Is Duty to Notify Notifiable Data Breaches (s 26D) legally binding?

Q: Is Duty to Notify Notifiable Data Breaches (s 26D) legally binding?

Duty to Notify Notifiable Data Breaches (s 26D) is binding in Singapore. Binding law. It applies to everyone in scope, whether or not anyone points at it. An organisation that assesses a breach as notifiable must notify the PDPC as soon as practicable and no later than 3 calendar days after that assessment, and must also notify affected individuals where the breach is likely to result in significant harm, subject to exceptions.

ObligationBinding

Duty to Notify Notifiable Data Breaches (s 26D)

Is this legally binding?

Binding. Binding law. It applies to everyone in scope, whether or not anyone points at it.

An organisation that assesses a breach as notifiable must notify the PDPC as soon as practicable and no later than 3 calendar days after that assessment, and must also notify affected individuals where the breach is likely to result in significant harm, subject to exceptions.

From the source
“the organisation must notify the Commission as soon as is practicable, but in any case no later than 3 calendar days after the day the organisation makes that assessment”
s 26D

sso.agc.gov.sg Show it on the map

What this connects to

2 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.

Cites1

ObligationDuty to Assess Data Breaches (s 26C)Binding
s 26D notification duty follows the s 26C assessment

Cited by1

SectionPart 6A, Notification of Data BreachesBinding
Structural decomposition of the source instrument

Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.