In Singapore, private sector organisations must generally comply
with the transfer limitation obligation in the Personal Data
Protection Act (the Act). Any transfer of personal data outside
Singapore must be in accordance with the Act's requirements, to
ensure that a comparable standard of protection is accorded to that
data.
However, where an organisation is a data intermediary, i.e., it
processes personal data on behalf of and for the purposes of
another pursuant to a written contract, that intermediary is
not subject to the transfer limitation obligation,
as specified in section 4(2) of the Act.
On 9 October 2019, Singapore's personal data protection
commission issued revised guidelines which
clarify the scope of the transfer limitation obligation with
respect to data intermediaries:
