Mandatory data breach notification under Singapore’s Personal Data Protection Act 2012 (PDPA) takes effect today.
Key points
- Notifiable breaches must be reported to the PDPC within three calendar days.
- Affected individuals must be notified.
- Organisations must assess suspected breaches.
- Higher financial penalties were also introduced.
UK organisations handling Singaporean personal data need incident response processes for the three-day deadline. A breach is notifiable if it is likely to cause significant harm or affects 500 or more individuals. Data intermediaries processing on behalf of an organisation must notify that organisation without undue delay, so contracts with suppliers should reflect this duty.
Source: Personal Data Protection (Amendment) Act 2020 (Singapore Statutes Online)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
