[Attention Required] Reporting data breaches and cyber incidents to Singpass

Dear Partners,

Keeping the Singpass ecosystem secure

Cybersecurity attacks and data breaches are becoming increasingly prevalent across all sectors. Singpass is committed to maintaining a secure ecosystem so that our users remain protected. Every Singpass partner plays an important role, such as responding promptly when an incident occurs.

What we need from you

The Singpass API Services Agreement sets out the following obligations with regard to user protection.

When this applies:

• personal data received through Singpass services is accessed, collected, used, disclosed, modified or disposed of without authorisation, or a device storing such data is lost; or
• your App, or the systems that host, operate or support it, is subject to a cybersecurity attack, hack or threat, or to unauthorised access, modification or transfer of data.

What to do when you become aware:

• Notify us within 24 hours. Inform us promptly, and no later than 24 hours after you suspect a data breach or become aware of an incident. Do not delay notifying us due to pending investigation - you may share updates as more information becomes available. 
• Provide the information requested. Share all relevant details we request and assist us in responding to the incident.
• Be prepared to follow-up. We may request your external auditor's report within 7 days, or conduct a review of your security practices.
• Contact us at partnersupport@singpass.gov.sg.

Why early notification matters

Early notification allows us to assess the impact with sufficient context, contain the incident and act quickly to protect Singpass users from further harm. To safeguard the ecosystem, we may suspend a partner's services without prior notice. We will work with the partner to resume services once we are satisfied the risk has been reasonably addressed.

We would appreciate it if you could share this notice with your security and incident response teams and ensure that your escalation procedures include notifying Singpass in a timely manner.

Thank you for your support.

Best regards,

Singpass Partner Experience team