Data breach spokesperson lines in Singapore have one job: say what happened, what you are doing, and what people should do now, in sentences a tired human can say without reading twice. The email to customers is the floor. The spoken line on the phone, on camera, and in the staff town hall is where trust is won or lost.
This is the language companion to our PDPA breach communications Singapore guide. That piece covers the clocks, the RACI, and the checklist. This one fixes the words. Every line below assumes Legal and your DPO own the facts, and Comms owns whether a person can say them.
Educational note: This is communications guidance, not legal advice and not a PDPC position. Confirm every public line with counsel and your DPO, and check the live PDPC guide on managing and notifying data breaches before you brief anyone.
Why does a correct notice still sound cold?
Because compliance English is written to survive review, not to be heard. It stacks clauses and hides the verb.
People do not repeat notices. They repeat what the spokesperson said. So the spoken line has to carry the same facts in shorter sentences.
The parent guide puts it plainly: lead with reader agency, separate facts from empathy, and name uncertainty honestly. Here is what that sounds like out loud.
Which five data breach spokesperson lines cover most questions?
Five sentences. One job each. No adjectives Legal has not cleared.
| Job | What it does | Say this |
|---|---|---|
| Fact | States what you know, no more | “We found that some customer data was accessed without permission.” |
| Scope | Names what is still unknown | “We are still confirming how many accounts are affected.” |
| Action | Says what you did, with a checkable verb | “We have locked the affected system and are working with investigators.” |
| Reader step | Tells people what to do this week | “Please change your password and watch for messages asking for payment details.” |
| Contact | Gives a human route | “You can reach our response team at the number in your notice.” |
Read together:
We found that some customer data was accessed without permission. We are still confirming how many accounts are affected. We have locked the affected system and are working with investigators. Please change your password and watch for messages asking for payment details. You can reach our response team at the number in your notice.
Around 60 words. Twenty seconds out loud. Every sentence can be checked.
Which phrases break trust on the first read?
Most bad breach lines fail on one phrase. These are the usual suspects.
| Phrase | Why it burns you | Say instead |
|---|---|---|
| “There is no risk of harm” | Promises an outcome before assessment is done | “Here is what we know, and here is what you can do now.” |
| “The incident is fully contained” | Often false on day one, and retracted by day three | “We have locked the affected system. We will confirm when the review is complete.” |
| “We take privacy seriously” | Everyone says it. Nobody believes it mid-incident | Show it with the reader step and the contact line. |
| “A sophisticated attack” | Sounds like an excuse before facts exist | “Some data was accessed without permission. We are finding out how.” |
| “A vendor caused this” | Blames before the chronology is agreed | “We are working with our service providers to confirm what happened.” |
| “Only a small number of users” | False precision you may have to walk back | “We are still confirming the number of accounts affected.” |
Put this table beside the spokesperson’s notes.
How is a trust narrative different from the notice?
Keep the PDPC notification language for the notice. Then write the version people actually read. Keep both. Do not ship only the first.
| Job | Compliance notice | Trust narrative |
|---|---|---|
| First line | Cites the Act | Says what happened, as known |
| Data | “Personal data as defined…” | Names categories in ordinary words: names, mobile numbers, account IDs |
| Ruled out | Not mentioned | Names what you have ruled out, once confirmed and cleared |
| Action | “We are investigating” | Names the containment step already done |
| Next step | “We will be in touch” | Names the page and the next update time |
| Channel | A generic privacy inbox | One inbox, one phone line with hours, one page |
If you cannot fill the blanks, you are not ready to publish. You are ready to draft.
How do you say “we don’t know yet” without sounding evasive?
Name the unknown, then name the next update. That pair is the whole trick.
“We don’t know yet” alone sounds like hiding. “We are still confirming how many accounts are affected. We will update you by Friday” sounds like a team at work. Never fill the gap with a guess to sound confident.
What changes for employees, partners and the board?
Same facts, different room. The parent guide asks for internal lines that match the external notice in the same hour.
| Audience | Their question | Say this |
|---|---|---|
| Employees | “What do I tell people?” | “Please do not post or comment. Send all questions to the response inbox. Here is the customer notice.” |
| Partners | “Are my customers affected?” | “Here is what we know so far. We will tell you before we publish anything that affects your customers.” |
| Board | “Where are we on the clock?” | “Assessment is in progress. Here is what is known, what is unknown, and when we expect to decide.” |
| Contact centre | “Was my account in it?” | “I can confirm whether your account is in the notified set. I cannot add facts that are not on the page.” |
| Vendors | “What can we tell our staff?” | “Use the customer notice. No extra colour, and no guesses about who was involved.” |
If a line cannot be read from a phone screen, it will not be used at the counter.
How does the 72-hour line sheet work as texts?
Write each owner’s instruction as a text they can send. Times are illustrative. Your clock starts from your own facts, and your counsel reads the deadlines, not this post.
| Window | Owner | Text they send |
|---|---|---|
| Hour 0 | DPO | “Possible data incident. War room open. Nobody posts until Legal replies.” |
| Hour 1 | Head of Comms | “Holding line v0 attached. Spokesperson is me. Freeze scheduled posts.” |
| Hour 6 | Legal | “Known / unknown / do-not-say sheet attached. Use only these facts.” |
| Day 1 | Head of Comms | “Five-sentence block drafted. DPO and Legal, approve or strike by 5pm.” |
| On notification | CEO office | “Customer notice goes out now. Staff line and partner brief go in the same hour.” |
| After send | Head of Comms | “Next update time is in the notice. Log every media and customer question.” |
The parent guide sets the real clocks: assess within 30 calendar days of credible grounds, and notify the Commission within three calendar days once a breach is found notifiable. Your sheet should never promise the public a determination before that assessment is documented.
Monday field kit
Do these before you ever need them.
- Draft your five-sentence block now with blanks for facts, scope, and contact. Get Legal and the DPO to pre-clear the shape.
- Paste the “phrases that break trust” table into the crisis folder and the spokesperson’s phone.
- Pre-write the employee, partner, board, and frontline lines.
- Run a 20-minute read-aloud drill. The most junior person reads the block. Cut anything they stumble on.
- Test the reader step on someone outside Comms. If they cannot say what to do next, rewrite it.
FAQs
What should a data breach spokesperson say first?
State what you know in one sentence, then what is still unknown. Follow with what you have done, what people should do now, and how to reach a human. Keep every line inside the facts Legal and the DPO have cleared.
Should we say “no customer data was affected” early?
Only if your DPO and counsel have confirmed it in writing. On day one, “we are still confirming” is safer than a claim you may have to retract.
Can the spokesperson say how many people are affected?
Say a number only when it is confirmed and cleared. Until then, say you are still confirming the number and give the next update time.
Does this replace the PDPA notice?
No. The notice to the Commission and to individuals is a legal step owned by the organisation and counsel. These lines make the spoken version match it.
Where should the public English live?
On one public page. The notice, social posts, and staff cards all point there. Three versions of the first sentence is how rumours start.
What to do next
Write the block, clear it, and drill it this week. For clocks, RACI, and the full checklist, go back to the PDPA breach communications Singapore guide. For night-shift holding lines, see POFMA holding lines you can say at 2am. For page-admin scripts, see OSA brand-admin English.
Need a drill partner in Singapore? Start at Singapore crisis and issues communications, Crisis rapid response, Singapore public affairs, or Contact. More in Insights.