The Amendment Act has introduced a new Section 12B and imposed a mandatory personal data breach notification obligation on data controllers. These amendments have come into operation on June 01, 2025. A data controller shall notify the Commissioner as soon as possible if he has reason to believe that a personal data breach has occurred and it causes or is likely to cause significant harm. The ‘significant harm’ requirement is satisfied where there is a risk that the compromised personal data: 

• May result in physical harm, financial loss, a negative effect on credit records or damage to or loss of property;
• May be misused for illegal purposes;
• Consists of sensitive personal data;
• Consists of personal data and other personal data which, when combined, could potentially enable identity fraud; or
• Is of significant scale (i.e. the number of affected data subjects exceeds 1,000). 

If the personal data breach causes or is likely to cause any significant harm to the data subject, the data controller shall also notify the data subject of such data breach without unnecessary delay. The above list defining significant harm for notifying the Commissioner also applies to the notification to data subjects, except the criterion on significant scale. 

The DBN Guidelines have also provided for the manner and form and timeframe for a data breach notification and the duty for data controllers to conduct assessments and maintain records of data breaches.