data-protection data-protection-act
Is it legal to store Singapore user data outside Singapore?
<p>I am based out of india and has intent to launch the  website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in singapore which does not allow to store the data outside singapore?</p>
<p>Yes definitely I will take the legal advise but before going them want to get some expert answers on this form which I will validate down the line.</p>
<p>Based on below answer from chatGPT looks like its allowed , may be with term and condition mentioned on site</p>
<blockquote>
<p>Under the Personal Data Protection Act (PDPA) of Singapore, an
organization may transfer personal data outside of Singapore only if
it ensures that the recipient country provides a comparable level of
data protection to Singapore's PDPA. This is known as the &quot;adequacy&quot;
requirement.</p>
<p>The adequacy requirement can be satisfied in several ways, such as
obtaining the individual's consent to transfer the data, entering into
a legally binding agreement with the recipient to ensure compliance
with the PDPA, or ensuring that the recipient country has a data
protection regime that provides a level of protection that is
comparable to the PDPA.</p>
<p>Therefore, it is possible to store Singapore user data outside of
Singapore if the recipient country provides a comparable level of data
protection to Singapore's PDPA, or if the organization has obtained
the individual's consent or entered into a legally binding agreement
that ensures compliance with the PDPA</p>
</blockquote>

<p>Yes, transferring data to other countries is allowed, if you nevertheless maintain an equivalent level of data protection. This is codified in <a href="https://sso.agc.gov.sg/Act/PDPA2012#pr26-" rel="nofollow noreferrer">section 26 of the PDPA 2021</a>:</p>
<blockquote>
<p>An organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under this Act to ensure that organisations provide a standard of protection to personal data so transferred that is comparable to the protection under this Act.</p>
</blockquote>
<p>The Personal Data Protection Commission has issued <a href="https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act" rel="nofollow noreferrer">advisory guidelines on PDPA concepts</a>. In chapter 19, it covers issues around transfers. It mentions a number of possibilities how to do that, for example:</p>
<ul>
<li>transfers within a group of companies could rely on binding corporate rules</li>
<li>the foreign data importer could be bound via a contract, essentially translating the PDPA statutory law into a contract</li>
<li>the foreign data importer could have a certification that demonstrates compliance, such as certifications under the acific Economic
Cooperation Cross Border Privacy Rules (“APEC CBPR”) system</li>
</ul>
<p>If that is not possible, then a fallback to “consent” or “deemed consent” could be appropriate.</p>
<p>These data transfer concerns apply to you in two ways:</p>
<ul>
<li>first, this may affect which additional services you engage to provide your product, e.g. server hosting providers</li>
<li>second, your clients from Singapore likely cannot use your services unless they can legally transfer data to you. For example, you may prepare a suitable contract that you sign, or attain a suitable certification.</li>
</ul>
<p>Note that ChatGPT cannot give reasonable advice on these matters. While it may not be outright <em>wrong</em>, it is not-entirely-correct in subtle ways. For example, the PDPA does not require an adequate level of data protection by the recipient <em>country</em>, but that the importing <em>organizations</em> provide such guarantees. It is likely that ChatGPT is confusing the Singapore PDPA with similar provisions from the EU GDPR, where “adequacy” is the primary mechanism to protect international transfers.</p>
