Data Protection Monitor
Global Privacy & Data Protection Intelligence

Singapore (SG) · Module Detail

Singapore: Cross-Border & Adequacy

← Full Singapore overview Build report with Singapore Request deeper dive

#

Transfer regime is mature with recognised certification schemes (APEC CBPR/PRP) and model clauses, though Singapore is not a recipient of an EU adequacy decision.

Primary frameworkPersonal Data Protection Act 2012, as amended (Transfer Limitation Obligation, s.26)
Supervisory authorityPersonal Data Protection Commission (PDPC)
Traffic-light rationale — GreenTransfer regime is mature with recognised certification schemes (APEC CBPR/PRP) and model clauses, though Singapore is not a recipient of an EU adequacy decision.

Sub-modules (6)

Transfer MechanismsGreen

Comparable-protection standard under s.26, satisfiable via contract, consent, or recognised certification schemes.

Claims (2):

  • Section 26 of the PDPA prohibits an organisation from transferring personal data outside Singapore except where it can ensure a standard of protection comparable to the PDPA is maintained over the transferred data.
  • Since June 2020, the Personal Data Protection Regulations recognise APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) system certifications as a basis for compliance with the Transfer Limitation Obligation for overseas transfers.

Adequacy ReceivedRed

No confirmed record of Singapore receiving a formal adequacy-style determination from another regime (e.g., EU) was found in this pass.

Absence provenance: unavailable. Searched: Singapore EU adequacy decision GDPR, Singapore adequacy determination received.

Adequacy GrantedAmber

PDPC does not operate a GDPR-style adequacy-list mechanism; instead it relies on recognised certification (APEC CBPR/PRP) and contractual mechanisms as functional equivalents.

Absence provenance: unavailable. Searched: PDPC adequacy list granted third countries.

Sccs And BcrsGreen

ASEAN Model Contractual Clauses (tailored by PDPC) and APEC CBPR/PRP certifications function as the primary standard-clause/certification mechanisms.

Claims (1):

  • The PDPC has published guidance on tailoring the ASEAN Model Contractual Clauses (MCCs) to meet Singapore's Transfer Limitation Obligation requirements, and provides sample clauses for contracts with overseas recipients holding Global/APEC CBPR or PRP certification.

Transfer Impact AssessmentAmber

No codified TIA methodology; due diligence obligation is placed on the transferring organisation.

Claims (1):

  • The onus is on the transferring organisation to undertake appropriate due diligence and obtain assurances that an overseas recipient can maintain a standard of protection comparable to the PDPA before transferring personal data outside Singapore.

Data LocalisationGreen

No general data localisation mandate; recent EU-SG trade agreement further constrains unjustified localisation requirements.

Claims (1):

  • The EU-Singapore Digital Trade Agreement, which entered into force on 1 February 2026, prohibits unjustified data localisation requirements between the parties.
Category narrative206 words

<cite index="31-3,31-4">Section 26 of the PDPA limits the ability of an organization to transfer personal data outside Singapore; section 26(1) provides that an organization must not transfer any personal data outside Singapore except where it can ensure that a comparable standard of protection, as provided for under the PDPA, will be maintained.</cite> <cite index="51-25,51-26">Singapore is a participant of the APEC CBPR and PRP System, and in June 2020, the Personal Data Protection Regulations 2014 was amended to recognise the APEC CBPR and PRP system certifications for overseas transfers of personal data under the PDPA.</cite> <cite index="39-1,39-2">The PDPC has published guidance on how to tailor the ASEAN Model Contractual Clauses to meet Singapore's PDPC requirements, including sample clauses for contracts with overseas recipients holding Global/APEC CBPR/PRP certification.</cite> <cite index="34-1,34-2">The Transfer Limitation Obligation requires that an organisation ensures that personal data transferred overseas is protected to a standard comparable with the Data Protection Provisions, with the onus on the transferring organisation to undertake appropriate due diligence.</cite> No EU adequacy decision covering Singapore was located in this research pass. Data localisation is generally not mandated, and <cite index="5-7">the EU-Singapore Digital Trade Agreement entered into force on February 1, 2026, enhancing online consumer protection and prohibiting unjustified data localization requirements.</cite>

no periodic updates on record for this sub-brief

Sources and claims (5)
  1. ProbableInternational Association of Privacy Professionals — Section 26 of the PDPA prohibits an organisation from transferring personal data outside Singapore except where it can ensure a standard of protection comparable to the PDPA is maintained over the transferred data.observed
  2. ProbableOneTrust DataGuidance — Since June 2020, the Personal Data Protection Regulations recognise APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) system certifications as a basis for compliance with the Transfer Limitation Obligation for overseas transfers.observed
  3. ProbablePersonal Data Protection Commission — The PDPC has published guidance on tailoring the ASEAN Model Contractual Clauses (MCCs) to meet Singapore's Transfer Limitation Obligation requirements, and provides sample clauses for contracts with overseas recipients holding Global/APEC CBPR or PRP certification.observed
  4. ProbablePersonal Data Protection Commission — The onus is on the transferring organisation to undertake appropriate due diligence and obtain assurances that an overseas recipient can maintain a standard of protection comparable to the PDPA before transferring personal data outside Singapore.observed
  5. ProbableOneTrust DataGuidance — The EU-Singapore Digital Trade Agreement, which entered into force on 1 February 2026, prohibits unjustified data localisation requirements between the parties.observed