--- title: "Singapore — Cross-Border & Adequacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/singapore/cross-border-and-adequacy/ source_html: /jurisdictions/singapore/cross-border-and-adequacy/index.html description: "Singapore — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 5 claims Green ▾ # Transfer regime is mature with recognised certification schemes (APEC CBPR/PRP) and model clauses" generated_at: 2026-10-25T04:46:50Z content_sha256: 6fcaffc360042bdddb429e4680042fc542574a4f6a9a860be976ca110ba35412 generator: "fe-fleet/md-twin@1.0" --- # Singapore — Cross-Border & Adequacy | Data Protection Monitor ### D5Cross-Border & Adequacy6 sub-modules5 claimsGreen▾# Transfer regime is mature with recognised certification schemes (APEC CBPR/PRP) and model clauses, though Singapore is not a recipient of an EU adequacy decision. Primary framework Personal Data Protection Act 2012, as amended (Transfer Limitation Obligation, s.26) Supervisory authority [Personal Data Protection Commission (PDPC)](https://www.pdpc.gov.sg/) Traffic-light rationale — Green Transfer regime is mature with recognised certification schemes (APEC CBPR/PRP) and model clauses, though Singapore is not a recipient of an EU adequacy decision. #### Sub-modules (6) #### Transfer MechanismsGreen Comparable-protection standard under s.26, satisfiable via contract, consent, or recognised certification schemes. Claims (2): - Section 26 of the PDPA prohibits an organisation from transferring personal data outside Singapore except where it can ensure a standard of protection comparable to the PDPA is maintained over the transferred data. - Since June 2020, the Personal Data Protection Regulations recognise APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) system certifications as a basis for compliance with the Transfer Limitation Obligation for overseas transfers. #### Adequacy ReceivedRed No confirmed record of Singapore receiving a formal adequacy-style determination from another regime (e.g., EU) was found in this pass. Absence provenance: unavailable . Searched: Singapore EU adequacy decision GDPR, Singapore adequacy determination received. #### Adequacy GrantedAmber PDPC does not operate a GDPR-style adequacy-list mechanism; instead it relies on recognised certification (APEC CBPR/PRP) and contractual mechanisms as functional equivalents. Absence provenance: unavailable . Searched: PDPC adequacy list granted third countries. #### Sccs And BcrsGreen ASEAN Model Contractual Clauses (tailored by PDPC) and APEC CBPR/PRP certifications function as the primary standard-clause/certification mechanisms. Claims (1): - The PDPC has published guidance on tailoring the ASEAN Model Contractual Clauses (MCCs) to meet Singapore's Transfer Limitation Obligation requirements, and provides sample clauses for contracts with overseas recipients holding Global/APEC CBPR or PRP certification. #### Transfer Impact AssessmentAmber No codified TIA methodology; due diligence obligation is placed on the transferring organisation. Claims (1): - The onus is on the transferring organisation to undertake appropriate due diligence and obtain assurances that an overseas recipient can maintain a standard of protection comparable to the PDPA before transferring personal data outside Singapore. #### Data LocalisationGreen No general data localisation mandate; recent EU-SG trade agreement further constrains unjustified localisation requirements. Claims (1): - The EU-Singapore Digital Trade Agreement, which entered into force on 1 February 2026, prohibits unjustified data localisation requirements between the parties. Category narrative 206 words Section 26 of the PDPA limits the ability of an organization to transfer personal data outside Singapore; section 26(1) provides that an organization must not transfer any personal data outside Singapore except where it can ensure that a comparable standard of protection, as provided for under the PDPA, will be maintained. Singapore is a participant of the APEC CBPR and PRP System, and in June 2020, the Personal Data Protection Regulations 2014 was amended to recognise the APEC CBPR and PRP system certifications for overseas transfers of personal data under the PDPA. The PDPC has published guidance on how to tailor the ASEAN Model Contractual Clauses to meet Singapore's PDPC requirements, including sample clauses for contracts with overseas recipients holding Global/APEC CBPR/PRP certification. The Transfer Limitation Obligation requires that an organisation ensures that personal data transferred overseas is protected to a standard comparable with the Data Protection Provisions, with the onus on the transferring organisation to undertake appropriate due diligence. No EU adequacy decision covering Singapore was located in this research pass. Data localisation is generally not mandated, and the EU-Singapore Digital Trade Agreement entered into force on February 1, 2026, enhancing online consumer protection and prohibiting unjustified data localization requirements. no periodic updates on record for this sub-brief Evidence 5 Sources and claims (5) - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/the-personal-data-protection-framework-in-singapore) — Section 26 of the PDPA prohibits an organisation from transferring personal data outside Singapore except where it can ensure a standard of protection comparable to the PDPA is maintained over the transferred data.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/singapore_-_third_country_assessment_guidance_note_dataguidance.pdf) — Since June 2020, the Personal Data Protection Regulations recognise APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) system certifications as a basis for compliance with the Transfer Limitation Obligation for overseas transfers.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/organisations/resources/guidance-by-topic/guide-to-cross-border-data-transfers) — The PDPC has published guidance on tailoring the ASEAN Model Contractual Clauses (MCCs) to meet Singapore's Transfer Limitation Obligation requirements, and provides sample clauses for contracts with overseas recipients holding Global/APEC CBPR or PRP certification.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf) — The onus is on the transferring organisation to undertake appropriate due diligence and obtain assurances that an overseas recipient can maintain a standard of protection comparable to the PDPA before transferring personal data outside Singapore.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/singapore) — The EU-Singapore Digital Trade Agreement, which entered into force on 1 February 2026, prohibits unjustified data localisation requirements between the parties.observed 2026-07-29