Singapore data-breach response
The revised 1.3.0 workflow explains the business work as well as its routing: 41 nodes, seven swimlanes, eight systems and eleven work products. Six human roles hold responsibility and decision authority; a separate system lane performs host-operated methods and records. Systems used appear above activities, documents and data stores below them. Decision questions and labelled answers explain the routes.
This is an actual software run informed by published official material. The incident facts, all role decisions and all notification effects remain synthetic. The exercise does not establish operative law, authenticated decision rights or live notification delivery. Original immutable releases and prior capture records remain available in version history.
The scenario is informed by the published 2023 SGPDPC 13 decision and the PDPC breach-management guide, revised March 2021. It is not a reconstruction of the organisation's internal process.
Read the revised process
Full-size BPMN · Interchange model · Generated step-by-step operator guide · Version, execution and capture evidence.
The complete overview shows the boundary and parallel routes. Use the detail views and operator guide to read individual activities; a thumbnail cannot make 41 nodes legible. The guide describes the trigger, purpose, every performer, accountable role, system, input/output work product, instruction and next route.
Use the revised workflow
The particular 1.3.0 release is a local verification artifact, not a workflow bundled by a fresh installation. Use the supplied incident starter for a new design, or reproduce this model through the design, capability-review, acceptance and release journey.
Design and delivery: record the phase boundary and business outcome; describe activities as actions on objects; identify human performers, system methods and work products; phrase gateways as questions and branches as answers. Review the generated operator guide alongside schemas and mappings. Obtain design approval, resolve the methods, test the exact blueprint and obtain release approval before reuse. System annotations describe use; they do not create integrations or prove that a document exists.
This is the actual unapproved 1.4.0 working revision created from release 1.3.0. Canvas zoom and selection change presentation only. The immutable release remains available.
Matter reuse: select release 1.3.0; supply matter facts and the source-access audit; confirm scope; investigate in parallel; collect and extract reports; reject incomplete counts and repeat collection; assess source sufficiency; decide the exercise route; review the proposed date; prepare and approve the exact no-send drafts; record only eligible receipts; assign follow-up work; decide retention separately. Each decision is recorded against the runner's issued task. The generated operator guide provides each node's current instructions and handoffs.
The new required source-access report discloses the original headless-browser failure and retrieval-method deviations. The replay reuses the historical research output; it makes no new SSO or PDPC request. Earlier research fixes were present in the pin. An alternative copy can resolve access while leaving operative-version verification open.
Eleven acceptance scenarios verify refusal routes, rework limits, notification variants, capture refusal and checkpoint recovery. Two matters reuse the same released blueprint: the main exercise completes 23 tasks; the scale-only variant completes 22 and omits the individual receipt. Fresh Studio host runs independently exercise completion and the actual capture-screen failure. No external notification is sent. Missing statutory text, foreign-law review and the capture false positive remain unresolved.