If an employee emails the wrong attachment, first contain the disclosure and preserve the facts. Identify the information sent, the recipient, whether it was accessed or forwarded and which individuals may be affected. A successful recall request is useful evidence, but it does not by itself establish that no personal data breach occurred or that no further action is required.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The company must assess the incident against the applicable notification rules. Separate the time the mistake was discovered from the time the company determines that the breach is notifiable.
Contain the incident without destroying the evidence
Notify the responsible privacy and security contacts promptly. Where appropriate, ask the recipient not to use or forward the material and to confirm how it has been handled. Preserve the original sent message, attachment, relevant delivery information and the recipient’s response.
Do not circulate the sensitive attachment widely while asking staff what happened. Use a restricted incident file and a factual description for people who need to assist without seeing the full document.
Build a factual incident record
- Who sent the message and when?
- What exact attachment and version were included?
- What personal data did it contain?
- Who received it and what is known about access or forwarding?
- What containment action was taken and what evidence supports it?
- When did the company obtain grounds to assess a possible breach?
Mark unknowns as unknown. A staff member’s belief that the recipient “probably deleted it” is different from a verified response or relevant technical evidence.
Assess harm and scale under the actual rules
The notification framework in the PDPA, including sections 26B to 26D, distinguishes the relevant harm and scale criteria. The company should assess the actual data and circumstances, including applicable regulations and exceptions. A small number of recipients does not automatically make sensitive information harmless.
Example: a payroll attachment sent to a supplier
An employee sends a payroll file instead of a purchase order to a supplier. The assessment should identify the personal information in the actual file, not assume it contains only employee names. The company should preserve the supplier’s response and investigate what happened to the attachment while reviewing the applicable notification criteria.
Keep the notification clock clear
Under section 26D, once the organisation assesses that a breach is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days after the day of that assessment. Notification to affected individuals has its own applicable conditions and exceptions; it is not identical in every case to notification of the Commission.
This is not permission to delay the assessment. Record the investigation steps and proceed promptly. If the incident is complicated, involve the appropriate technical and legal advisers while continuing containment and evidence preservation.
Make an actual decision and carry it through
Record the assessment, reasons, responsible decision-maker and any professional advice. If notification is required, prepare accurate information using the prescribed process and retain evidence of submission. If the assessment finds no notification requirement, retain the factual basis rather than a bare note saying “not reportable”.
Consider other applicable duties separately, including contractual incident clauses. A PDPA conclusion does not automatically settle every commitment to a customer or another organisation.
Prevent the same attachment error
Review how the mistake occurred: similar filenames, a shared downloads folder, broad access or an unchecked recipient list. Choose controls addressing that cause, such as a controlled final-document location and a review of recipient and attachment before sensitive messages are sent. Avoid treating disciplinary action as the only response while leaving the same process unchanged.
Does a recall prove that the email was never opened?
Assess what the system and recipient evidence actually show. Do not infer more than the available evidence supports.
Must every wrong attachment be reported to the PDPC?
Assess the actual incident against the statutory criteria. Neither automatic reporting nor automatic dismissal replaces that assessment.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.