SINGAPORE Trends and Developments Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Contractual and certification mechanisms The PDPC continues to recognise a range of prac - tical mechanisms to facilitate cross-border transfers that are compliant with the PDPA’s transfer limitation obligation. At a regional level, the ASEAN Model Contractual Clauses are recognised and encouraged by the PDPC as a practical contractual mechanism, particularly for organisations with intra-group or vendor-related transfers within South-East Asia. These standardised clauses are designed to align with the ASEAN Frame - work on Personal Data Protection 2016 and can help streamline negotiations across multiple ASEAN juris - dictions. In addition, Regulation 12 of the Personal Data Pro - tection Regulations 2021 recognises certifications under the APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) sys - tems as mechanisms that satisfy the transfer limitation obligation. These certifications provide a structured, internationally recognised approach to demonstrating comparable data protection standards across partici - pating economies. Building on the aforementioned cross-border privacy mechanisms, the Global CBPR and Global PRP sys - tems were introduced in June 2025 as broader inter - national certification frameworks. While Singapore’s regulations currently recognise only the APEC CBPR and PRP certifications, the Global CBPR framework reflects a wider trend towards interoperable, certifica - tion-based transfer regimes. Taken together, these developments point to an increasingly layered cross-border data governance environment. Businesses operating across multiple jurisdictions should therefore consider both treaty- level developments, such as the EU-Singapore DTA, and practical compliance tools, such as contractual clauses and recognised certifications, when structur - ing their data transfer arrangements. Data Protection in the Context of AI Deployment Singapore introduced three new initiatives in July 2025:
• the new Global AI Assurance Sandbox; • a new privacy enhancing technology (PET) adop - tion guide; and • the Singapore Standard for Data Protection. The Global AI Assurance Sandbox The Global AI Assurance Sandbox aims to provide a conducive environment for organisations to trial responsible AI applications, offering tools, resources and a controlled setting for practical testing. Building on insights from an earlier pilot phase, the sandbox now covers additional AI archetypes, such as agentic AI, as well as emerging risks including data leakage and prompt injection vulnerabilities. It addresses a broad range of AI-related risks and is also relevant from a data protection perspective, as it enables organisations to assess how their AI systems man - age data-related risks before full-scale deployment. The sandbox may also be opened to sectoral regu - lators to test governance or assurance approaches, with insights feeding into future policy guidance and potential accreditation frameworks for AI testers. PETs Adoption Guide PETs protect personal data while allowing organisa - tions to use such data for AI development and training and are increasingly positioned as practical tools to enable data-driven innovation without compromis - ing privacy. First introduced in 2022 by the IMDA and PDPC, Singapore’s PET Sandbox now explores how PETs can be applied to generative AI use cases while managing associated data protection risks. Drawing on insights from these sandbox projects, IMDA has released a new PETs Adoption Guide to help organisa - tions deploy PETs and derive greater value from their data. The guide includes a “PETs Use Case Evaluation Tool” to assist organisations in identifying suitable PET solutions, as well as an “Implementation Checklist” to support the end-to-end adoption process. IMDA has emphasised that the guide is intended to be a “liv - ing document”, with ongoing refinements based on industry feedback and additional use cases. The Singapore Standard for Data Protection The Data Protection Trustmark was elevated into a new Singapore Standard (SS 714:2025), aligning it with international data protection benchmarks and best practices. Organisations can now apply for certi -
428 CHAMBERS.COM
Powered by FlippingBook