In this guide · 8 sections
Short answer
You can host customer data overseas under the PDPA, but section 26 requires the recipient to give it protection comparable to the PDPA, usually through a contract, binding corporate rules or a CBPR/PRP certification. A Singapore region helps, but backups copied abroad still count.
What the Transfer Limitation Obligation says
Section 26 of the Personal Data Protection Act says an organisation must not transfer personal data outside Singapore except in line with requirements set by the PDPA regulations. PDPC's Advisory Guidelines on Key Concepts, revised on 29 April 2026, explain the reason: once data leaves Singapore, the overseas recipient is not subject to the PDPA, so the sender must make sure it is still protected to a comparable standard.
The obligation applies when you hand data to another organisation overseas and give up possession or direct control, for example to a cloud provider, a software vendor or a group company abroad. If you keep control yourself, for example a laptop taken on a business trip or servers you own and run in an overseas data centre, PDPC says all the normal PDPA obligations simply continue to apply to you there.
Five ways to meet the rule
PDPC's guidelines list the conditions set by the Personal Data Protection Regulations 2021. PDPC encourages businesses to rely on the first two, especially for ongoing relationships, because they give better accountability.
| Route | What it means | Typical use |
|---|---|---|
| Contract | Contract requires comparable protection and names the countries the data may go to | Cloud hosting, SaaS vendors, outsourced IT |
| Binding corporate rules | Group-wide rules binding every related recipient | Groups with offices in several countries |
| Specified certification | Recipient holds Global or APEC CBPR (or, as a data intermediary, Global or APEC PRP) | Vendors that advertise these certifications |
| Consent | Individual agrees after a written summary of how data will be protected abroad | One-off cases; PDPC treats it as a fallback |
| Necessary for a contract with the individual | For example, sending a traveller's details to an overseas hotel | Travel, logistics, overseas fulfilment |
There are also narrow cases for vital or national interest, data merely passing through Singapore in transit, and data that is publicly available in Singapore. For most SMEs using cloud services, the contract route is the one that matters.
What a vendor contract must cover
PDPC sets out the minimum protections a transfer contract should include, and they differ depending on whether the overseas recipient processes data on your behalf (a data intermediary, such as a hosting or CRM provider) or uses it for its own purposes.
| Area of protection | Data intermediary | Other organisation |
|---|---|---|
| Purpose of collection, use and disclosure | No | Yes |
| Accuracy | No | Yes |
| Protection (security) | Yes | Yes |
| Retention limitation | Yes | Yes |
| Data protection policies | No | Yes |
| Access and correction | No | Yes |
| Data breach notification | Notify you without undue delay | Assess and notify PDPC or individuals where relevant |
PDPC also recognises the ASEAN Model Contract Clauses as a way to meet the obligation. In practice, major cloud providers publish a data processing addendum; your job is to check that it covers security, retention and breach notification, and names or allows the regions involved. Our guide to data processor agreements under the PDPA covers what to look for clause by clause.
When a Singapore cloud region simplifies things
Hosting your app and database in a Singapore region keeps the main copy of the data local, which removes most transfer questions and is easier to explain to customers. All three large clouds offer one, per the AWS region list, Azure region list and Google Cloud regions page.
| Provider | Singapore region |
|---|---|
| Amazon Web Services | Asia Pacific (Singapore), ap-southeast-1, 3 availability zones |
| Microsoft Azure | Southeast Asia (southeastasia), Singapore; paired with East Asia (Hong Kong) |
| Google Cloud | asia-southeast1, zones in Jurong West, Singapore |
But a Singapore region alone does not settle it. PDPC's own example describes a Singapore cloud storage provider that copies data to its servers in London and Hong Kong: the customer business is still responsible for the Transfer Limitation Obligation, because the provider transfers the data on its behalf. Azure's Southeast Asia region, for instance, is paired with Hong Kong, so replication settings matter.
Data residency check for a business app
Hosting overseas is fine if you do it properly
Many good tools have no Singapore region. Using them is allowed under the PDPA; you just need the transfer covered.
List the personal data and the vendor
Write down what personal data the tool holds, such as names, phone numbers, NRIC partials or order history, and which company provides it.
Find where the data is stored
Check the vendor's trust, privacy or sub-processor page for hosting regions and sub-processors.
Check the legal basis
Look for a data processing addendum with comparable protection, or a Global/APEC CBPR or PRP certification you can verify on the official certification lists.
Keep evidence
Save a copy or link of the DPA and certification with the date you checked. PDPC expects organisations to do due diligence and can ask what you relied on.
Tell customers in your privacy notice
State that data may be processed outside Singapore and how it is protected. This is good practice and supports the notification obligation.
For AI tools specifically, our guide to where ChatGPT and other AI tools store data lists which vendors offer Singapore or Asia data residency.
Sector rules that go further
The PDPA is the baseline. Some sectors add their own rules about outsourcing, data location or approval before moving systems to the cloud.
- Financial institutions licensed by MAS: MAS outsourcing and technology risk expectations apply on top of the PDPA. Check the current MAS guidance for your licence type.
- Healthcare providers: licensed providers may face additional MOH requirements on patient data and cybersecurity; check current MOH guidance.
- Government contracts: agencies often set data location and security clauses in the contract itself.
- Overseas customers: if you serve EU or other foreign customers, their laws can add restrictions on where you send their data.
If none of these apply, a contract-backed overseas host is acceptable for most small businesses. If one does, start with the sector rules and treat the PDPA as the minimum.
Do it yourself or get help?
A small business with a few SaaS tools can map where its data sits in an afternoon using vendors' trust pages. It takes longer if you run your own app, have backups spread across regions, or need written policies to show customers or auditors.
Our PDPA Compliance Pack (S$690) maps where your personal data is stored, checks vendor terms and gives you a privacy notice and data inventory. For apps you host yourself, Software & Server Protection Setup (S$590) covers server region, backups and access controls. IT Sorted is a Singapore-based team of developers with over 10 years of experience. You pay upfront, send your brief in writing through the site chat or contact form, and track progress on your order page.
Frequently asked questions
No. Section 26 of the PDPA restricts transfers of personal data outside Singapore, but it does not require local storage. You may transfer data overseas if the recipient is bound, for example by contract, binding corporate rules or a recognised certification, to protect it to a standard comparable to the PDPA. Some sectors and government contracts add stricter location rules.
Not necessarily. PDPC's guidelines give the example of a Singapore cloud storage provider that copies data to servers in London and Hong Kong; the customer business must still comply with the Transfer Limitation Obligation. Check where backups, replicas, support access and other tools such as email or analytics send personal data.
They are cross-border privacy certification systems recognised in PDPC's regulations. A recipient holding Global or APEC Cross-Border Privacy Rules certification meets the transfer requirement as an organisation. A data intermediary can also rely on Global or APEC Privacy Recognition for Processors certification. PDPC suggests checking the official certification lists rather than relying on a vendor's claim alone.
It is allowed, but PDPC treats it as a fallback. To rely on consent, you must first give the individual a reasonable written summary of how their data will be protected in the destination country. For ongoing hosting arrangements, PDPC encourages relying on legally enforceable obligations such as a contract or certification, which are easier to manage at scale.
PDPC can investigate and impose directions or financial penalties for breaches of the PDPA, including the Transfer Limitation Obligation. In practice, problems usually surface after a data breach at an overseas vendor. Keeping a record of where data is stored and the contract or certification you relied on shows you took reasonable steps.