AI Breach Notification: Requirements, Timelines, and Templates

When an AI incident involves personal data, the clock starts ticking. Regulatory notification requirements in Singapore, Malaysia, and Thailand each have specific timelines and content requirements. Miss them, and you face penalties on top of the incident itself.

This guide covers when AI incidents trigger notification requirements, what those requirements entail in each jurisdiction, and provides templates to help you respond effectively.

Executive Summary

• AI incidents often involve personal data, triggering breach notification obligations
• Timelines are strict: Singapore requires 3 days, Malaysia specifies "as soon as practicable," Thailand requires 72 hours for serious breaches
• Different stakeholders require different notifications: Regulators, data subjects, and boards each need tailored communication
• Documentation is essential: Record your assessment, decisions, and timing for compliance evidence
• When in doubt, notify: The penalty for late notification typically exceeds the penalty for unnecessary notification
• Templates accelerate response: Having ready-to-adapt templates saves critical time during incidents

Why This Matters Now

AI systems process personal data at scale. When things go wrong, the breach scope can be massive:

• An AI chatbot might expose customer data in responses
• A training dataset containing personal data might be leaked
• A model might be tricked into revealing personal information
• AI-generated outputs might include personal data inappropriately

Regulators increasingly expect organisations to have AI-specific incident response capabilities, including the ability to notify appropriately when AI incidents affect personal data.

When Does an AI Incident Trigger Notification?

General Trigger Criteria

A notification is typically required when:

1. Personal data is involved — data relating to an identifiable individual
2. Unauthorized access, disclosure, or loss occurs — the data is exposed beyond intended recipients
3. Harm threshold is met — the breach creates risk of harm to data subjects

AI-Specific Scenarios

Assessment Framework

AI INCIDENT → Does it involve personal data?
                       ↓ YES
        → Was there unauthorized access/disclosure/loss?
                       ↓ YES
        → Is there risk of harm to data subjects?
                       ↓ YES
        → NOTIFICATION REQUIRED
        
Consider: scale, data sensitivity, reversibility, containment

Jurisdiction-Specific Requirements

Singapore (PDPA)

When notification is required:

• Data breach results in (or is likely to result in) significant harm to affected individuals, OR
• Data breach is (or is likely to be) of significant scale

Significant harm includes:

• Threats to physical safety
• Identity theft, blackmail, extortion
• Significant financial loss
• Significant impact on credit record
• Loss of employment or business opportunities

Significant scale:

• 500 or more individuals affected

Notification timeline:

• To PDPC: As soon as practicable, and in any case no later than 3 calendar days after determining notification is required
• To affected individuals: As soon as practicable

Required information to PDPC:

• Description of breach
• Personal data involved
• Period of breach
• Number of individuals affected
• Actions taken
• Contact details for inquiries
• Measures to prevent recurrence

Penalties for non-compliance:

• Up to S$1 million fine per breach

Malaysia (PDPA 2010)

When notification is required: The Malaysian PDPA has been amended to require breach notification (effective 2024):

• Breach likely to cause harm to data subjects
• No minimum threshold specified for scale

Notification timeline:

• To Personal Data Protection Commissioner: As soon as practicable (within 72 hours recommended)
• To affected individuals: As directed by Commissioner or where significant harm likely

Required information:

• Nature of breach
• Personal data affected
• Measures taken to address breach
• Measures taken to mitigate effects
• Contact information

Penalties:

• Up to RM500,000 fine and/or imprisonment up to 3 years for non-compliance

Thailand (PDPA)

When notification is required:

• Personal data breach occurs, AND
• Breach is likely to pose high risk to rights and freedoms of individuals (for individual notification)

Notification timeline:

• To PDPC Thailand: Within 72 hours of becoming aware of breach
• To affected individuals: Without delay if high risk to individuals

Required information:

• Nature of breach
• Contact details of DPO
• Likely consequences
• Measures taken/proposed

Penalties:

• Administrative fines up to THB 5 million
• Criminal penalties possible in severe cases

Comparison Summary

Notification Decision SOP

Step 1: Initial Assessment (Hour 0-4)

Step 2: Notification Decision (Hour 4-8)

Step 3: Notification Preparation (Hour 8-24)

Step 4: Notification Execution (Within Required Timeline)

Notification Templates

Template 1: Singapore PDPC Notification

TO: Personal Data Protection Commission
RE: Data Breach Notification under Section 26D PDPA

1. ORGANIZATION DETAILS
Organization name: [Name]
UEN: [Number]
DPO name: [Name]
Contact email: [Email]
Contact phone: [Phone]

2. BREACH DESCRIPTION
Date breach occurred: [Date] (or estimated period)
Date breach discovered: [Date]
Description of breach:
[Describe what happened, how data was accessed/disclosed/lost, 
and how the breach was discovered]

3. PERSONAL DATA INVOLVED
Types of personal data:
☐ Name
☐ NRIC/Passport number
☐ Financial information
☐ Health information
☐ Contact information
☐ Other: [specify]

4. INDIVIDUALS AFFECTED
Number of individuals affected: [Number]
Are the affected individuals identifiable? [Yes/No]
Categories of individuals: [e.g., customers, employees]

5. ACTIONS TAKEN
Immediate containment actions:
[List actions taken to stop the breach and secure data]

Investigation status:
[Describe investigation progress and findings]

Remediation measures:
[Describe steps to prevent recurrence]

6. INDIVIDUAL NOTIFICATION
Have affected individuals been notified? [Yes/No/Planned]
If yes, date of notification: [Date]
Method of notification: [Email/Letter/SMS/Other]
If no, reason and planned timeline: [Explain]

7. ADDITIONAL INFORMATION
[Any other relevant information]

Submitted by: [Name, Title]
Date: [Date]

Template 2: Data Subject Notification (General)

[ORGANIZATION LETTERHEAD]

Date: [Date]

Dear [Name/Valued Customer],

IMPORTANT: Notice of Personal Data Incident

We are writing to inform you of an incident affecting your personal data.

WHAT HAPPENED
On [date], we discovered that [brief description of what occurred]. 
This incident was caused by [brief cause without technical jargon].

WHAT INFORMATION WAS INVOLVED
The information potentially affected includes:
• [List specific data types in plain language]
• [E.g., your name and email address]
• [E.g., your account number]

WHAT WE ARE DOING
We have taken the following steps:
• [Action 1 – e.g., secured the affected system]
• [Action 2 – e.g., engaged cybersecurity experts]
• [Action 3 – e.g., notified relevant authorities]
• [Action 4 – e.g., implemented additional safeguards]

WHAT YOU CAN DO
We recommend you:
• [Action 1 – e.g., monitor your accounts]
• [Action 2 – e.g., be alert for suspicious communications]
• [Action 3 – e.g., change passwords if applicable]

[If offering credit monitoring or identity protection services:]
We are offering [service] at no cost to you. To enroll, [instructions].

FOR MORE INFORMATION
If you have questions, please contact:
[Dedicated contact method – phone number, email, FAQ webpage]

We deeply regret any concern this may cause and are committed 
to protecting your information.

Sincerely,

[Name]
[Title]
[Organization]

Template 3: Board Notification

CONFIDENTIAL

TO: Board of Directors
FROM: [Name, Title]
DATE: [Date]
RE: Data Breach Notification – AI System Incident

EXECUTIVE SUMMARY
A data breach involving [brief description] has been identified. 
Regulatory notification [has been/will be] made. This memo provides 
an overview for board awareness.

INCIDENT OVERVIEW
• Date discovered: [Date]
• Nature of incident: [Brief description]
• Root cause: [If known]
• Current status: [Contained/Under investigation/Resolved]

IMPACT ASSESSMENT
• Individuals affected: [Number]
• Data involved: [Types]
• Jurisdictions: [Countries]

REGULATORY RESPONSE
• Singapore PDPC: [Notified on date / Notification planned]
• Malaysia PDPC: [Notified on date / Notification planned / N/A]
• Thailand PDPC: [Notified on date / Notification planned / N/A]
• Individual notifications: [Status]

FINANCIAL IMPLICATIONS
• Estimated remediation cost: [Amount]
• Potential regulatory penalty exposure: [Range]
• Other costs: [List]

ACTIONS TAKEN
1. [Action with date]
2. [Action with date]
3. [Action with date]

NEXT STEPS
1. [Planned action with timeline]
2. [Planned action with timeline]

BOARD ACTION REQUESTED
[Specify if any board action is needed – approval, information only, etc.]

CONTACT
For questions, contact [Name, contact details]

Common Failure Modes

1. Missing the Timeline

Regulatory timelines start when you should have known, not when you confirmed everything. Don't delay notification for perfect information.

2. Under-Notifying

Hoping an incident doesn't meet thresholds when it does. Regulators view this poorly.

3. Over-Technical Language

Notifications to individuals filled with jargon. Plain language is required.

4. Insufficient Documentation

Can't prove what you did and when. Document everything.

5. Forgetting Individuals

Focusing on regulator notification and neglecting data subject notification.

6. Wrong Jurisdiction

Applying one country's rules to an incident governed by another's laws.

Implementation Checklist

Preparation (Before Incidents)

• Document applicable jurisdictions for your data
• Create notification templates
• Establish notification decision authority
• Train response team on requirements
• Create documentation templates
• Establish relationships with regulators (where possible)

During Incident

• Immediately assess personal data involvement
• Document timeline of discovery and assessment
• Apply jurisdiction-specific criteria
• Make notification decision and document reasoning
• Prepare notifications with legal review
• Execute notifications within timelines
• Log all notifications with timestamps

After Notification

• Monitor for regulator follow-up
• Respond to data subject inquiries
• Document all communications
• Complete post-incident review
• Update templates based on learnings

Frequently Asked Questions

When does the notification clock start?

When you become aware that a notifiable breach has occurred. This isn't when you have complete information—it's when you have reasonable grounds to believe a breach requiring notification has happened.

What if we're not sure if notification is required?

When genuinely uncertain, consult legal counsel urgently. The penalty for late notification usually exceeds any downside from unnecessary notification. Err toward notifying.

Can we delay notification to investigate?

Limited delay is acceptable to assess the breach, but don't wait for a complete investigation. You can notify with partial information and update later.

What if the breach involves multiple jurisdictions?

Apply each jurisdiction's rules to the data subjects in that jurisdiction. You may need multiple regulator notifications with different requirements.

Should we notify individuals even if not legally required?

Often yes—trust and relationship considerations may warrant notification even when not legally mandated. Consider reputational impact of later disclosure.

What if a vendor's AI system caused the breach?

You're still responsible for notifying your data subjects and potentially your regulators. Your vendor relationship doesn't change your obligations to individuals whose data you process.

Taking Action

Breach notification is time-critical. When an AI incident involves personal data, you need to move quickly from assessment to notification. Having templates, procedures, and trained personnel ready before incidents occur is essential.

Don't wait for a breach to figure out your notification obligations. Prepare now.

Ready to ensure your breach notification capability is ready?

Pertama Partners helps organisations build AI incident response and breach notification capabilities tailored to their regulatory environment. Our AI Readiness Audit includes compliance and incident response assessment.

Book an AI Readiness Audit →

Disclaimer

This guide provides general information about data breach notification requirements. It does not constitute legal advice. Requirements change, and specific circumstances may affect obligations. Organisations should consult qualified legal counsel for advice on their specific situations and verify current requirements with relevant regulators.

References

1. PDPC Singapore. (2024). Guide to Managing Data Breaches 2.0.
2. PDPC Singapore. (2024). Advisory Guidelines on the Personal Data Protection Act.
3. PDPC Malaysia. (2024). Personal Data Protection Act 2010 (as amended).
4. Thailand PDPC. (2024). Guidelines on Personal Data Breach Notification.
5. PDPC Singapore. (2024). Data Breach Notification Form and Guide.