Singapore

Section 2 defines 'organisation' to include any individual, company, association or body of persons, corporate or unincorporated, whether or not (a) formed or recognised under the law of Singapore, or (b) resident, or having an office or a place of business, in Singapore. Section 11(3) requires designation of one or more individuals responsible for compliance (in practice called the Data Protection Officer) and section 11(5) requires their business contact information to be made public; neither provision imposes a residence requirement. Carve-outs in section 4: individuals acting personally or domestically, employees acting in the course of employment, public agencies (which are covered instead by the Public Sector (Governance) Act 2018), business contact information, records over 100 years old, and individuals dead more than 10 years. Data intermediaries acting under a written contract are relieved of most obligations but not of the security and retention duties.

Section 26(1) of the Personal Data Protection Act 2012 prohibits transfer 'except in accordance with requirements prescribed under this Act to ensure that organisations provide a standard of protection to personal data so transferred that is comparable to the protection under this Act'. The prescribed requirements sit in Part 3 of the Personal Data Protection Regulations 2021. There is no country list of any kind, populated or empty. Sector-by-sector position on 18 August 2026, each rated separately: - Banking and merchant banking (conditional): MAS Notice 658 and Notice 1121 govern outsourced services involving customer information. They expressly contemplate services performed overseas and set conditions rather than a ban. Note the trap: the previous rulebook (Notice 634 and the Guidelines on Outsourcing) was cancelled on 11 December 2024. - Insurance, capital markets, payments, trust companies (conditional): governed by the Guidelines on Outsourcing (Financial Institutions other than Banks), effective 11 December 2024. No localisation. - Health (conditional): the Healthcare Services Act 2020 requires records to be kept and secured but is silent on where. The Health Information Act 2026 has been passed but not commenced, and it too contains no residency requirement. - Telecoms (open): the Telecommunications Act 1999 as in force from 1 October 2025 contains no reference to keeping anything inside Singapore. - Critical information infrastructure (mirror in practice, not in law): the Cybersecurity Act 2018 applies to systems located wholly or partly in Singapore and, since 31 October 2025, also to a system located wholly outside Singapore that is owned by a person in Singapore. It regulates security, not location. - Company accounting records (mirror): the Companies Act 1967 allows records to be kept abroad but requires statements and returns to be sent to and kept in Singapore. - Mapping, gaming, education, defence: no residency rule found, checked 18 August 2026, confidence medium.

Regulation 10(1) of the Personal Data Protection Regulations 2021 requires the transferring organisation to take appropriate steps to ascertain and ensure that the recipient is bound by legally enforceable obligations. Regulation 11 lists what counts: any law, a contract, binding corporate rules, or any other legally binding instrument. A qualifying contract must (a) require comparable protection and (b) specify the countries and territories to which the data may be transferred. Binding corporate rules may only be used between related entities and must specify the recipients, the destinations and the rights and obligations created. Regulation 12 treats a recipient as compliant if it holds a specified certification. As amended by S 86/2026 with effect from 2 March 2026 this now covers four schemes for data intermediaries — the APEC Privacy Recognition for Processors System, the APEC Cross-Border Privacy Rules System, the Global Privacy Recognition for Processors System and the Global Cross-Border Privacy Rules System — and the two Cross-Border Privacy Rules systems for everyone else. Regulation 10(2) sets out situations where the requirement is deemed satisfied: the individual consents (but consent is invalid unless they were first given a written summary of the protection the destination offers, and it cannot be forced as a condition of a product unless genuinely necessary), deemed consent under section 15, transfer necessary for a use permitted without consent, data in transit, or data already publicly available in Singapore. The Commission may also exempt a named organisation from the transfer requirements under section 26(2). Such an exemption need not be published in the Gazette and can be revoked at any time.

Section 5 of the Personal Data Protection Act 2012 designates the Info-communications Media Development Authority as the Personal Data Protection Commission, so the Commission is not a separate legal body. Evidence that it is operational rather than nominal: published decision and undertaking batches dated 3 July 2025, 31 July 2025, 7 August 2025, 3 September 2025, 2 October 2025, 28 October 2025, 4 December 2025, 8 January 2026, 26 February 2026 and 9 April 2026, all listed on its own site, plus a press release on 2 February 2026 announcing it will step up enforcement on misuse of national identity numbers. The Commission may issue directions under section 48I and financial penalties under section 48J. The ceiling is 10 per cent of annual turnover in Singapore for an organisation whose Singapore turnover exceeds 10 million Singapore dollars (about 7.8 million US dollars), and 1 million Singapore dollars (about 780,000 US dollars) otherwise. That ceiling has applied since 1 October 2022. Individuals also have a direct right of action under section 48O. The Monetary Authority of Singapore replaced its entire outsourcing rulebook on 11 December 2024 and its technology risk and cyber hygiene notices on 10 May 2024 — evidence of active, not dormant, supervision. The Commissioner of Cybersecurity issued a new Cybersecurity Code of Practice for Critical Information Infrastructure on 29 July 2026.

Ceiling: section 25 of the Personal Data Protection Act 2012 requires an organisation to cease retaining documents containing personal data, or to strip the link to particular individuals, as soon as it is reasonable to assume that the purpose is no longer served and retention is no longer necessary for legal or business purposes. Floor: Companies Act 1967 section 199(2) sets five years from the end of the financial year. The tax authority applies five years from the relevant Year of Assessment under the Income Tax Act 1947 and the Goods and Services Tax Act 1993, with penalties of up to 5,000 Singapore dollars (about 3,900 US dollars) and up to six months' imprisonment in default. The Ministry of Manpower requires employment records for the latest two years for current employees, and the last two years kept for one year after the employee leaves. For a struck-off or wound-up company, an officer or the liquidator must keep the books for five years after dissolution. How the conflict resolves: it usually does not become a conflict, because section 25(b) itself permits retention that is still necessary for legal purposes. Where it does bite, section 4(6)(b) of the Act settles it — the provisions of other written law prevail to the extent of any inconsistency. Location interacts here too: Companies Act section 199(4) permits accounting records to be held abroad but requires statements and returns sufficient to prepare true and fair financial statements to be sent to and kept in Singapore.

Privacy clock. Sections 26C and 26D of the Personal Data Protection Act 2012. On having reason to believe a breach occurred you must assess it 'in a reasonable and expeditious manner'; there is no fixed deadline for the assessment itself, and the three-day clock starts only when the assessment concludes the breach is notifiable. A breach is notifiable if it causes or is likely to cause significant harm, or is or is likely to be of significant scale. The Personal Data Protection (Notification of Data Breaches) Regulations 2021 fix the significant-scale threshold at 500 affected individuals. Affected individuals must be told on or after the regulator, in any reasonable manner, where the significant-harm limb is engaged. A breach confined inside one organisation is deemed not notifiable. A supplier processing data for you must tell you without undue delay; the assessment duty then falls on you. Finance clock. MAS Notice FSM-N25 requires notification 'as soon as possible, but not later than 1 hour, upon the discovery of a relevant incident', with a root cause and impact analysis report within 14 days. Parallel notices apply across other supervised classes. The old Notices 644, 655, 644A, 655A, 1114 and 1118 were cancelled with effect from 10 May 2024, so compliance manuals citing them are out of date. Cyber clock. Section 14 of the Cybersecurity Act 2018 requires notification within the prescribed period. The Cyber Security Agency states the period is 2 hours from awareness, by calling the number in the National Cybersecurity Incident Response Framework, with supplementary details within 72 hours. Since 31 October 2025 the duty also covers incidents on a supplier's interconnected systems. A fourth clock is coming for healthcare once the Health Information Act 2026 commences: separate notifiable cybersecurity incident and notifiable data breach duties, with the periods to be set by regulations that do not yet exist.

1. Criminal, not just administrative. Sections 48D, 48E and 48F of the Personal Data Protection Act 2012 make it an offence for an INDIVIDUAL to knowingly or recklessly disclose personal data without authorisation, to misuse it for gain or to cause harm, or to re-identify anonymised information. Maximum: a fine of 5,000 Singapore dollars (about 3,900 US dollars) or two years' imprisonment or both. It bites employees and contractor staff personally, including those handling government data. Sections 7 and 8 of the Public Sector (Governance) Act 2018 create mirror offences with the same maximum for people working inside public sector agencies. 2. Other law wins. Section 4(6)(b) states that the provisions of other written law prevail to the extent that the privacy obligations are inconsistent with them. So a permissive answer under the privacy law is worth nothing if a banking secrecy duty, a professional secrecy duty or a licence condition says otherwise. 3. The national identity number deadline. On 2 February 2026 the regulator announced that organisations must cease using NRIC numbers for authentication by 31 December 2026, and that it will step up enforcement. Using a national identity number as a password, a default PIN or a proof of identity is the exact pattern being targeted. 4. A dormant obligation inside the statute. Part 6B of the Act — the data portability obligation — was enacted by the Personal Data Protection (Amendment) Act 2020 and is referenced throughout the in-force text, in sections 4 and 48J among others, yet the Part itself has never been commenced. A naive reading of the Act will report a portability right that does not currently exist. It can be switched on by commencement notification. 5. Stale banking guidance. MAS Notice 634 on banking secrecy conditions for outsourcing was cancelled with effect from 11 December 2024, and the well-known Guidelines on Outsourcing dated 2016 and revised 2018 are also marked cancelled. They were replaced by Notice 658 for banks, Notice 1121 for merchant banks, and separate Guidelines on Outsourcing for banks and for non-banks, all effective 11 December 2024. 6. Bonus, for consumer products: the regulator issued separate Advisory Guidelines for children's personal data in the digital environment in March 2024. Treat children's data as a distinct workstream rather than assuming the general rules cover it.

Landing within twelve months, with dates: - 31 December 2026: deadline to stop using NRIC numbers for authentication, with the regulator having said in February 2026 that it will step up enforcement. - Health Information Act 2026 (Act No. 1 of 2026): passed by Parliament on 12 January 2026, assented to on 3 February 2026, published on 12 February 2026, and still listed as Uncommenced on 18 August 2026. It creates a national electronic records system with mandatory contribution, new data security and retention duties, separate cybersecurity incident and data breach notification duties with periods still to be prescribed, and a health data portability right. Commencement date not yet announced. - Digital Infrastructure Bill: a draft was published for public consultation on 1 July 2026, closing 22 July 2026. It would licence data centre facility services in data centres of 10 megawatts critical IT load or more, and cloud infrastructure and platform services earning 100 million Singapore dollars or more a year from users in Singapore (about 78 million US dollars). Software-as-a-service is excluded. It would also make related amendments to the Cybersecurity Act. It is a draft, not law. - MAS is consulting on new guidelines covering financial institutions' use of third-party services. DORMANT SWITCHES, which matter more than the pending bills because they need no consultation: 1. Cybersecurity Act Parts 3C and 3D. The Cybersecurity (Amendment) Act 2024 commenced on 31 October 2025. The definitions of 'entity of special cybersecurity interest' and 'major foundational digital infrastructure service provider', and the application clauses in section 3(2E) to (2H) that point at them, are all in force TODAY. The Parts that actually impose duties on those entities — including on cloud service providers and data centres — are not, and section 18 currently reads as deleted. A commencement notification alone would bring a cloud and data centre regime into force. Note it would reach a provider serving Singapore from wholly outside Singapore. 2. Personal Data Protection Act Part 6B, data portability: enacted in 2020, never commenced, switchable the same way. 3. Section 26(2) of the Personal Data Protection Act lets the Commission exempt a named organisation from the transfer rules by unpublished written notice, on conditions it can vary or revoke at any time. Not coming: on 5 May 2026 the Ministry of Digital Development and Information told Parliament it is relying on existing law and published guidelines for data derived by artificial intelligence, rather than amending the Act.