Breach notices
Data breach notification in Singapore and India
Short answer
- Singapore deadline
- 3 calendar days after assessment 1
- Singapore scale threshold
- 500 affected individuals 2
- Singapore rules in force
- 1 February 2021 2
- India CERT-In deadline
- 6 hours after noticing the incident 3
- India log retention
- Rolling 180 days 3
- India DPDP Rules
- Notified 14 November 2025, 18-month phase-in 4
Singapore: when a breach is notifiable
Part 6A of the Personal Data Protection Act 2012 sets the breach rules 1. Under section 26B, a data breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or if it is, or is likely to be, of a significant scale 1. A breach involving prescribed personal data is deemed to result in significant harm 1.
The Personal Data Protection (Notification of Data Breaches) Regulations 2021 came into operation on 1 February 2021 2. Regulation 4 sets the prescribed number of affected individuals for significant scale at 500 2. Regulation 3 lists the classes of data that are deemed to cause significant harm, including account identifiers held with banks and finance companies 2.
Singapore: the notice steps
- Assess the breach under section 26C 1.
- Notify the Commission as soon as practicable, and in any case no later than 3 calendar days after the day of the assessment, under section 26D(1) 1.
- Notify each affected individual under section 26D(2), subject to the exceptions in section 26D(5) 1.
- Notice to individuals is not needed where the organisation took action after the assessment, or had technological measures in place before the breach, that make significant harm unlikely, under section 26D(5) 1.
Singapore: the PDPC reporting route
The PDPC published a reporting guide for Data Protection Officers on 22 April 2026 5. It explains how to decide whether a breach is notifiable, how to meet the three-day deadline and how to report using the Commission's process and its C.A.R.E. framework 5. The PDPC offers a self-assessment tool to test whether a breach is notifiable and an e-service form to submit the notification 5.
India: CERT-In reporting
CERT-In issued directions under section 70B(6) of the Information Technology Act, 2000 on 28 April 2022 3. Covered entities must report listed cyber incidents to CERT-In within 6 hours of noticing them or being told about them 3. Annexure I lists 20 incident types 3. Reports go to incident@cert-in.org.in 3.
India: the DPDP Act and Rules
Parliament enacted the Digital Personal Data Protection Act on 11 August 2023 4. The Ministry of Electronics and IT announced on 14 November 2025 that the DPDP Rules, 2025 had been notified, marking the full operationalisation of the Act 4. The Rules provide an 18-month phased compliance timeline 4.
In the event of a personal data breach, Data Fiduciaries must promptly inform affected individuals in plain language 4. The notice explains the nature and possible consequences of the breach, the steps taken to address it and contact details for help, according to the ministry 4. The Data Protection Board will work as a fully digital body, and appeals against its decisions go to the Telecom Disputes Settlement and Appellate Tribunal 4.
Side by side
| Point | Singapore | India |
|---|---|---|
| Regulator | Personal Data Protection Commission 1 | CERT-In for cyber incidents, Data Protection Board under the DPDP Act 3,4 |
| Deadline to regulator | 3 calendar days after assessment 1 | 6 hours for CERT-In incidents 3 |
| Notice to people | Under section 26D(2), with exceptions in section 26D(5) 1 | Promptly, in plain language, under the DPDP Rules 4 |
| Scale trigger | 500 individuals 2 | Not stated in the ministry release 4 |
Common questions
How quickly must a Singapore company report a data breach?
No later than 3 calendar days after it assesses that the breach is notifiable 1.
What number of affected people makes a breach significant in Singapore?
500 individuals 2.
What is the CERT-In 6 hour rule?
Listed cyber incidents must be reported to CERT-In within 6 hours of noticing them or being told about them 3.
When were India's DPDP Rules notified?
The ministry announced the notification on 14 November 2025 4.
Do the DPDP Rules apply at once?
They provide an 18-month phased compliance timeline 4.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@noticeofrecord.com.
Sources
- Singapore Statutes Online: Personal Data Protection Act 2012, Part 6A
- Singapore Statutes Online: Personal Data Protection (Notification of Data Breaches) Regulations 2021
- CERT-In: Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 (28 April 2022)
- Press Information Bureau, Ministry of Electronics and IT: Government notifies DPDP Rules to empower citizens and protect privacy (14 November 2025)
- PDPC: Report Your Organisation’s Data Breach (published 22 April 2026)
Related
- Data breach notification laws compared
How breach notice rules differ in the EU, UK, US, Australia, Canada and India: who must notify, the deadline and who receives the notice.
- Data breach notification in Australia
How Australia's Notifiable Data Breaches scheme works: the 30 day assessment, the statement to the OAIC, three ways to notify and the latest figures.
- Data breach notification in Kenya and South Africa
Kenya's 72 hour breach rule under the Data Protection Act 2019 and South Africa's POPIA section 22 duty, with notice methods and penalty caps.
- How to check whether a notice was given
Where to look up official notices: state breach lists, the HHS breach portal, SEC EDGAR, FDA warning letters, FCA notices, WARN reports and recall lists.