Data protection that will stand up to a PDPA breach or PDPC investigation.

Why do you need a breach response plan? Once you assess a data breach as notifiable (likely to cause significant harm, or affecting 500 or more people), PDPA Part 6A gives you 3 calendar days to notify the PDPC, and you must also notify affected individuals where significant harm is likely. Three days is not enough time to work out a response from scratch. The plan is how you meet the deadline.

Why it matters: In 2025 the PDPC imposed a S$315,000 financial penalty on Marina Bay Sands after the personal data of 665,495 patrons was exfiltrated.

What we provide: A lawyer-led response, with forensic vendors engaged through us so that privilege may apply to their work.

• Response plan
• Escalation matrix
• PDPC and individual notification templates

Why do you need an IT security and BYOD policy? PDPA section 24 requires you to make reasonable security arrangements to protect personal data. In PDPC decisions the failures are usually human: weak passwords, unencrypted laptops, data emailed to personal accounts. A written policy tells staff what to do and shows the PDPC that you took reasonable steps.

• Acceptable use policy
• BYOD policy
• Employee monitoring notice

The PDPA applies to every organisation in Singapore that handles personal data. There is no small-business exemption. The core obligations: designate at least one Data Protection Officer (section 11(3)) and publish the DPO's contact details (section 11(5)); develop data protection policies (sections 11–12); make reasonable security arrangements (section 24); and, under Part 6A (sections 26A–26E), assess suspected breaches and notify the PDPC of a notifiable breach within 3 calendar days of the assessment. Three days is very little time to work out what happened, contain it, assess the harm thresholds and prepare a notification the regulator will scrutinise. Organisations without a rehearsed plan miss the deadline or notify badly, and the PDPC treats the quality of the response as relevant to penalty.

Financial exposure runs to S$1 million or, where annual Singapore turnover exceeds S$10 million, 10% of that turnover (section 48J). The PDPC publishes and names: in October 2025 it imposed a S$315,000 penalty on Marina Bay Sands after the personal data of 665,495 lifestyle-programme members was exfiltrated. Individuals also have a private right of action (section 48O), so a breach can bring civil claims on top of regulatory action. A breach handled without legal structure creates a second problem: forensic reports commissioned directly by the company are ordinarily not privileged, so the report that sets out everything that went wrong is disclosable to the other side.

IT security and BYOD policies turn the section 24 obligation into instructions staff can follow. In PDPC decisions the recurring findings are human: weak passwords, unencrypted laptops, data emailed to personal accounts. Enterprise customers, government tenders and cyber insurers all test the framework. On the horizon: the PDPC's Advisory Guidelines on the Use of Personal Data in Generative AI (20 July 2026) mean policies and vendor contracts that predate them will need review as AI tools enter the workflow.

Technical vendors secure systems. They cannot advise on the law or protect the advice. We conduct the gap assessment as lawyers, so the findings are legal advice and may be privileged. That matters when the assessment uncovers problems you need time to fix. We then draft the policy suite from your actual data inventory and retention practices, not from a form describing some other company's systems.

In a breach, structure matters from the first hour. We lead the response, engage forensic vendors through the firm so that litigation privilege may attach to their work, make the Part 6A notifiability assessment with you, and draft the PDPC and individual notifications. These are judgement calls with penalty consequences, better made with counsel than by a committee reading the Act for the first time.

If the PDPC investigates, we can represent you throughout: responding to notices, making representations on penalty, managing parallel civil exposure. We also provide ongoing DPO legal support and an annual review so the framework keeps pace with PDPC guidance.