Transferring Personal Data

Do you ensure there are appropriate contractual arrangements or binding corporate rules to govern the transfer of personal data overseas?

IF NO:

Do not transfer personal data to a country outside Singapore unless you have ensured that the standard of protection to be given to the personal data is comparable to the standard under the PDPA (Comparable Protection Standard).

Before you transfer personal data overseas, you must:

  • take appropriate steps to ensure that you have complied with the relevant provisions under the PDPA; and

  • take appropriate steps to ascertain whether, and to ensure that, the receiving party of the personal data (the recipient) is bound by legally enforceable obligations to apply the Comparable Protection Standard to the transferred personal data.

Legally enforceable obligations include obligations imposed on the recipient under:

  • any law;

  • any contract which:

    • requires the recipient to give a standard of protection to the personal data that is at least comparable to the protection under the PDPA; and specifies the countries and territories to which the personal data may be transferred under the contract;

  • any binding corporate rules which:

    • require the recipient to give a standard of protection to the personal data that is at least comparable to the protection under the PDPA;

    • specify the recipients which the binding corporate rules apply to; the countries and territories to which the personal data may be transferred under the binding corporate rules; and the rights and obligations provided by the binding corporate rules;

    • (e.g. the transferring organisation is in the same group of companies as the recipient and has control over the recipient); and

  • any other legally binding instrument.

An organisation transferring personal data overseas is deemed to have satisfied the requirement to take appropriate steps to ensure that the recipient is bound by legally enforceable obligations to give the personal data a standard of protection comparable to that under the PDPA if:

  • subject to conditions, the individual has given his consent to the transfer of his personal data. You should (among other things) provide the individual with a reasonable summary in writing of the extent to which the personal data transferred to those countries and territories will be protected to a standard comparable to the protection under the PDPA;

  • the transfer is necessary for the performance of a contract between your organisation and the individual (e.g. if the organisation is a data intermediary of the individual pursuant to a contract between them in relation to the transfer), or to do anything at the individual’s request with a view to his entering a contract with the organisation;

  • the transfer is necessary for the conclusion or performance of a contract between your organisation and a third party which is entered into at the individual’s request, or which a reasonable person would consider to be in the individual’s interest;

  • the transfer is necessary for a use or disclosure in certain situations where the consent of the individual is not required under the PDPA, such as use or disclosure necessary to respond to an emergency that threatens the life, health or safety of an individual. (E.g. medical records provided to medical doctor for emergency treatment.) In such cases, the organisation may only transfer personal data if it has taken reasonable steps to ensure that the personal data will not be used or disclosed by the recipient for any other purpose;

  • the personal data is data in transit; or

  • the personal data is publicly available in Singapore (e.g. film containing faces of passersby if the filming of images would be reasonably expected at that location).

 

Thank you for visiting the PDPA Singapore Compliance & Template site. We intend to provide general information on the law, which should not be construed as legal advice at all. If you are looking for advice on a specific matter, you are encouraged to contact us directly. We strongly advise you to not disclose personal or confidential information until a lawyer client relationship has been established.

PDPA SINGAPORE COMPLIANCE & TEMPLATES

T 6635 8885

F 6635 8720

Covenant Chambers LLC

8 Eu Tong Sen Street #12-96, Clarke Quay Central, Singapore 059818

  • Black Blogger Icon

© RONALD JJ WONG