Consumers in Singapore will have more protection when the law is changed to prevent organisations dealing with their personal information from keeping quiet on data breaches.

The Personal Data Protection Act (PDPA) will be revised, and the amended Bill tabled in Parliament next year, in keeping with developments in mature jurisdictions like Australia, South Korea and Europe.

Individuals in Singapore affected by data breaches must be notified as soon as practicable. The Personal Data Protection Commission must also be notified no later than 72 hours from the time the breach is identified.

The need for mandatory breach disclosure became more apparent after it came to light late last year that Uber had covered up for more than a year a massive breach involving the personal details of 57 million passengers and drivers, of which 380,000 lived in Singapore.

It was the country's largest data leak. But it was not clear if the current laws in Singapore requiring companies to protect the personal data of their customers also extended to Uber.

While Uber has an office in nearly every country it operates in, including Singapore, the local Uber outfit may not own and process consumers' personal data. With the amended laws, however, Uber's obligations will be more clearly spelt out. And it would face enforcement action for hiding the breach from consumers and the local authorities.

As lawyer Gilbert Leong, senior partner at Dentons Rodyk & Davidson, said: "Without mandatory disclosure requirements, consumers' position is considerably weakened."

Changes to the PDPA also include concessions to businesses, especially those that deal with the Internet of Things, the next big tech revolution on the horizon. They will be allowed to collect and use the personal data of consumers without their consent.

These changes are timely to keep Singapore in step with the rapidly changing digital landscape.