Singapore legislation
Regulation 10
Regulation 10
Requirements for transfer
Subregulation 1
For the purposes of section 26 of the Act, a transferring organisation must, before transferring an individual’s personal data to a country or territory outside Singapore on or after 1 February 2021, take appropriate steps to ascertain whether, and to ensure that, the recipient of the personal data is bound by legally enforceable obligations (in accordance with regulation 11) to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the Act.
Subregulation 2
A transferring organisation is taken to have satisfied the requirements of paragraph (1) in respect of an individual’s personal data which it transfers to a recipient in a country or territory outside Singapore if —
subject to paragraph (3), the individual consents to the transfer of the individual’s personal data to that recipient in that country or territory;
the individual is deemed to have consented to the disclosure by the transferring organisation of the individual’s personal data to that recipient under section 15(3), (4), (5), (6), (7) or (8) of the Act;
the transfer of the personal data to the recipient is necessary for the personal data to be used or disclosed under Part 1 or paragraph 2 of Part 2 of the First Schedule to the Act, and the transferring organisation has taken reasonable steps to ensure that the personal data so transferred will not be used or disclosed by the recipient for any other purpose;
the personal data is data in transit; or
the personal data is publicly available in Singapore.
Subregulation 3
For the purposes of paragraph (2)(a), an individual is not taken to have consented to the transfer of the individual’s personal data to a country or territory outside Singapore if —
the individual was not, before giving his or her consent, given a reasonable summary in writing of the extent to which the personal data to be transferred to that country or territory will be protected to a standard comparable to the protection under the Act;
the transferring organisation required the individual to consent to the transfer as a condition of providing a product or service, unless the transfer is reasonably necessary to provide the product or service to the individual; or
the transferring organisation obtained or attempted to obtain the individual’s consent for the transfer by providing false or misleading information about the transfer, or by using other deceptive or misleading practices.
Subregulation 4
This Part does not prevent an individual from withdrawing any consent given for the transfer of the personal data to a country or territory outside Singapore.