SingaporePersonal Data Protection Act, cross-border transfer
Personal Data Protection Act 2012, s.26
In force since .
A cross border transfer rule binding private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Singapore, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Singapore must ensure the recipient provides a standard of protection comparable to the PDPA, through a PDPC-prescribed mechanism, unless the PDPC has granted an exemption.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commission of Singapore (PDPC) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf
- Guidance body
- Personal Data Protection Commission of Singapore (PDPC)
- Open questions
- What makes a standard of protection "comparable to that under the PDPA" when the overseas recipient is bound by a contract rather than by a specified certification?
What it makes you log
Logging duty
Section 26(1) bars a transfer of personal data outside Singapore except in accordance with prescribed requirements ensuring comparable protection, and section 26(2) to (4) let the Commission exempt an organisation on conditions. It names no log, record or audit. The prescribed requirements sit in subsidiary legislation this row does not cite.
- Kind
- None
- As of
What this law does
Section 26(1) bars an organisation from transferring personal data to a country or territory outside Singapore except in accordance with requirements ensuring a standard of protection comparable to the PDPA; the PDPC may grant exemptions on application under s.26(2) and (3). This is a comparability-based mechanism, not a flat prohibition or a data-localization mandate; the specific instruments accepted as satisfying comparable protection sit in PDPA Regulations not read.
Section 26 sits in the original 2012 Act's Part 6 (Care of Personal Data), which the Act's own consolidated text records as having commenced alongside the rest of Parts 3 to 7.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .