Singapore

Section 2 defines an 'organisation' to include any individual, company, association or body of persons. It covers corporate and unincorporated bodies alike. It applies whether or not the body is formed or recognised under the law of Singapore. It applies whether or not the body lives here, or has an office or place of business here. Section 11(3) requires you to name one or more individuals responsible for compliance. Most people call that person the Data Protection Officer. Section 11(5) requires you to publish their business contact information. Neither section says that person must be based in Singapore. Section 4 sets out the exclusions. Individuals acting personally or at home. Employees acting in the course of their job. Public agencies, which are covered instead by the Public Sector (Governance) Act 2018. Business contact information. Records over 100 years old. And individuals dead more than 10 years. A supplier handling data for you under a written contract is relieved of most duties. It is not relieved of the security and retention duties.

Section 26(1) of the Personal Data Protection Act 2012 bans a transfer unless you follow the requirements set under the Act. Those requirements exist to make sure data you send abroad gets protection comparable to the protection under the Act. The detailed requirements sit in Part 3 of the Personal Data Protection Regulations 2021. There is no country list of any kind, populated or empty. Industry by industry on 18 August 2026, each rated separately: - Banking and merchant banking (conditional): Monetary Authority of Singapore Notice 658 and Notice 1121 cover outsourced services involving customer information. They expressly allow the work to be done overseas. They set conditions rather than a ban. Note the trap. The previous rulebook, Notice 634 and the Guidelines on Outsourcing, was cancelled on 11 December 2024. - Insurance, capital markets, payments and trust companies (conditional): covered by the Guidelines on Outsourcing (Financial Institutions other than Banks), effective 11 December 2024. Nothing about keeping data in the country. - Health (conditional): the Healthcare Services Act 2020 requires records to be kept and secured but says nothing about where. The Health Information Act 2026 has been passed but has not started. It says nothing about where data must sit either. - Telecoms (open): the Telecommunications Act 1999, as in force from 1 October 2025, says nothing about keeping anything inside Singapore. - Critical information infrastructure (a copy stays here in reality, not by law): the Cybersecurity Act 2018 applies to systems located wholly or partly in Singapore. Since 31 October 2025 it also applies to a system located wholly outside Singapore that is owned by a person in Singapore. It governs security, not location. - Company accounting records (a copy stays here): the Companies Act 1967 allows records to be kept abroad. But statements and returns must be sent to and kept in Singapore. - Mapping, gaming, education and defence: we found no rule about where data must sit, checked 18 August 2026, with medium confidence.

Regulation 10(1) of the Personal Data Protection Regulations 2021 requires you to take appropriate steps before you send data. You must check and make sure the recipient is bound by legally enforceable duties. Regulation 11 lists what counts: any law, a contract, binding corporate rules, or any other legally binding document. A qualifying contract must do two things. It must require comparable protection. And it must name the countries and territories the data may be sent to. Binding corporate rules may only be used between related companies. They must name the recipients, the destinations, and the rights and duties they create. Regulation 12 treats a recipient as compliant if it holds a specified certification. As amended by S 86/2026, with effect from 2 March 2026, this now covers four schemes for suppliers who handle data for others. Two are run by Asia-Pacific Economic Cooperation: the APEC Privacy Recognition for Processors System and the APEC Cross-Border Privacy Rules System. The other two are the Global Privacy Recognition for Processors System and the Global Cross-Border Privacy Rules System. For everyone else, the two Cross-Border Privacy Rules systems count. Regulation 10(2) lists situations where the requirement counts as met. The person consents. But that consent is invalid unless you first gave them a written summary of the protection the destination offers. You also cannot force consent as a condition of a product unless it is really necessary. Deemed consent under section 15 also counts. So does a transfer needed for a use allowed without consent. So does data in transit, and data already publicly available in Singapore. The Commission can also exempt a named organisation from the transfer requirements under section 26(2). That exemption need not be published in the Gazette. It can be revoked at any time.

Section 5 of the Personal Data Protection Act 2012 designates the Info-communications Media Development Authority as the Personal Data Protection Commission. So the Commission is not a separate legal body. Here is the evidence that it works in reality, not just on paper. It published batches of decisions and undertakings on 3 July 2025, 31 July 2025, 7 August 2025, 3 September 2025 and 2 October 2025. More followed on 28 October 2025, 4 December 2025, 8 January 2026, 26 February 2026 and 9 April 2026. All are listed on its own site. On 2 February 2026 it announced it will step up enforcement on misuse of national identity numbers. The Commission can issue directions under section 48I and financial penalties under section 48J. The maximum is 10 per cent of annual turnover in Singapore, where your Singapore turnover is over 10 million Singapore dollars (about 7.8 million US dollars). Otherwise the maximum is 1 million Singapore dollars (about 780,000 US dollars). That maximum has applied since 1 October 2022. Individuals can also sue directly under section 48O. The Monetary Authority of Singapore replaced its entire outsourcing rulebook on 11 December 2024. It replaced its technology risk and cyber hygiene notices on 10 May 2024. That is a sign of active supervision, not idle supervision. The Commissioner of Cybersecurity issued a new Cybersecurity Code of Practice for Critical Information Infrastructure on 29 July 2026.

The maximum. Section 25 of the Personal Data Protection Act 2012 says you must stop keeping documents that contain personal data. You can instead strip out the link to particular individuals. This applies as soon as it is reasonable to assume the purpose is no longer served. It also requires that keeping the data is no longer necessary for legal or business purposes. The minimum. Companies Act 1967 section 199(2) sets five years from the end of the financial year. The tax authority applies five years from the relevant Year of Assessment. That comes from the Income Tax Act 1947 and the Goods and Services Tax Act 1993. Penalties run to 5,000 Singapore dollars (about 3,900 US dollars) and up to six months in prison. The Ministry of Manpower requires employment records for the latest two years for current employees. For someone who leaves, the last two years of records are kept for one year afterwards. For a struck-off or wound-up company, an officer or the liquidator must keep the books for five years after dissolution. How the clash resolves. Usually it never becomes a clash, because section 25(b) itself allows you to keep data still needed for legal purposes. Where it does clash, section 4(6)(b) of the Act settles it. Other written law wins to the extent of any inconsistency. Location matters here too. Companies Act section 199(4) allows accounting records to be held abroad. But statements and returns good enough to prepare true and fair financial statements must be sent to and kept in Singapore.

Privacy deadline. Sections 26C and 26D of the Personal Data Protection Act 2012. Once you have reason to believe a breach happened, you must assess it 'in a reasonable and expeditious manner'. There is no fixed deadline for the assessment itself. The three-day clock starts only when your assessment concludes that the breach is notifiable. A breach is notifiable if it causes or is likely to cause significant harm. It is also notifiable if it is or is likely to be of significant scale. The Personal Data Protection (Notification of Data Breaches) Regulations 2021 set the significant-scale threshold at 500 affected individuals. You must tell affected individuals on or after you tell the regulator, in any reasonable manner. That applies where the significant-harm test is met. A breach kept inside one organisation is treated as not notifiable. A supplier who handles data for you must tell you without undue delay. The duty to assess then falls on you. Finance deadline. Monetary Authority of Singapore Notice FSM-N25 requires notification 'as soon as possible, but not later than 1 hour, upon the discovery of a relevant incident'. A root cause and impact analysis report follows within 14 days. Parallel notices apply to other supervised firms. The old Notices 644, 655, 644A, 655A, 1114 and 1118 were cancelled with effect from 10 May 2024. Compliance manuals that still cite them are out of date. Cyber deadline. Section 14 of the Cybersecurity Act 2018 requires notification within the prescribed period. The Cyber Security Agency states the period is 2 hours from the moment you become aware. You call the number set out in Singapore's national cybersecurity incident response plan. Supplementary details follow within 72 hours. Since 31 October 2025 the duty also covers incidents on a supplier's interconnected systems. A fourth deadline is coming for healthcare once the Health Information Act 2026 starts. It creates separate duties to report notifiable cybersecurity incidents and notifiable data breaches. The periods will be set by regulations that do not yet exist.

1. Criminal, not just administrative. Sections 48D, 48E and 48F of the Personal Data Protection Act 2012 create offences for an INDIVIDUAL. It is an offence to knowingly or recklessly disclose personal data without authorisation. It is an offence to misuse it for gain or to cause harm. And it is an offence to re-identify anonymised information. The maximum is a fine of 5,000 Singapore dollars (about 3,900 US dollars), two years in prison, or both. It applies personally to employees and contractor staff, including those handling government data. Sections 7 and 8 of the Public Sector (Governance) Act 2018 create matching offences with the same maximum, for people working inside public sector agencies. 2. Other law wins. Section 4(6)(b) says other written law prevails wherever the privacy duties are inconsistent with it. So a permissive answer under the privacy law is worth nothing if a banking secrecy duty, a professional secrecy duty or a licence condition says otherwise. 3. The national identity number deadline. On 2 February 2026 the regulator announced that organisations must stop using National Registration Identity Card numbers to check who someone is by 31 December 2026. It said it will step up enforcement. Using a national identity number as a password, a default PIN or a proof of identity is the exact pattern being targeted. 4. A sleeping duty inside the statute. Part 6B of the Act is the data portability duty. It was enacted by the Personal Data Protection (Amendment) Act 2020. It is referred to throughout the in-force text, in sections 4 and 48J among others. Yet the Part itself has never been started. A naive reading of the Act will report a portability right that does not currently exist. It can be switched on by a commencement notification. 5. Stale banking guidance. Monetary Authority of Singapore Notice 634, on banking secrecy conditions for outsourcing, was cancelled with effect from 11 December 2024. The well-known Guidelines on Outsourcing, dated 2016 and revised 2018, are also marked cancelled. They were replaced by Notice 658 for banks and Notice 1121 for merchant banks. There are also separate Guidelines on Outsourcing for banks and for non-banks. All took effect on 11 December 2024. 6. One more, for consumer products. The regulator issued separate Advisory Guidelines for children's personal data in the digital environment in March 2024. Treat children's data as its own piece of work rather than assuming the general rules cover it.

Landing within twelve months, with dates: - 31 December 2026: the deadline to stop using National Registration Identity Card numbers to check who someone is. In February 2026 the regulator said it will step up enforcement. - Health Information Act 2026 (Act No. 1 of 2026): passed by Parliament on 12 January 2026, assented to on 3 February 2026 and published on 12 February 2026. It was still listed as Uncommenced on 18 August 2026. It creates a national electronic records system that named providers must contribute to. It adds new data security and retention duties. It adds separate duties to report cybersecurity incidents and data breaches, with the periods still to be set. It also creates a health data portability right. No start date has been announced. - Digital Infrastructure Bill: a draft was published for public consultation on 1 July 2026, closing 22 July 2026. It would licence data centre facility services in data centres with a critical information technology load of 10 megawatts or more. It would also licence cloud infrastructure and platform services earning 100 million Singapore dollars or more a year from Singapore users. That is about 78 million US dollars. Software-as-a-service is excluded. It would also make related changes to the Cybersecurity Act. It is a draft, not law. - The Monetary Authority of Singapore is consulting on new guidelines covering financial institutions' use of third-party services. POWERS THE GOVERNMENT ALREADY HOLDS, which matter more than the pending bills because they need no consultation: 1. Cybersecurity Act Parts 3C and 3D. The Cybersecurity (Amendment) Act 2024 started on 31 October 2025. The definitions of 'entity of special cybersecurity interest' and 'major foundational digital infrastructure service provider' are in force TODAY. So are the clauses in section 3(2E) to (2H) that point at them. The Parts that actually impose duties on those entities are not in force. Those Parts cover cloud service providers and data centres. Section 18 currently reads as deleted. A commencement notification alone would bring cloud and data centre rules into force. Note that they would reach a provider serving Singapore from wholly outside Singapore. 2. Personal Data Protection Act Part 6B, data portability. Enacted in 2020, never started, and can be switched on the same way. 3. Section 26(2) of the Personal Data Protection Act lets the Commission exempt a named organisation from the transfer rules by unpublished written notice. It can vary or revoke that notice at any time. Not coming. On 5 May 2026 the Ministry of Digital Development and Information told Parliament it will not amend the Act for data derived by artificial intelligence. It is relying on existing law and published guidelines instead.