Why the clock and the cost belong to leaders
A data breach is not only a security event - it is a legal deadline that starts running the moment you have credible grounds to believe something happened. Miss the deadline and you have a second breach on top of the first. Leaders often assume this is the DPO's problem, but the decisions to notify, to allocate people, and to face the regulator are leadership decisions made under time pressure. This session removes the surprise: the timelines are fixed and knowable, and the penalty numbers are public. Know them now, not at 5pm on a Friday.
The breach clock 9 min live
The moment you have credible grounds to believe a data breach has occurred, a clock starts. The law gives you a window to assess whether it is notifiable, then a hard deadline to notify once you have decided it is. There are only a few numbers to hold, and every leader should hold them.
LiveWhat makes a breach notifiable3 min▶
Not every breach must be reported. A breach becomes notifiable if it crosses either of two triggers - and you only need one.
- Significant harm: the breach is likely to result in significant harm to the affected individuals - for example where sensitive personal data is exposed.
- Significant scale: the breach affects 500 or more individuals, regardless of harm. Scale alone makes it notifiable.
- Either one triggers it. A leak of highly sensitive data about a handful of people can be notifiable on harm; a leak of low-sensitivity data about thousands can be notifiable on scale.
LiveThe timelines, precisely3 min▶
The dates are where organisations trip. Three numbers, in order:
- Assess within 30 calendar days of having credible grounds to believe a breach occurred. You use this window to establish what happened and whether it is notifiable - you do not get to sit on a known notifiable breach.
- Notify the PDPC no later than 3 calendar days after you determine the breach is notifiable. This is fast, and it is calendar days, not working days - a weekend does not pause it.
- Notify affected individuals as soon as practicable - at the same time as, or after, you notify the PDPC, not before.
Self-studyWho notifies - and the data-intermediary rule2 min read▶
The duty to notify sits with the organisation that owns or controls the data. If you use a vendor to process data on your behalf - a mailing house, a cloud processor, an outsourced call centre - that vendor is a data intermediary, and its duty is different: when it becomes aware of a breach involving your data, it must notify you, the organisation, without undue delay. The intermediary does not notify the PDPC in your place; it puts the ball back in your court, and your clock starts. The practical lesson for a leader is contractual: your agreements with processors should require prompt breach notification to you, because their silence does not pause your legal deadlines. If they sit on it, you are still the one who missed the window.
What it costs - real cases 8 min live
The caps tell you the ceiling; the decisions tell you the reality. The PDPC publishes both, and the pattern is consistent: it weighs how much harm was done and how careless you were, and it considers directions before it reaches for a penalty. Here are the numbers and four real cases.
LiveFour real decisions - read the pattern4 min▶
Numbers land harder when they are attached to real organisations. Read these across, not down - the pattern is harm plus culpability, softened by what the organisation did right.
| Case | What happened | Finding | Outcome |
|---|---|---|---|
| Marina Bay Sands | 665,495 patrons' data exposed | Protection Obligation | S$315,000 penalty |
| Ezynetic (SME) | Ransomware, 190,589 individuals | Protection Obligation | S$17,500 + directions |
| Lee Chee Meng (agent) | Bought ~420,000 records for telemarketing; did check DNC | Consent + Notification | S$16,800 (reduced) + delete in 7 days |
| A Financial Advisor | Dictionary attack on numbers, no register check, no consent | DNC breach + s.48B | Warning |
What the pattern says. Marina Bay Sands and Ezynetic are the same obligation - reasonable security - at two different scales, and being an SME changed the number, not the duty. The two DNC cases show the softening levers: Lee Chee Meng's penalty was reduced partly because he had checked the register (even though his real failure was using a bought list with no consent), and the financial advisor drew a warning rather than a penalty. The regulator is not looking to maximise fines; it is measuring harm and carelessness, and rewarding the things you did right.
LiveHow the PDPC decides the number2 min▶
The caps are ceilings, rarely the outcome. The PDPC's published approach has a clear order and clear factors.
- Directions first. Where the breach can be remedied by directions - fix this, delete that, put controls in place - the PDPC considers those before financial penalties.
- Harm. How many people were affected, how sensitive the data, and how real the harm to them.
- Culpability. Was this a lapse despite reasonable effort, or reckless behaviour - a bought list, a skipped check, a known gap left open?
- Mitigation. What you did right - having controls, checking the register, cooperating, remediating quickly, self-reporting - pulls the number down.
Run Marina through the clock ★ 12 min · pen and paper
Marina Retail discovers today that a misconfigured export exposed 3,000 customer records. Walk it through the breach clock and decide the two things that matter: is it notifiable, and by when must you act?
Mark today as the day Marina has credible grounds. Note that this is where the clock starts - not the day of the leak, the day you had reason to believe.
Apply the two triggers. 3,000 records - is that 500 or more? Is significant harm likely? Decide whether it is notifiable, and on which trigger.
If notifiable, put dates on it: assess within 30 calendar days of today; notify the PDPC within 3 calendar days of determining it is notifiable. Write the actual dates.
Name who at Marina makes the "it is notifiable" call and who contacts the PDPC - including who covers a weekend. If the answer is "nobody has that job," that is the finding.
Rank the mitigating and aggravating factors ★ 8 min · your next leadership meeting
If Marina's 3,000-record breach reached the PDPC, what would weigh in Marina's favour, and what would weigh against? Rank them - because the same list is your prevention checklist.
List everything that would count in Marina's favour: reasonable controls in place, quick detection, prompt remediation, cooperation, self-reporting, no sensitive data. Rank them by how much you think each helps.
List everything that would count against: was the misconfiguration a known risk left unfixed, was there prior warning, how sensitive was the data, was the number of people large. Rank by severity.
Circle the one aggravating factor Marina could most cheaply remove before any incident. That is the item for the next budget conversation.
Note which favourable factors are decisions, not luck - controls, a response plan, a named owner - and which Marina does not yet have.
Before session a6 ◐ 30 min total
- Find out who at your organisation can make the "this is notifiable" decision and reach the PDPC within 3 days, including on a weekend. Write the name down. If there is none, that is your finding for a6.
- Check one vendor contract for a breach-notification clause. Does the processor have to tell you promptly? If not, note it - their silence does not pause your clock.
- Run the breach-clock prompt on a realistic scenario for your organisation and see whether your team could hit the deadlines today.
- Optional: read one PDPC enforcement decision end to end - the reasoning on harm, culpability, and mitigation is more instructive than the headline number.
- If we had credible grounds for a breach today, who assesses it, and are we confident we would finish within 30 days?
- Who is authorised to notify the PDPC within 3 calendar days, and who covers weekends and public holidays?
- Do our vendor contracts require processors to report breaches to us promptly?
- For our biggest data pool, would a leak cross the 500-individual line or the significant-harm line?
- What mitigating factors could we point to today - and which ones are we missing that we could cheaply add?
Official sources covered
Taught from the PDPC's published guidance and enforcement decisions - not marketing material. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · A data breach is notifiable to the PDPC if...
Either trigger is enough: significant harm, or a scale of 500 or more individuals. You do not need both.
2 · Once you determine a breach is notifiable, you must notify the PDPC...
The 30 days is the window to assess. Once you decide it is notifiable, you have no more than 3 calendar days to notify the PDPC - and individuals are notified at the same time or after, not before.
3 · Lee Chee Meng bought ~420,000 records for telemarketing but had checked the DNC register. In the decision, checking DNC was...
His real breach was using a bought list with no consent or notification, but the fact that he had checked the register counted in his favour and the penalty was reduced. The PDPC rewards what you did right.