The two tests
A data breach is "notifiable" under the PDPA if it meets either test (section 26B(1)):
- The harm test. It "results in, or is likely to result in, significant harm to an affected individual".
- The scale test. It's "of a significant scale", which the regulations set at 500 or more people affected (Notification of Data Breaches Regulations 2021, regulation 4).
One exception: a breach that stays entirely inside your business, like a colleague opening a file they shouldn't have, is deemed not notifiable (section 26B(4)).
Details that count as harm automatically
You don't have to argue about harm for some details. A breach is deemed to meet the harm test when it involves a person's full name, alias or ID number together with one of the kinds of data listed in the regulations' Schedule (regulation 3(1)). The Schedule's 23 kinds include a person's income, such as wages and commission; bank, credit card and debit card numbers; loans, debts and creditworthiness; insurance cover and claims; and some medical conditions.
An account name together with its password also counts, on its own.
So a lost sheet with names and phone numbers might not be notifiable for harm, while the same sheet with each customer's monthly income on it is.
The order of steps
- Contain it first. PDPC expects businesses "to begin containment and assessment immediately after discovering a potential breach". Change the passwords, ask the wrong recipient to delete the message, and log the lost phone out of your accounts.
- Assess it "in a reasonable and expeditious manner" (section 26C(2)). PDPC says that should generally take no more than 30 calendar days, and to be ready to explain if it takes longer (Key Concepts guidelines, page 130).
- If it's notifiable, tell PDPC "as soon as is practicable, but in any case no later than 3 calendar days" after you decide it is (section 26D(1)). PDPC's page says the clock starts "from the time the organisation determines that the data breach is notifiable".
- Tell the people affected, for a breach that meets the harm test, on or after you tell PDPC (section 26D(2)). There are exceptions, such as when your fix or encryption makes harm unlikely, or when the police or PDPC tell you not to.
Underneath all of this sits the protection duty: "reasonable security arrangements" against unauthorised access and against "the loss of any storage medium or device" holding personal data (section 24).
Four everyday cases
| What happened | Notifiable? | What to think about |
|---|---|---|
| Your phone, with three years of customer chats, is lost | Possibly | How many customers are in the chats, and what's in them. 500 or more is the scale test. Names with income or bank details meet the harm test |
| You sent the parent list to the wrong WhatsApp group | Possibly | Who's in that group, and whether the list holds anything from the Schedule. Ask them to delete it, and keep the replies as proof |
| A salesperson left with the customer spreadsheet on a personal laptop | Possibly | Whether they still have it, and what's in it. This is also why a customer list shouldn't live on one person's laptop |
| A teammate opened a customer file they had no reason to | Usually no | A breach only within your business is deemed not notifiable. Tighten who can open what |
"Possibly" is honest here. The answer turns on what was in the data and how many people it covers, which is what the assessment is for.
Keep the list off one phone
The commonest small-business breach starts with customer details living in one place that can walk away: a phone, a laptop or a personal WhatsApp.
In Palby CRM, your pipelines, records, notes and deals sit in a database in Singapore, not on your phone. You share each pipeline with your team to view, use, manage or export, so a new hire can work their customers without being able to download the whole list. When someone leaves, removing them takes away their access, and the customers stay with you.
30 minutes. You choose the day and the time.
Book a walkthroughKeep reading
- Team permissions in Palby CRM
- Security in Palby CRM
Questions about PDPA data breaches
No. Only a notifiable breach gets reported, meaning one that meets the harm test or affects 500 or more people, and one that stays inside your business is deemed not notifiable.
As soon as practicable, and no later than 3 calendar days after you decide the breach is notifiable.
The Act asks for it to be reasonable and expeditious, and PDPC's guidelines put that at no more than 30 calendar days in most cases.
If the breach meets the harm test, yes. You tell them on or after telling PDPC, unless an exception applies, such as encryption that makes harm unlikely.
It can be, if it holds customers' personal data and it isn't protected. Assess what was on it and how many people it covers.
Sources
- PDPA 2012 s24, s26B, s26C and s26D (sso.agc.gov.sg/Act/PDPA2012, current version as at 2 Nov 2026), read 2 Nov 2026
- Personal Data Protection (Notification of Data Breaches) Regulations 2021, regs 3 and 4 and the Schedule (sso.agc.gov.sg/SL/PDPA2012-S64-2021), read 2 Nov 2026
- PDPC Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, page 130, read 2 Nov 2026
- PDPC "Report your organisation's data breach" page (published 22 Apr 2026), read 2 Nov 2026