisation;
the data intermediary must, without undue delay, notify that other organisation of the occurrence of the data breach; and
that other organisation must, upon notification by the data intermediary, conduct an assessment of whether the data breach is a notifiable data breach.
The organisation must carry out the assessment mentioned in subsection (2) or (3)(b) in accordance with any prescribed requirements.