SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
5.2 Government Notifications and Approvals Singapore does not impose any registration, filing, notification or prior approval requirements with regu - latory authorities solely for the purpose of transferring data overseas. 5.3 Data Localisation Requirements Singapore does not impose explicit data localisa - tion or data residency requirements under the PDPA. Organisations are therefore not obliged to retain per - sonal data, or copies of such data, physically within Singapore, even where the data is stored or processed abroad. Remote access to personal data from outside Singa - pore is treated in practice as a form of cross-border transfer. It is permitted so long as the organisation complies with the PDPA’s transfer limitation obligation, including taking steps to ensure that overseas recipi - ents or access arrangements afford a level of protec - tion comparable to that required under Singapore law. 5.4 Blocking Statutes Singapore does not maintain a general “blocking stat - ute” or foreign-judgment control regime that restricts compliance with foreign discovery orders or sanc - tions. Nevertheless, cross-border disclosures of data are constrained by existing confidentiality and data protection laws. In particular, Section 26 of the PDPA limits the transfer of personal data outside Singapore unless the transferring organisation ensures that the recipient is subject to legally enforceable safeguards providing a level of protection comparable to the PDPA. Separately, disclosures may be prohibited under the Official Secrets Act and the Statutory Bodies and Gov - ernment Companies (Protection of Secrecy) Act 1983, which prevents the disclosure of official government- related documents and information.
5.5 Recent Developments In June 2025, the Global Cross-Border Privacy Rules (CBPR) Forum formally launched the Global CBPR and Privacy Recognition for Processors certification systems, marking a significant development in the facilitation of international personal data transfers. • The Global CBPR framework establishes a single certification that organisations can rely on to trans - fer personal data across all participating econo - mies, which currently include Singapore, the United States, Japan, Australia, Canada and several other jurisdictions. Certification is obtained through accredited Accountability Agents, with the IMDA acting as the designated authority in Singapore. • In Singapore, Global CBPR certification is recog - nised under the PDPA as a lawful mechanism for overseas data transfers, reducing the need for organisations to implement additional contractual or organisational safeguards when transferring personal data to other member economies. • Looking ahead, the Global CBPR Forum has sig - nalled plans to expand membership beyond the current group of economies, continuing to build its network of certified organisations – developments that are expected to further shape Singapore’s approach to cross-border data transfer compli - ance.
425 CHAMBERS.COM
Powered by FlippingBook