The two numbers that focus the mind
Most of the GDPR is about doing things well in advance. Breach and penalties are about what happens when you did not - and they are what get a board's attention. The 72-hour clock is unforgiving because it starts when you become aware, not when you have finished investigating. And the fines are tied to global turnover, so for any company with international revenue the GDPR ceiling dwarfs the PDPA's. This hour turns both into something you can plan for.
The 72-hour clock 9 min live
The breach rules have two thresholds and one deadline. Any breach that risks people's rights goes to the regulator within 72 hours. A breach that risks them badly also goes to the individuals.
LiveTwo thresholds, one deadline3 min▶
- To the authority (Art 33): without undue delay and, where feasible, no later than 72 hours after becoming aware - unless the breach is unlikely to result in a risk to people's rights. Miss 72 hours and you must explain the delay.
- To the individuals (Art 34): when the breach is likely to result in a high risk to them, tell them too, without undue delay. Exceptions exist - notably if the data was strongly encrypted.
- The trap is "aware". The clock does not wait for your investigation. The moment you have reasonable certainty a breach occurred, it is running.
Livevs the PDPA clock3 min▶
The PDPA runs a different clock. You assess whether a breach is notifiable (the PDPC expects the whole cycle within about 30 days), and once you determine it is, you notify the PDPC within 3 calendar days. The threshold is significant harm or 500 or more affected individuals.
- GDPR: one 72-hour clock from awareness, risk-based, no numeric headcount threshold for the authority.
- PDPA: a ~30-day assessment window, then 3 days from determining notifiable, gated by the 500/significant-harm threshold.
- For a dual-regime company: the GDPR clock is tighter and starts earlier. Build your incident response to the 72-hour standard and you comfortably meet the PDPA one too.
Lumina's Monday incident. Lumina discovers an exposed database on a Monday morning affecting EU and Singapore users. Two clocks start. The GDPR one is the binding constraint: 72 hours to notify the EU authority. The team that had only planned for the PDPA's 30-day assessment window would already be late.
Two tiers, global turnover 8 min live
GDPR fines come in two tiers, and the ceiling is a percentage of worldwide turnover. That single word is why GDPR exposure is a different order of magnitude from the PDPA.
LiveThe two tiers3 min▶
| Tier | Ceiling (whichever is higher) | Covers |
|---|---|---|
| Lower (Art 83(4)) | EUR 10 million or 2% of global annual turnover | Records, security, breach notification, DPIA, DPO duties (Art 25-39) |
| Upper (Art 83(5)) | EUR 20 million or 4% of global annual turnover | Principles, lawful basis, consent (Art 5/6/7/9); rights (Art 12-22); transfers (Art 44-49); ignoring an order |
- "Whichever is higher" means a large company is measured against the percentage, not the euro figure - the cap scales with revenue.
- Global turnover is the base, not EU turnover. A multinational's ceiling is enormous.
LiveThe cases that prove it - and the PDPA contrast3 min▶
- Meta - EUR 1.2 billion (2023): the largest GDPR fine to date, for unlawful transfers of EU user data to the US. A transfers case (upper tier).
- Amazon - EUR 746 million (2021): over its advertising and data-processing practices.
- The PDPA contrast: Singapore caps at S$1 million or 10% of Singapore turnover. For a company with modest Singapore revenue but large global revenue, the GDPR exposure is vastly larger, because the base is global.
Self-studyWhy the transfers cases dominate the top of the list2 min read▶
It is not a coincidence that the biggest fine on record is a transfers case. International data transfer (session a6) is where a Singapore company is most exposed, because moving EU personal data to a Singapore server is exactly the kind of transfer the GDPR scrutinises after Schrems II. Meta's EUR 1.2 billion was not for a leak or a consent slip - it was for sending EU data abroad without adequate protection. For a Singapore business, that is the risk that maps most directly onto your own operations: your servers, your cloud region, your EU customers' data crossing a border. It is why the leader track ends on transfers, and why the practitioner track dedicates a full session to doing them right.
Run your 72-hour clock ★ 12 min · pen and paper
A breach plan that has never been timed is a hope, not a plan.
Imagine a breach discovered at 9am Monday affecting EU individuals. Write who first "becomes aware" in your organisation, and how the alarm reaches a decision-maker.
Map the hops to a regulator notification: who assesses risk, who drafts, who approves, who submits. Put an hour estimate on each.
Add it up against 72 hours. If a weekend or an approval bottleneck eats the budget, you have found a real gap.
Decide the one change that would most protect the clock - usually a named incident owner with authority to notify.
Size the exposure ★ 8 min · your next board prep
Put the two regimes side by side on your own numbers.
Take your global annual turnover. Compute 4% of it - that is your GDPR upper-tier ceiling if it exceeds EUR 20 million.
Take your Singapore turnover. Compute 10% - the PDPA ceiling (or S$1 million if larger applies).
Compare. For most internationally-exposed companies the GDPR number is far larger. Note the gap.
Ask: does our board understand that our largest privacy tail-risk is GDPR, not PDPA? If not, that is the slide to add.
Before session a6 ◐ 30 min total
- Time your breach clock end to end and note the biggest bottleneck. Keep it - session b7 turns it into a response plan.
- Compute your GDPR (4% global) vs PDPA (10% Singapore) ceilings and bring the comparison to your next risk conversation.
- Check whether your incident plan starts its clock at "aware" or at "investigation complete" - only the first is compliant.
- Optional: read GDPR Articles 33 and 34 - short, and the whole breach regime.
- Could we notify an EU authority within 72 hours of becoming aware of a breach - who owns that?
- Does our incident plan start the clock at "aware" or wait until the investigation is done?
- When would we have to notify affected individuals, not just the regulator?
- What is our GDPR upper-tier ceiling (4% of global turnover) versus our PDPA ceiling?
- Is our biggest fine risk a data leak, or a cross-border transfer (as the Meta case suggests)?
Official sources covered
Taught from the GDPR text and published enforcement decisions. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · The GDPR 72-hour breach clock starts when...
Article 33: notify without undue delay and, where feasible, within 72 hours of becoming aware. Awareness starts the clock - not the end of the investigation.
2 · The GDPR upper-tier fine ceiling is...
Article 83(5): EUR 20M or 4% of global turnover, whichever is higher - covering principles, bases, rights, and transfers. The global base is why it dwarfs the PDPA cap.
3 · You must notify affected INDIVIDUALS (not just the authority) when the breach...
Article 34: individuals are notified when the risk to them is high. (The 500 threshold is a PDPA rule, not a GDPR one.) Any risk goes to the authority; high risk also goes to individuals.