Initiative overview
Under Section 26 of Singapore’s Personal Data Protection Act, private organisations may transfer personal data outside Singapore if the recipient is subject to legally enforceable obligations that ensure a level of data protection comparable to that required under Singapore law. These requirements are operationalised through the Personal Data Protection Regulations 2021, which have been in force since 1 February 2021.
The framework does not impose data localisation requirements or restrict the use of foreign cloud service providers. Instead, it establishes conditions under which cross‑border data transfers — including those associated with cloud‑based AI training, processing, or analytics — may occur lawfully. Compliance mechanisms include contractual safeguards with overseas service providers, internal rules for intra‑group transfers, recognised certifications, or reliance on foreign legal regimes that provide comparable protection.
Guidance issued by the Personal Data Protection Commission (PDPC) clarifies how these statutory requirements apply in practice, including to cloud computing arrangements. While the guidance is non‑binding, it provides regulatory interpretation of the in‑force legal provisions. Overall, the PDPA cross‑border transfer regime addresses legal uncertainty related to international cloud use while maintaining enforceable data protection obligations for private organisations.
