Data Breach Notification Email: What to Include

The worst email a business ever writes is the one that says your data was in our care, and it is no longer. Written well, a breach notification limits real harm to real people and preserves a fragment of trust from a bad situation; written badly, it compounds the breach with a second failure of candour. This guide builds the notification, on the official response guides' spine and Singapore's PDPA clock.

Two Notifications, One Incident

A breach triggers two notification tracks, the regulator and the affected individuals, and the emails differ in law and in tone, because the regulator needs facts on a deadline while individuals need protection steps they can act on tonight. Official breach-response guidance separates the audiences explicitly: notification to authorities follows the regulator's process, and notification to individuals carries the plain-language facts and steps. Legal counsel sets the track; this email is the individual one. Confusing the two is the classic first-draft error, a letter written to sound defensible in a hearing rather than useful on a phone screen, and recipients can smell the difference even if they cannot name it.

The Singapore Clock

Singapore's PDPA requires notifying the PDPC as soon as practicable, and no later than three calendar days after determining a breach is notifiable, with affected individuals informed as soon as practicable, and breaches qualify when they risk significant harm or touch five hundred or more people.

• Notification to the PDPC: as soon as practicable, no later than 3 calendar days after determining the breach is notifiable.
• Notification to affected individuals: as soon as practicable after assessment.
• Notifiable triggers: likely significant harm to individuals, or significant scale of 500 or more affected.
• The three-day clock starts at determination, not discovery; the assessment period before it must be documented.

The three-day clock starts at determination, not discovery; the assessment period before it must be documented. Confirm your own case against the official PDPC guide and the regulations before drafting anything, because thresholds and deadlines are exactly the facts that change and exactly the facts a breach letter gets audited against.

The Five-Fact Body

The notification body runs five facts: what happened and when, what data was involved, what you have done, what the recipient should do now, and where to reach a real contact.

1. What happened: on 2 December we discovered unauthorised access to one customer database, detected and closed the same day.
2. What data: the database held names, email addresses and hashed passwords; no payment card data was stored there.
3. What we have done: access is closed, the credential is rotated, and an independent review of the system is underway.
4. What you should do: change your password on our site and anywhere you reused it; watch for phishing emails citing this incident.
5. The contact: our support line 6555 0188 and dpo@yourco.com, staffed for this event through January.

Name the data types specifically; vague breaches read as unassessed breaches. Official sample letters structure the five facts in this order because recipients read for themselves first, my data, my risk, my next step, and the order serves the reader who is skimming under stress.

Protection Steps the Recipient Can Take

The steps are concrete and ranked by risk, password changes if credentials were exposed, card monitoring if payment data moved, watchpoints for phishing that will cite this very incident, because exposure becomes damage only through the steps people fail to take. Best-practice guidance insists on naming the data types precisely because the protection steps derive from them: hashed passwords mean a reset, exposed card numbers mean a bank call, identity data means watching for accounts opened in your name. Include the phishing warning; breach follow-ups are the scam industry's favourite costume, and the email that warns about it spares recipients the second wave. Where credit monitoring is warranted, it appears as a concrete enrolment step with a deadline, not a coupon code at the bottom.

Tone Without Panic or Disguise

The tone is plain and accountable, apology once, no minimising adjectives, no jargon load, and no burying the data types three paragraphs down, because recipients skim under stress and the reading conditions are part of the writing problem. Official guidance and practical template sets converge on the same register: state the facts, take the responsibility, help the reader act. Write for the person reading on a phone at 9pm; front-load every fact. We take security very seriously is the sentence to delete on sight, it spends a line saying nothing at the exact moment every line matters. The company that writes like a human in its worst email keeps a credibility the incidents cannot spend.

Compliance Writing as Business English

Breach notices, privacy updates and policy changes form the compliance register where precision protects people and the company at once, and marked small-group practice keeps that writing human at the worst possible moment. iWorld Learning's Business English small-group classes rehearse exactly this register in classes of three to six, where a marking teacher reads for the skimming recipient before the regulator does. Archive the sent notice and the timeline; the next incident starts from the last one's record.

Frequently Asked Questions

Does a lawyer need to review the notification?

Yes; counsel confirms whether the breach is notifiable, what the regulator track requires and what the letter may lawfully say about cause, before any send.

What if we discover the breach's full scope later?

Send the confirmed facts on time and follow up when scope changes; a late complete notice hurts more than a timely honest one with a promised update.

Should we offer credit monitoring?

Offer it where financial or identity data was exposed, stated as a concrete enrolment step with a deadline, because an offer buried in fine print protects nobody.