# Singapore breach initial response: evidence, decisions and controlled rehearsal Starts when: An incident coordinator receives a suspected personal-data exposure report and opens an explicitly scoped initial-response exercise. Purpose: Coordinate initial containment, source-backed assessment and reviewed no-send response drafts; hand unresolved current-law, foreign-law and remediation work to named owners. Success is completion of the declared exercise phase, not resolution of a live breach. The canonical manifest controls execution. System and work-product references describe the work; they do not install integrations or establish that a document exists. ## As Is ### Suspected data exposure reported Performer: DPO / incident coordinator (control). - Then: Record the incident intake and initial uncertainty ### Record the incident intake and initial uncertainty Performer: DPO / incident coordinator (interactive). Fictional baseline: record the incident intake and initial uncertainty. Systems: Workflow Studio and native runner. - Then: Request supplier facts through separate follow-up ### Request supplier facts through separate follow-up Performer: Vendor liaison (interactive). Fictional baseline: request supplier facts through separate follow-up. Systems: Workflow Studio and native runner. - Then: Reconcile reports and assess legal questions manually ### Reconcile reports and assess legal questions manually Performer: Responsible Singapore counsel (interactive). Fictional baseline: reconcile reports and assess legal questions manually. Systems: Workflow Studio and native runner. - Then: Review the proposed initial response and unresolved work ### Review the proposed initial response and unresolved work Performer: Executive exercise sponsor (interactive). Fictional baseline: review the proposed initial response and unresolved work. Systems: Workflow Studio and native runner. - Then: Initial advice handed over with open follow-up work ### Initial advice handed over with open follow-up work Performer: DPO / incident coordinator (control). ## To Be ### Suspected data exposure report received Performer: DPO / incident coordinator (control). - Then: Confirm the scope and authority for the rehearsal ### Confirm the scope and authority for the rehearsal Performer: DPO / incident coordinator (interactive). Review the incident intake, confirm the exercise-only boundary and identify the decision owners. Refuse any live-use request that lacks operative-law verification and actual authority. Systems: Workflow Studio and native runner. Receives: Versioned incident reports. - Then: Has the exercise scope been accepted? ### Has the exercise scope been accepted? Performer: DPO / incident coordinator (control). - Accepted: start parallel investigations: Start containment, supplier enquiry and legal research - Refused: stop exercise: Exercise stopped: scope refused ### Start containment, supplier enquiry and legal research Performer: DPO / incident coordinator (control). - Then: Record containment and preserve incident logs - Then: Await and record the supplier investigation report - Then: Verify breach-response sources and record legal gaps ### Record containment and preserve incident logs Performer: Security and forensics (interactive). Record the simulated endpoint containment and preservation actions, their timing and uncertainty. This exercise does not change any production system. Systems: Simulated containment and log preservation, Workflow Studio and native runner. Receives: Versioned incident reports. - Then: Containment, supplier report and research recorded ### Await and record the supplier investigation report Performer: Vendor liaison (interactive). Obtain the provisional supplier report, preserve its qualifications and request an amendment identifying unique persons, jurisdictions and affected data categories. Systems: Simulated supplier report channel, Incident evidence workspace. Produces or updates: Versioned incident reports. - Then: Containment, supplier report and research recorded ### Verify breach-response sources and record legal gaps Performer: Host-operated legal methods and local records (automated). Responsible person or role: Responsible Singapore counsel. Follow browser discovery and the active owner-selected retrieval policy before live research. Distinguish an unavailable tool, a headless session, a normal browser and a publisher refusal; record each actual route. Consider appropriate authorised fallback routes, respecting explicit tool restrictions. Inspect the retrieved decision and guide, record versions and pinpoints, and identify unavailable operative statutory text. Disclose historical retrieval-method deviations and return a limited research record without inventing provisions. Systems: Research and PDPA assessment tools. Produces or updates: Sources and current-law gaps. - Then: Containment, supplier report and research recorded ### Containment, supplier report and research recorded Performer: DPO / incident coordinator (control). - Then: Collect versioned reports and request missing counts ### Collect versioned reports and request missing counts Performer: DPO / incident coordinator (interactive). Collect the incident and supplier reports in the evidence workspace. On rework, obtain the deduplicated amendment; preserve the earlier reports and unresolved factual assertions. Systems: Incident evidence workspace. Receives: Versioned incident reports. Produces or updates: Versioned incident reports. - Then: Extract incident facts with exact source spans ### Extract incident facts with exact source spans Performer: Host-operated legal methods and local records (automated). Responsible person or role: DPO / incident coordinator. Run the installed span method against the supplied reports. Keep row counts distinct from unique persons and preserve report qualifications; check every recorded quotation against the stored source. Systems: Incident evidence workspace. Receives: Versioned incident reports. Produces or updates: Source-linked incident facts. - Then: Reconcile affected-person counts and evidence gaps ### Reconcile affected-person counts and evidence gaps Performer: Responsible Singapore counsel (interactive). Review source-linked facts for unique-person totals, jurisdictions and affected data. Request corrected evidence if those facts remain unresolved; accept factual completeness without treating it as legal sufficiency. Systems: Incident evidence workspace, Workflow Studio and native runner. Receives: Source-linked incident facts. - Then: Are affected-person counts and facts sufficient? ### Are affected-person counts and facts sufficient? Performer: Responsible Singapore counsel (control). - Yes: assess the documented facts: Check selected PDPA issues against retrieved law - No: request a corrected report (bounded rework): Collect versioned reports and request missing counts ### Check selected PDPA issues against retrieved law Performer: Host-operated legal methods and local records (automated). Responsible person or role: Responsible Singapore counsel. Run the selected breach, protection and transfer checks. Retain failures where cited provisions lack retrieved text; do not convert guidance or a successful software task into a legal compliance conclusion. Systems: Research and PDPA assessment tools. Receives: Source-linked incident facts, Sources and current-law gaps. Produces or updates: PDPA review and failed checks. - Then: Decide whether the limited exercise may continue ### Decide whether the limited exercise may continue Performer: Responsible Singapore counsel (interactive). Inspect the actual failed statutory-text check and the supplied source-access audit. A failed browser client is not proof that every browser route failed. Record the retrieval-method deviations, then decide whether the explicitly guide-based exercise is acceptable; a live matter must stop for current-law verification. Systems: Research and PDPA assessment tools, Workflow Studio and native runner. Receives: PDPA review and failed checks. - Then: Is this an accepted exercise-only request? ### Is this an accepted exercise-only request? Performer: Responsible Singapore counsel (control). - Exercise-only input and explicit acceptance: Record proposed Singapore notification routes - Otherwise: stop for source verification: Live reliance stopped: verify operative law ### Record proposed Singapore notification routes Performer: Responsible Singapore counsel (interactive). Using only the exercise assumptions, record separate regulator and individual routes, the proposed trigger date and cleared rehearsal wording. Preserve unresolved operative-law and foreign-law questions. Systems: Workflow Studio and native runner. Receives: PDPA review and failed checks, Source-linked incident facts. Produces or updates: Proposed notification routes. - Then: Does the proposed route require regulator notice? ### Does the proposed route require regulator notice? Performer: Responsible Singapore counsel (control). - Yes: calculate and review the proposed date: Calculate the guide-based notification outer limit - No: record the exercise determination: Exercise complete: no notification route selected ### Calculate the guide-based notification outer limit Performer: Host-operated legal methods and local records (automated). Responsible person or role: DPO / incident coordinator. Apply the explicit three-calendar-day, no-roll exercise rule in the exact pinned engine. Return the date, trigger assumption, rule provenance and unverified-current-law limitation. Systems: Pinned deadline calculation engine. Receives: Proposed notification routes. Produces or updates: Proposed date and calculation trace. - Then: Review the trigger and proposed outer-limit date ### Review the trigger and proposed outer-limit date Performer: Responsible Singapore counsel (interactive). Inspect the calculation trace, calendar-day basis, trigger and no-weekend-extension rule. Accept or refuse the proposed exercise date; do not claim this verifies current legal timing requirements. Systems: Pinned deadline calculation engine, Workflow Studio and native runner. Receives: Proposed date and calculation trace. - Then: Has counsel accepted the proposed date? ### Has counsel accepted the proposed date? Performer: Responsible Singapore counsel (control). - Accepted: prepare the response pack: Prepare drafts, supplier clause and foreign-law handoff - Refused: stop before draft release: Exercise stopped: proposed date refused ### Prepare drafts, supplier clause and foreign-law handoff Performer: DPO / incident coordinator (control). - Then: Assemble marked no-send notification drafts - Then: Draft source-linked supplier cooperation wording - Then: Acknowledge handoff of foreign-law questions ### Assemble marked no-send notification drafts Performer: Host-operated legal methods and local records (automated). Responsible person or role: DPO / incident coordinator. Assemble regulator and individual drafts from the cleared exercise wording and reviewed date. Mark both drafts synthetic and not for submission; preserve unknowns and recipient boundaries. Systems: Incident evidence workspace. Receives: Proposed notification routes, Proposed date and calculation trace. Produces or updates: Marked no-send notification drafts. - Then: Drafts, clause and foreign handoff ready for review ### Draft source-linked supplier cooperation wording Performer: Host-operated legal methods and local records (automated). Responsible person or role: Responsible Singapore counsel. Run the drafting method for generic incident-information and cooperation wording. Include the source-limited note and unresolved negotiation points; do not add a statutory deadline from memory. Systems: Drafting and precedent tools. Receives: Sources and current-law gaps. Produces or updates: Supplier cooperation clause proposal. - Then: Drafts, clause and foreign handoff ready for review ### Acknowledge handoff of foreign-law questions Performer: Vendor liaison (interactive). Record the synthetic foreign-counsel investigation handoff and its limitations. Acknowledgement is not completion of foreign advice or satisfaction of a foreign notification duty. Systems: Workflow Studio and native runner. Receives: Proposed notification routes. - Then: Drafts, clause and foreign handoff ready for review ### Drafts, clause and foreign handoff ready for review Performer: DPO / incident coordinator (control). - Then: Approve or refuse the exact rehearsal drafts ### Approve or refuse the exact rehearsal drafts Performer: Executive exercise sponsor (interactive). Review the prepared drafts, date and foreign-law handoff. Approve only the precise no-send exercise wording or refuse continuation; record the synthetic actor and evidence. Systems: Workflow Studio and native runner. Receives: Marked no-send notification drafts. - Then: Has management approved the exact rehearsal text? ### Has management approved the exact rehearsal text? Performer: Executive exercise sponsor (control). - Approved: record a no-send receipt: Record a no-send regulator notification receipt - Refused: do not record notification: Exercise stopped: draft release refused ### Record a no-send regulator notification receipt Performer: Host-operated legal methods and local records (automated). Responsible person or role: DPO / incident coordinator. Write a local receipt tied to the exact regulator-draft hash and sent=false. No external regulator service is called. Systems: Local no-send receipt ledger. Receives: Marked no-send notification drafts. Produces or updates: No-send receipt records. - Then: Does the proposed route require individual notices? ### Does the proposed route require individual notices? Performer: Responsible Singapore counsel (control). - Yes: record an individual no-send receipt: Record a no-send individual notification receipt - No: proceed to follow-up actions: Assign unresolved legal and remediation actions ### Record a no-send individual notification receipt Performer: Host-operated legal methods and local records (automated). Responsible person or role: DPO / incident coordinator. Write a local receipt tied to the exact individual-draft hash and sent=false only when that route was selected. No email or individual contact occurs. Systems: Local no-send receipt ledger. Receives: Marked no-send notification drafts. Produces or updates: No-send receipt records. - Then: Assign unresolved legal and remediation actions ### Assign unresolved legal and remediation actions Performer: DPO / incident coordinator (interactive). Record owners for current-law verification, foreign advice, migration access tests and evidence of remediation. Keep those open actions separate from completion of the initial-response exercise. Systems: Workflow Studio and native runner. Produces or updates: Open legal and remediation actions. - Then: Decide whether generic wording may be retained ### Decide whether generic wording may be retained Performer: Knowledge and remediation owner (interactive). Separately review genericity, privacy and consent for optional precedent capture. Withhold consent while the known screen issue remains unresolved; preserve the draft in the private matter workspace. Systems: Workflow Studio and native runner, Drafting and precedent tools. Receives: Supplier cooperation clause proposal. - Then: Has the owner consented to optional capture? ### Has the owner consented to optional capture? Performer: Knowledge and remediation owner (control). - Consent recorded: attempt guarded capture: Screen and capture approved generic wording - No consent: retain the draft privately: Exercise complete: drafts retained privately ### Screen and capture approved generic wording Performer: Host-operated legal methods and local records (automated). Responsible person or role: Knowledge and remediation owner. Run the actual drafting capture guard with the original evidence identifiers and explicit consent. Record refusal as a failed task; do not change an identifier or bypass the guard to obtain success. Systems: Drafting and precedent tools. Receives: Supplier cooperation clause proposal. Produces or updates: Private precedent library. - Then: Exercise complete: approved generic wording captured ### Exercise stopped: scope refused Performer: DPO / incident coordinator (control). ### Live reliance stopped: verify operative law Performer: Responsible Singapore counsel (control). ### Exercise stopped: proposed date refused Performer: Responsible Singapore counsel (control). ### Exercise stopped: draft release refused Performer: Executive exercise sponsor (control). ### Exercise complete: no notification route selected Performer: Responsible Singapore counsel (control). ### Exercise complete: approved generic wording captured Performer: Knowledge and remediation owner (control). ### Exercise complete: drafts retained privately Performer: Knowledge and remediation owner (control).