Data protection panel proposes mandatory notice of breaches

Singapore

THE Personal Data Protection Commission (PDPC) has proposed a framework which would ensure that, in the event of a personal data breach where there was a risk of impact or harm, companies would have to inform the affected individuals as soon as possible.

Under the proposed mandatory data breach notification (DBN), in case of breach incidents that involve 500 or more individuals, the affected organisations would have to notify the PDPC within 72 hours of the incident, in addition to all the cases where there is risk of harm to affected individuals.

This would allow PDPC to better ascertain the level of risk and manage data breaches at the national level.

PDPC said the mandatory DBN measure would allow affected individuals to take steps to protect themselves, like changing passwords or cancelling credit cards, depending on the nature of the breach. It would also allow the organisation to receive guidance from PDPC …