Is an Email Outage a Data Breach Under the PDPA? When Singapore Businesses Must Notify PDPC
When Outlook and Microsoft 365 went down on 13 November 2026, a second worry followed the first in many Singapore offices: do we have to report this to PDPC? It is a sensible question. The Personal Data Protection Act (PDPA) has a mandatory data breach notification rule with tight deadlines, and nobody wants to find out about it afterwards.
The quick answer: PDPC's guide defines a data breach around unauthorised access to, or handling of, personal data. An outage where a service is simply unavailable is not described there as a data breach. But some of the things staff do to get around an outage can create one. This article walks through PDPC's own guidance. It is general information, not legal advice.
What counts as a data breach under the PDPA?
PDPC's guide describes a data breach as unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data. It also covers the loss of a storage device or medium holding personal data where such unauthorised activity is likely to follow.
The guide lists typical causes in three groups: malicious acts such as hacking, ransomware and phishing; human error such as sending data to the wrong recipient or losing a device; and system weaknesses such as software bugs.
Source: PDPC, Guide on Managing and Notifying Data Breaches under the PDPA.
So is an email outage a data breach?
PDPC's guide does not specifically discuss a service outage on its own. Its definition turns on personal data being accessed or handled without authorisation, or lost. An outage in which staff could not reach their mailboxes, and nothing else happened to the data, is a different kind of event.
For the 13 November incident, the Microsoft status updates we reviewed describe servers becoming unavailable. They do not mention unauthorised access to customer data. Microsoft had not published a root cause at the time of writing, so check its post-incident report when it appears. See what Microsoft has confirmed about the outage.
If you are unsure how the definition applies to your situation, ask your Data Protection Officer or a legal adviser.
How can an outage lead to a real data breach?
This is the part worth five minutes. The outage is not the risk. The workarounds are.
| Workaround during an outage | Why it matters under the PDPA |
|---|---|
| Sending customer files from a personal email account | Personal data leaves the systems your organisation controls |
| Sharing customer details in a personal chat group | Data may reach people who should not have it |
| Typing an address from memory and sending to the wrong recipient | PDPC's guide lists sending data to the wrong recipient as a cause of breaches |
| Clicking a fake "restore your mailbox" link | Phishing is listed by PDPC as a malicious cause of breaches |
| Copying files to a USB drive that then goes missing | Loss of a storage device can itself be a data breach |
The practical fix is to agree the fallback channels in advance, so nobody improvises with customer data. See email continuity options for SMEs and how to report a phishing email in Singapore.
When must you notify PDPC of a data breach?
| Step | What PDPC's guide says |
|---|---|
| Assess | Once there are credible grounds to believe a breach occurred, assess whether it is notifiable within 30 calendar days, and document the steps taken |
| Notifiable: significant harm | The breach is likely to result in significant harm to affected individuals. Breaches involving prescribed categories of personal data are deemed to meet this |
| Notifiable: significant scale | The breach affects 500 or more individuals |
| Notify PDPC | As soon as practicable, and no later than 3 calendar days after determining the breach is notifiable |
| Notify individuals | As soon as practicable, at the same time as or after notifying PDPC, where required |
| Data intermediaries | A data intermediary processing personal data for another organisation must notify that organisation of a breach it detects |
PDPC's guide sets out a four-step response it calls C.A.R.E.: Contain, Assess, Report, Evaluate.
Source: PDPC, Guide on Managing and Notifying Data Breaches under the PDPA; PDPC, data breach management guidance page.
What should a Singapore business do after an outage?
- Record the incident: dates, times, services affected and what Microsoft reported.
- Ask staff how they worked around it. No blame; you need to know whether customer data went through personal accounts or devices.
- Check for anything unusual: unexpected sign-ins, forwarding rules or messages staff did not send.
- If personal data may have been exposed, treat it as a possible breach and start the assessment PDPC describes.
- Read Microsoft's post-incident report when it is published.
- Write down the fallback channels for next time.
The outage was Microsoft's. What your staff did with customer data while it was down is yours.
Getting help in Singapore
For backup and continuity planning, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Is an email outage a data breach under the PDPA? PDPC's guide defines a data breach around unauthorised access to or handling of personal data, or its loss. It does not describe a service outage on its own as a data breach.
How long do I have to notify PDPC? No later than 3 calendar days after determining that a breach is notifiable, according to PDPC's guide.
What makes a data breach notifiable? It is likely to result in significant harm to affected individuals, or it affects 500 or more individuals.
How long do I have to assess a suspected breach? PDPC's guide says within 30 calendar days of having credible grounds to believe a breach occurred.
This article is general information compiled from the PDPC sources linked above as at 13 November 2026. It is not legal advice and is not a statement by or on behalf of PDPC or Microsoft. Refer to PDPC's guidance and take professional advice for your situation.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
