In this guide · 7 sections
Short answer
You can use overseas cloud tools under the PDPA. Section 26 requires the vendor to be bound, usually by its data processing terms or a recognised CBPR or PRP certification, to protect the data to a standard comparable to the PDPA. Check each tool's terms and record what you relied on in a register.
What the Transfer Limitation Obligation requires
Section 26 of the Personal Data Protection Act says an organisation must not transfer personal data outside Singapore except in line with requirements in the regulations. PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026, chapter 19) explain why: once data leaves Singapore, the overseas recipient is not subject to the PDPA, so you must make sure it still protects the data to a comparable standard.
The obligation applies when you hand data to another organisation overseas and give up possession or direct control, for example a cloud vendor acting as your data intermediary. If you keep direct control, such as staff travelling with a laptop or servers you own and run abroad, you remain directly bound by all the PDPA obligations instead.
| Way to meet it | What it means for a cloud tool | PDPC's view |
|---|---|---|
| Contract with comparable protection | The vendor's data processing terms cover protection, retention and breach notice, and name the countries data may go to | Preferred for ongoing relationships |
| Specified certification | Vendor holds Global or APEC CBPR (or PRP, if it processes data for you) | Preferred; verify on the official list |
| Binding corporate rules | Mainly for transfers within a corporate group | Preferred where relevant |
| Consent after a written summary | Each person agrees after being told how their data is protected abroad | Use only if the above are not possible |
| Necessary for a contract with the person | For example a travel agent sending names to an overseas hotel | Use only if the above are not possible |
Which of your tools count as overseas transfers
Start by listing every tool that stores or processes customer, staff or supplier personal data. Typical ones for a small business:
- Email and files: Microsoft 365 or Google Workspace, Dropbox, WeTransfer.
- Sales and marketing: CRM, newsletter platform, Meta and Google ad audiences, website forms.
- Operations: booking system, e-commerce platform, help desk, WhatsApp Business API provider.
- Finance and HR: accounting software, payroll, expense apps, e-signature tools.
- AI tools: chat assistants, meeting transcription, AI features inside other apps.
A Singapore data centre does not settle the question on its own. PDPC's guidelines give the example of a Singapore cloud storage provider that copies data to its servers in London and Hong Kong; the business using it is still responsible for the transfer. Backups, support access from other countries and sub-processors all count. Our guide to app hosting and data residency covers choosing hosting regions for your own website or app.
What to look for in a SaaS vendor's terms
Most established vendors publish a data processing addendum (DPA) or privacy terms that apply automatically to business accounts. You rarely negotiate them; you check them. PDPC lists the minimum areas a contract should cover. For a vendor acting as your data intermediary, that means protection, retention limits and telling you about data breaches without undue delay.
Vendor terms checklist
PDPC also recognises the ASEAN Model Contract Clauses as a way to meet the obligation in your own contracts, which can help when you hire a smaller overseas agency or developer who has no standard terms. Our guide to data processor agreements with vendors covers those contracts in more detail.
Certifications: CBPR and PRP explained
The Personal Data Protection Regulations 2021 treat a recipient holding a "specified certification" as bound to protect the data. The rules differ by role:
- Recipient using the data for its own purposes (an organisation): needs Global or APEC Cross-Border Privacy Rules (CBPR) certification.
- Recipient processing data on your behalf (a data intermediary, which is what most SaaS vendors are): Global or APEC CBPR, or Global or APEC Privacy Recognition for Processors (PRP) certification.
PDPC's examples have the Singapore business checking the certification on the official lists at globalcbpr.org or cbprs.org, not taking the vendor's word for it. Record the date you checked.
Build a register of tools that hold personal data
A register is a simple table, kept up to date, that shows you know where personal data goes and what safeguard you relied on. It is also the first thing you will want after a vendor data breach.
List every tool
Ask each team which apps they use. Check card statements and your Google or Microsoft admin console for connected apps, which often reveals forgotten tools.
Note the data and the people
For each tool, write what personal data it holds (names, emails, NRIC, salary, health) and whose (customers, staff, suppliers).
Find the storage locations
Check the vendor's documentation or admin settings for data regions and sub-processor lists.
Record the safeguard
Link to the vendor's data processing terms or certification listing, with the date you checked.
Decide on gaps
Replace or upgrade tools with no usable terms, move sensitive data out of free accounts, and set a yearly review date.
Do it yourself or get help?
Most small businesses can build the register themselves in a few hours using the steps above. The harder part is reading vendor terms consistently and turning the result into policies staff follow. Our guide to ChatGPT at work and the PDPA covers the AI tool side, which is where most new gaps appear.
If you want the paperwork done, our PDPA Compliance Pack (S$690) includes a personal data inventory from an online questionnaire, a website privacy policy, a staff data protection policy, DPO notes and a breach response plan. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page. This guide and the pack are not legal advice; speak to a lawyer for unusual transfers.
Frequently asked questions
No. Section 26 restricts transfers of personal data outside Singapore but does not require local storage. You can use overseas cloud services if the recipient is bound, by contract, binding corporate rules, other law or a recognised certification, to protect the data to a standard comparable to the PDPA. Some sectors and government contracts add stricter rules.
Often, yes, if it imposes protection comparable to the PDPA and names the countries data may go to. PDPC lists the areas a contract with a data intermediary should cover, including protection, retention limits and breach notification. Read the terms once, check the storage locations, and record the version and date in your register.
Consent is allowed if the person has been given a written summary of how their data will be protected in the destination countries. PDPC encourages organisations to rely on contracts or certifications instead, especially for ongoing vendor relationships, because they give better accountability and do not depend on every customer agreeing.
They are cross-border privacy certifications recognised in Singapore's regulations. Global or APEC CBPR covers a recipient using data for its own purposes. A recipient processing data on your behalf can rely on CBPR or on Global or APEC PRP. Check the certification on the official lists rather than relying on the vendor's claim.
You remain responsible for the personal data. Your vendor terms should require the vendor to tell you without undue delay. You then assess whether the breach is notifiable under the PDPA and, if so, notify PDPC within three calendar days of that assessment. A register showing your safeguards helps demonstrate you took reasonable steps.