Website Data Breach Response for Singapore SMEs: PDPA Notification Basics
A website breach rarely arrives with a warning. A customer reports strange emails, a plugin turns out to be compromised, or a hosting alert shows files you never changed. What you do in the first few hours, and how clearly you record it, shapes both the damage and your obligations under Singapore's Personal Data Protection Act (PDPA).
This guide is for founders, marketing leads and IT owners who run a business website or online shop. It sets out a sensible response order and explains what the PDPC's official guidance says about assessing and notifying a data breach. It is general information, not legal advice.
Table of contents
- Executive summary
- Quick answer
- What counts as a data breach, and when it is notifiable
- The first hours: contain and preserve evidence
- Assess whether the breach is notifiable
- Notify the PDPC within three calendar days
- Notify affected individuals
- If a vendor or host handles the data
- Common mistakes to avoid
- Prepare before something happens
- Frequently asked questions
- Key takeaways
- Official sources
- Review your hosting setup
Executive summary
A website breach becomes a PDPA matter when personal data is involved. The response has three jobs: contain the incident, assess whether it is notifiable, and notify the PDPC and affected individuals where required. Doing them in order, with written records, keeps a stressful week manageable.
Quick answer
Contain the breach first, then assess whether it is notifiable. The PDPC's Guide expects that assessment within 30 calendar days. A breach is notifiable if it is likely to cause significant harm or involves the personal data of 500 or more individuals; notify the PDPC no later than three calendar days after you determine it is notifiable. Individuals must be notified as soon as practicable, at the same time as or after the PDPC, only where the breach results in, or is likely to result in, significant harm to them, unless an exception or prohibition applies.
What counts as a data breach, and when it is notifiable
Under the PDPA, a data breach means unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data. It also covers losing a storage device that holds personal data where unauthorised activity is likely. A defaced homepage can be a serious security incident without involving personal data at all.
A data breach is notifiable if it meets either of two tests:
- Significant harm. The breach results in, or is likely to result in, significant harm to the affected individuals. The Personal Data Protection (Notification of Data Breaches) Regulations 2021 prescribe certain categories of personal data that are deemed to result in significant harm. This article does not reproduce that list, so check the Regulations against the data you hold.
- Significant scale. The breach involves the personal data of 500 or more individuals. If you do not yet know the number, the Guide says to notify when you have reason to believe it is at least 500.
The two tests are alternatives. A breach affecting only 40 customers can still be notifiable if the data involved could cause significant harm to them.
The first hours: contain and preserve evidence
The PDPC's Guide describes the response in four steps: Contain, Assess, Report and Evaluate. Containment comes first because every extra hour of access can widen the breach. The steps below are practical good practice for a website, not PDPA requirements.
- Limit access. Work with your host or developer to restrict or isolate the affected systems and the compromised access paths, such as by blocking the entry point. A maintenance page can keep visitors out meanwhile, but it does not stop someone who already has access. From a trusted device, change passwords and revoke API keys, FTP or SFTP credentials and active admin sessions, starting with accounts that can reach customer data.
- Preserve evidence. Before cleaning up, copy the server logs, the affected files and a database snapshot. Overwriting them can make it impossible to know what was taken.
- Find the way in. Common routes include an outdated plugin, a reused admin password or an exposed backup file. Restoring a backup without closing the entry point invites a repeat.
- Restore from a clean backup. Use a copy taken before the compromise, then update software and review every user account.
- Start a written log. Record who found the problem, when, what was done and by whom. You will need this for the assessment.
Our small business website security checklist covers prevention: updates, backups and access controls.
Assess whether the breach is notifiable
Once you have reason to believe a breach affecting personal data in your possession or control has occurred, the PDPA requires you to assess, in a reasonable and expeditious manner, whether it is notifiable. The Guide expects that assessment within 30 calendar days and asks you to document each step. If it takes longer, be prepared to explain why.
The 30 days is not a waiting period. Begin as soon as you suspect a breach, and move faster wherever the facts are clear. These questions usually drive the assessment:
- What personal data was involved, and does it fall into a category the Regulations treat as causing significant harm?
- How many individuals are affected, or is there reason to believe it is 500 or more?
- Could the data be misused to harm those individuals?
- Did any protective measure, such as encryption, limit what an attacker could use?
- Did a vendor or hosting provider process any of the affected data?
Notify the PDPC within three calendar days
If you determine that the breach is notifiable, notify the PDPC as soon as practicable and in any case no later than three calendar days. The Guide says this period starts from the time you determine the breach is notifiable, and counts the day after that determination as the first day.
The PDPA asks for the prescribed information to the best of your knowledge at the time, so you do not need every answer before you notify. The Guide sets out what to prepare.
| Area | What to prepare |
|---|---|
| Facts | When and how you became aware, how the breach occurred, the number of individuals affected, the personal data involved and the potential harm. |
| Handling | The steps taken so far in chronological order, actions taken or planned, and your plan to inform individuals. |
| Contact | At least one authorised representative. |
| Late notification | The reasons for the delay, if you notify after the three calendar days. |
Notify affected individuals
Where individuals must be told, the Guide says to do so as soon as practicable, at the same time as or after notifying the PDPC. On the wording of the PDPA, the duty to notify individuals applies to a breach that results in, or is likely to result in, significant harm to them. A breach that is notifiable only because it meets the 500-person scale test does not automatically require individual notification, so check section 26D of the Act.
A notice to individuals should explain when and how you became aware of the breach and which personal data was affected. It should also describe the potential harm, what you have done, the steps the individual can take, and how to reach an authorised representative.
The Act provides limited exceptions. You may not need to notify individuals if:
- you took action that makes significant harm unlikely;
- a technological measure applied before the breach makes significant harm unlikely;
- a prescribed law enforcement agency instructs, or the PDPC directs, you not to notify; or
- the PDPC waives the requirement on your written application.
If you decide not to notify individuals, the Guide says your notification to the PDPC must state the grounds.
If a vendor or host handles the data
A data intermediary that processes personal data on behalf of another organisation must tell that organisation without undue delay when it has reason to believe a breach has occurred. The organisation then carries out the assessment. Whether a vendor counts as a data intermediary depends on what it actually does with the data and on your contract.
List the vendors that touch customer data, such as your host, email platform, payment tool and marketing software. Check what each contract says about incident notification, and keep their support contacts where your team can find them. Ask your host which parts of the stack it manages and which remain yours, because this varies by plan.
Common mistakes to avoid
Treating 30 days as a grace period
The assessment must be reasonable and expeditious. Thirty days is the outer expectation, not a target.
Assuming 500 people is the only trigger
Significant harm is a separate test. A smaller breach can still be notifiable.
Skipping the written record
The Guide asks you to document the steps you took in assessing a breach. Notes made on the day are far more reliable than memory.
Prepare before something happens
- Name an incident owner and a deputy, with phone numbers that work outside office hours.
- Map where personal data sits: web forms, orders, mailing lists, backups and exports.
- Keep dated backups and test a restore, so recovery is not a first attempt.
- Give admin access to named people only, with unique passwords and two-step verification where available.
- Keep your host and developer contacts in one shared place.
- Draft a notification template covering the points above, so facts can be filled in quickly.
Check what your hosting plan includes. Z.com Singapore lists automated backups, free SSL and Imunify 360 malware protection on several plans, and the details differ by plan, so confirm them before you choose.
Separately from PDPA notification, SingCERT accepts cyber incident reports by email at singcert@csa.gov.sg and through its online Cyber Aid page. See the SingCERT page on the CSA website for current details.
Frequently asked questions
Do I have to notify the PDPC if my site was only defaced?
The PDPA's breach definition concerns personal data. If no personal data was affected, the PDPA notification duty does not arise from that incident. Record why you reached that conclusion, fix the entry point and consider reporting to SingCERT.
Is 30 days the deadline to notify the PDPC?
No. Thirty calendar days is the period the Guide expects for assessing whether a breach is notifiable. Once you determine it is notifiable, the PDPC must be notified no later than three calendar days.
Does reporting to SingCERT replace PDPC notification?
No. SingCERT is a separate channel for cyber incidents. The PDPA's notification duties apply alongside any other legal obligation to notify.
Key takeaways
- Contain first and preserve evidence, then assess.
- A breach is notifiable to the PDPC on significant harm or on significant scale of 500 or more individuals.
- Assess in a reasonable and expeditious manner. The Guide expects this within 30 calendar days, so be ready to explain a longer assessment. Notify the PDPC within three calendar days of determining the breach is notifiable, counting the day after that determination as the first day.
- Notify individuals as soon as practicable, at the same time as or after the PDPC, for significant-harm breaches, unless an exception or prohibition applies.
Official sources
- PDPC Guide on Managing and Notifying Data Breaches Under the PDPA (revised 15 March 2021)
- Personal Data Protection Act 2012, Part 6A, on Singapore Statutes Online
- Personal Data Protection (Notification of Data Breaches) Regulations 2021
Sources were checked on 4 November 2026. Rules and guidance can change, and this article is general information rather than legal advice. Confirm your obligations with the PDPC or a qualified adviser.
Review your hosting setup
Backups, malware protection and a clear support route make recovery faster. Compare Z.com Singapore hosting plans and check the features listed for each one.