Is it legal to store Singapore user data outside Singapore?

Question

I am based out of india and has intent to launch the website in Singapore for singapore usesr where datastores and webservers will be hosted on data center in india. Is there any data protect act in singapore which does not allow to store the data outside singapore?

Yes definitely I will take the legal advise but before going them want to get some expert answers on this form which I will validate down the line.

Based on below answer from chatGPT looks like its allowed , may be with term and condition mentioned on site

Under the Personal Data Protection Act (PDPA) of Singapore, an organization may transfer personal data outside of Singapore only if it ensures that the recipient country provides a comparable level of data protection to Singapore's PDPA. This is known as the "adequacy" requirement.

The adequacy requirement can be satisfied in several ways, such as obtaining the individual's consent to transfer the data, entering into a legally binding agreement with the recipient to ensure compliance with the PDPA, or ensuring that the recipient country has a data protection regime that provides a level of protection that is comparable to the PDPA.

Therefore, it is possible to store Singapore user data outside of Singapore if the recipient country provides a comparable level of data protection to Singapore's PDPA, or if the organization has obtained the individual's consent or entered into a legally binding agreement that ensures compliance with the PDPA

Answer 1

Yes, transferring data to other countries is allowed, if you nevertheless maintain an equivalent level of data protection. This is codified in section 26 of the PDPA 2021:

An organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under this Act to ensure that organisations provide a standard of protection to personal data so transferred that is comparable to the protection under this Act.

The Personal Data Protection Commission has issued advisory guidelines on PDPA concepts. In chapter 19, it covers issues around transfers. It mentions a number of possibilities how to do that, for example:

• transfers within a group of companies could rely on binding corporate rules
• the foreign data importer could be bound via a contract, essentially translating the PDPA statutory law into a contract
• the foreign data importer could have a certification that demonstrates compliance, such as certifications under the acific Economic Cooperation Cross Border Privacy Rules (“APEC CBPR”) system

If that is not possible, then a fallback to “consent” or “deemed consent” could be appropriate.

These data transfer concerns apply to you in two ways:

• first, this may affect which additional services you engage to provide your product, e.g. server hosting providers
• second, your clients from Singapore likely cannot use your services unless they can legally transfer data to you. For example, you may prepare a suitable contract that you sign, or attain a suitable certification.

Note that ChatGPT cannot give reasonable advice on these matters. While it may not be outright wrong, it is not-entirely-correct in subtle ways. For example, the PDPA does not require an adequate level of data protection by the recipient country, but that the importing organizations provide such guarantees. It is likely that ChatGPT is confusing the Singapore PDPA with similar provisions from the EU GDPR, where “adequacy” is the primary mechanism to protect international transfers.