Effective notification to affected individuals:

1. provides them with the opportunity to take steps to protect their personal data following a data breach; and
2. helps to build consumer trust in your organisation as being accountable, and having data protection as a priority. 

Organisations must notify affected individuals as soon as practicable, at the same time or after notifying the PDPC.

However, for data breaches which are likely to attract widespread public attention and/or interest, please notify the PDPC first before notifying the affected individuals and before issuing any public/media statement on the data breaches. You may click here to lodge a Data Breach Notification to the PDPC.