Overview On The Data Breach Notification Under The Personal Data Protection Act 2010

Introduction

Section 12B of the Personal Data Protection Act 2010[1] [Act 709] ("PDPA"), which will come into effect on 1 June 2025 introduces a mandatory requirement for data controller to notify the Personal Data Protection Commissioner ("Commissioner") and affected data subjects if the data controller has reason to believe that a personal data breach has occurred.

Pursuant to the above and Section 48(g) of the PDPA, the Commissioner has recently issued:

(a) Circular of Personal Data Protection Commissioner No. 2/2025 (Data Breach Notification) ("Circular No. 2/2025"); and

(b) Personal Data Protection Guideline: Data Breach Notification Version 1.0 ("DBN Guideline").