Quick answer: Yes, if the attacker could access, copy, change or delete personal data held on the site. A hack that never touches personal data is a security incident, not a PDPA data breach. If personal data was involved, assess whether the breach is notifiable. If it is, notify the PDPC within 3 calendar days of deciding that.
Table of contents
⦁ What counts as a data breach under the PDPA?
⦁ Where does personal data sit on a WordPress site?
⦁ When is a hacked WordPress site a notifiable breach?
⦁ What are the PDPA deadlines after a website hack?
⦁ What should you do first after a WordPress hack?
⦁ What counts as reasonable security for a WordPress site?
⦁ If a provider meintains your site, who is responsible?
⦁ FAQ
⦁ Sources and notes
What counts as a data breach under the PDPA?
A data breach is any unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data, or the loss of a device holding it where such access is likely (PDPA s26A). Unauthorised access is enough, so you do not need proof that anything was downloaded.
On a WordPress site, that covers an attacker who logs in to wp-admin, reads the database through a vulnerable plugin, plants malware that copies form submissions, or encrypts or deletes data in a ransomware attack. The PDPC’s guide lists hacking, ransomware and exploited bugs in outdated website software as common causes.
A hack that never reaches personal data is a security incident, not a PDPA data breach. A defaced homepage on a site that stores no form entries is an example, but you still need logs to show the attacker never got near the data.
Where does personal data sit on a WordPress site?
List which of these exist on your site before you ever need an assessment.
| Location | What it often holds |
|---|---|
| User accounts | Names, emails, usernames, password hashes |
| Form entries (for example Gravity Forms, WPForms Pro, Elementor Pro submissions, or Flamingo) | Names, phone numbers, emails, free-text messages that may include NRIC or health details |
| WooCommerce orders and accounts | Names, addresses, phone numbers, order history, logins |
| Uploads folder | CVs, ID copies, medical or booking forms |
| Backups and logs | A full copy of everything above, so a backup left on the same server is a second copy at risk |
WordPress stores password hashes, not plain-text passwords. Whether leaked hashes count like leaked passwords is a judgement call for your assessment.
Not sure what personal data your WordPress site holds?
Get a Free PDPA Website Audit from SBWD and find out where it sits and who can reach it.
When is a hacked WordPress site a notifiable breach?
A breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or is of significant scale (PDPA s26B). Either trigger is enough.
Significant harm. The Notification of Data Breaches Regulations 2021 deem a breach to cause significant harm in two main cases:
- a person’s full name, alias or identification number, together with certain data listed in the Regulations’ Schedule, such as financial or specified health information
- an account identifier together with the password or other data used to access that account
On WordPress, that could be a customer login with its credentials, or a form that collected NRIC numbers alongside other details. These deemed cases are “without limiting” the general test, so data outside the Schedule can still cause significant harm.
Significant scale. The prescribed number is 500 affected individuals. The PDPC’s guide says a breach of that size is notifiable even if no prescribed data is involved. If you cannot count exactly, notify once you have reason to believe at least 500 people are affected.
Encryption helps. The PDPC lists it as a contextual factor, and the Act removes the duty to tell individuals (not the PDPC) where a technological measure in place beforehand makes significant harm unlikely.
What are the PDPA deadlines after a website hack?
You have 3 calendar days to notify the PDPC, but that clock starts when you decide the breach is notifiable, not when the hack happened. Before that, you must assess it quickly and in writing.
| Step | Deadline | Basis |
|---|---|---|
| Assess whether the breach is notifiable | "Reasonable and expeditious" once you have reason to believe a breach occurred. The PDPC's guide expects this within 30 calendar days, with every step documented | PDPA s26C, PDPC guide |
| Notify the PDPC | As soon as practicable, and no later than 3 calendar days after the day you assess it as notifiable | PDPA s26D(1) |
| Notify affected individuals (significant-harm breaches) | As soon as practicable, on or after notifying the PDPC | PDPA s26D(2) |
| Data intermediary (such as a host or maintenance provider) | Tell the organisation that controls the data without undue delay | PDPA s26C(3) |
The three days begin the day after your assessment: determine on 1 January that a breach is notifiable and you must notify by 4 January. Submit through the PDPC’s e-service.
What should you do first after a WordPress hack?
Contain it, preserve the evidence, then assess. The PDPC’s guide frames a response as Contain, Assess, Report, Evaluate. For a WordPress site:
- Contain. Put the site in maintenance mode or block traffic at the firewall, and reset every credential that could be exposed: WordPress admins, hosting, database, SFTP and API keys.
- Preserve evidence before you clean. Copy the site files and database and save the server, error and security-plugin logs. Restoring a backup first can overwrite what you need. If a provider maintains your site, ask them to preserve these first.
- Find out what was reached. Check for unknown admin users, modified files, outdated plugins and exported form entries or orders.
- Start the written assessment. Record when you first had reason to believe a breach occurred and every step you take. The PDPC offers a self-assessment tool.
- Report. If it is notifiable, notify the PDPC within 3 calendar days of that decision, then tell affected individuals what to do. The guide also suggests considering a police report and an alert to SingCERT, and checking whether a sector regulator such as MAS or the Ministry of Health expects a report.
- Eradicate and recover. Remove the malware, patch the hole, restore from a clean backup and force password resets.
- Evaluate. Find the root cause and fix the process behind it.
For a real example, read SBWD’s case study, WP2Shell: How We Found and Cleaned Up a Client Site After a WordPress Security Breach.
Are your website and server logs ready if a breach happens, and who will analyse them?
Let SBWD manage your logs so you're always prepared
What counts as reasonable security for a WordPress site?
Being hacked is not itself a breach of the Act. The penalty turns on whether you made reasonable security arrangements (s24) and notified on time, judged on an objective standard: the foreseeable risks to the data, and what a reasonable organisation would have done about them. The maximum financial penalty is 10% of annual turnover in Singapore if that exceeds SGD 10 million, and SGD 1 million in any other case.
| Case | Penalty | What the PDPC found | WordPress takeaway |
|---|---|---|---|
| Marina Bay Sands (Oct 2025) | SGD 315,000 | A manual step was missed in a platform migration and went unnoticed for at least six months, exposing records of 665,495 members. There was no independent verification | Test changes on staging and verify security settings after every migration or major update |
| Singapore Data Hub (Apr 2025) | SGD 17,500 | Outdated, publicly accessible servers with no firewall, monitoring or multifactor authentication, and no periodic security reviews or patching | Keep core, themes and plugins patched, with a firewall and monitoring |
| People Central (Jan 2026) | SGD 17,500 | No two-factor authentication and insufficient security testing, ahead of a database deletion and data theft | Enforce two-factor authentication on every admin account and test periodically |
None of these was a WordPress case, and the PDPC does not prescribe specific plugins. The pattern is patching, access control, monitoring, periodic review and verified changes. SBWD’s PDPA for Websites guide covers the wider checklist on consent, cookies and NRIC rules.
Want these checks handled every month?
SBWD's WordPress maintenance and security plans cover patching, monitoring, backups and login protection.
If a provider maintains your site, who is responsible?
You remain responsible. The Act says an organisation has the same obligations for personal data processed on its behalf by a data intermediary as if it processed the data itself (s4(3)). A host or maintenance provider that holds backups or has database access can be a data intermediary. Under a written contract it still carries the protection and retention obligations and must notify you of a breach without undue delay (s26C(3)). You then assess whether it is notifiable.
Whether a given provider qualifies depends on the facts. Whatever the label, put these points in the contract:
- how quickly the provider will tell you about a suspected breach, in hours rather than “promptly”
- who holds backups and logs, where, and for how long
- who preserves evidence and who runs the clean-up
FAQ
Only if personal data was accessed, changed, copied or otherwise compromised. A defacement that never touched personal data is a security incident, not a PDPA data breach. Use your logs to show what the attacker reached.
It depends on the assessment. Names, emails and phone numbers alone are not obviously among the prescribed significant-harm data (check the Regulations' Schedule), but a breach affecting 500 or more individuals is notifiable regardless.
Yes, if the breach is notifiable because of significant harm: as soon as practicable, on or after notifying the PDPC. There are exceptions, for example where remedial action or a technological measure in place beforehand makes significant harm unlikely, and the PDPC can direct you not to notify.
You must state the reasons for the delay in your notification. As the PDPC's guide explains, unreasonable delay is a breach of the notification obligation and may lead to enforcement action.
The duty to assess and notify sits with the organisation that controls the data. A data intermediary must tell that organisation without undue delay. Your provider can help prepare the notification, but the responsibility stays with you.
Sources and notes
This article is general information, not legal advice. Whether an incident is notifiable depends on its facts, so take advice from a Singapore-qualified practitioner. Last reviewed 6 November 2026; check the current versions of the sources below.
- Personal Data Protection Act 2012, Singapore Statutes Online (text read was the consolidation in force from 1 October 2022)
- Personal Data Protection (Notification of Data Breaches) Regulations 2021, Singapore Statutes Online
- Guide on Managing and Notifying Data Breaches under the PDPA, PDPC (revised 15 March 2021)
- Re Marina Bay Sands Pte. Ltd. [2025] SGPDPC 6, PDPC decision, 28 October 2025
- Singapore: PDPC Fines Several Organizations, Baker McKenzie, 30 January 2026
- Report Your Organisation’s Data Breach, PDPC
