Document text
Date: [DD MONTH YYYY]
Sent by [E-MAIL TO THE COMPANY'S DATA PROTECTION CONTACT / REGISTERED POST / BY HAND]
To:
[COMPANY NAME]
Attention: [DATA PROTECTION OFFICER / CUSTOMER SERVICE / COMPLIANCE]
[COMPANY ADDRESS OR E-MAIL]
From:
[YOUR FULL NAME AS IN NRIC / PASSPORT]
[NRIC NO. — LAST 4 DIGITS ONLY / PASSPORT NO. — LAST 4 DIGITS ONLY]
[YOUR ADDRESS]
[PHONE] · [E-MAIL]
[CUSTOMER / ACCOUNT / MEMBERSHIP NO., IF ANY]
Subject: Data breach of [DATE OR "ANNOUNCED ON (DATE)"] — information request and data access request under sections 30 and 31 of the Personal Data Protection Act 2010
Dear Sir / Madam,
On [DATE] I learned that your company had a personal data breach: [YOUR NOTICE TO ME BY E-MAIL / SMS DATED (DATE) / YOUR PUBLIC ANNOUNCEMENT OF (DATE) / NEWS REPORTS OF (DATE)]. I am your [CUSTOMER / MEMBER / USER / FORMER CUSTOMER] since [YEAR].
1. Information I ask you to give me about the breach
No. Question Your answer
1 Was my personal data in the data that was accessed, copied or lost?
2 Which categories of my data were affected (for example name, NRIC number, address, phone, e-mail, bank or card details, account login, health data)?
3 When did the breach happen and when did you discover it?
4 Have you notified the Personal Data Protection Commissioner? On what date?
5 What have you done to contain the breach and to protect my data now?
6 What should I do to protect myself (for example change passwords, watch for phishing, contact my bank)?
7 Who in your company can I contact about this, and how?
2. Data access request (sections 30 and 31 of the Act)
Under section 30 of the Personal Data Protection Act 2010 I request:
1. to be informed whether you process my personal data;
2. a description of the personal data about me that you process; and
3. a copy of that personal data in an intelligible form.
To identify me, please use: [FULL NAME, CUSTOMER / ACCOUNT NO., E-MAIL OR PHONE REGISTERED WITH YOU]. If you need further information to locate my data, or if a fee applies, please tell me promptly.
Under section 31 you must comply with this request not later than 21 days after you receive it. If you cannot comply in that time, please inform me in writing before the 21 days end, give me what you can, and comply in full within 14 days after that. If you refuse, section 33 requires you to tell me in writing, with reasons, within the same 21 days.
3. Other requests
[OPTIONAL] Please correct the following data that is inaccurate: [DETAILS].
[OPTIONAL] Please stop sending me marketing messages.
[OPTIONAL] Please confirm whether you still need to keep my data, given that my account was closed on [DATE].
Please reply in writing to [E-MAIL / ADDRESS].
If I do not receive a full reply within the time set by the Act, I may make a complaint to the Personal Data Protection Commissioner under section 104 of the Act.
Yours faithfully,
______________________________
[YOUR FULL NAME]
Attachments:
1. Copy of your notice about the breach / screenshot of the announcement, dated [DATE].
2. [COPY OF IDENTITY DOCUMENT — ONLY IF THE COMPANY ASKS FOR IT, WITH UNNEEDED NUMBERS COVERED].
BEFORE SENDING — delete this part
Write down the date the company receives this letter. The 21 days run from receipt. Keep the e-mail delivery record or the registered post slip.
Do not send your full NRIC number, passwords or card details in an e-mail. Give only what is needed to find your records.
Credit reporting agencies. Information processed for a credit reporting business by a credit reporting agency is not "personal data" under this Act; those agencies are regulated by the Credit Reporting Agencies Act 2010. You can still use part 1 of this letter to ask what happened.
Government bodies. The Act does not apply to the Federal Government and State Governments.
Field labels in [SQUARE BRACKETS, CAPITALS] must be completed or deleted. Alternatives are separated by a slash. © Layers (layers.md), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Template, not legal advice.
Reply to this document or get a deadline reminder: https://layers.md/my/data-breach-letter-pdpa?from=reply-my-rez-data-breach