APAC / Asia-Pacific / revised 28 Oct 2026
Singapore PDPA Transfer Limitation Obligation for AI Inference
Singapore does not require personal data to stay in Singapore. Section 26 instead requires an organisation that transfers personal data overseas to ensure the recipient protects it to a standard comparable to the PDPA, usually through legally enforceable obligations. For AI inference, that turns a model provider's region choice into a contract and evidence question.
- Citation
- Personal Data Protection Act 2012, section 26; Personal Data Protection Regulations 2021, Part 3
- Regulator
- Personal Data Protection Commission (PDPC)
- In force
- 2 July 2014 (data protection provisions)
- Maximum penalty
- Up to 10% of annual turnover in Singapore for organisations with turnover above SGD 10 million, otherwise up to SGD 1 million (s. 48J, from 1 October 2022)
Section 26: the Transfer Limitation Obligation
Section 26(1) prohibits an organisation from transferring personal data to a country or territory outside Singapore except in accordance with requirements prescribed under the Act, so that the organisation provides a standard of protection comparable to that under the PDPA. The obligation sits with the transferring organisation. It cannot be discharged by assuming the provider's home law is good enough.
Part 3 of the PDP Regulations 2021
Part 3 sets out how to meet the obligation. The transferring organisation must take appropriate steps to ensure the recipient is bound by legally enforceable obligations, or holds specified certifications, to provide comparable protection. Legally enforceable obligations can come from law, contract, binding corporate rules for related organisations, or other legally binding instruments. Specified certifications include the APEC Cross Border Privacy Rules and Privacy Recognition for Processors systems.
The regulations also treat certain transfers as meeting the standard, including where the individual has consented after being told how their data will be protected, where the transfer is necessary for a contract with the individual, and where personal data is only in transit through Singapore.
Enforcement and AI guidance
The 2020 amendments raised the financial penalty ceiling to 10% of annual Singapore turnover for organisations whose turnover there exceeds SGD 10 million, effective 1 October 2022. In March 2024 the PDPC issued Advisory Guidelines on the use of personal data in AI recommendation and decision systems, which address consent, the business improvement and research exceptions, and the information organisations should give users about AI systems.
- 01
Contract terms that reach the model provider
If a reseller or gateway sits between you and the model provider, confirm the comparable-protection terms flow down to the party that actually processes the prompt, and that sub-processor changes are notified. - 02
Prefer in-region inference when it is available
Running inference in Singapore does not remove PDPA duties, but it removes the section 26 analysis for that flow and simplifies breach-notification scoping. - 03
Mask NRIC and FIN numbers
NRIC and FIN numbers follow a fixed letter, seven digits, checksum letter pattern with a widely documented check calculation. Detect and tokenise them before any overseas hop; the PDPC's advisory guidelines restrict their collection and use in any case. - 04
Retention controls at the provider
The Retention Limitation Obligation (s. 25) still applies to data you hand to a provider. Contractual zero retention makes it easier to show you have ceased to retain prompts once the purpose is met. - 05
Evidence per request
Keep a record of which region processed each request. In a breach investigation the PDPC will ask where the data went, and a signed receipt answers faster than reconstructing provider logs.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | Singapore-tagged requests prefer a Singapore endpoint and fall back only to destinations on the tenant's approved section 26 list. | Each overseas destination needs a legally enforceable basis on file; the router should not reach destinations without one. |
| 02 | Tokenise NRIC and FIN numbers in-path for every route that leaves Singapore. | Minimising identifiers reduces the harm of any onward exposure and aligns with PDPC guidance on national identifiers. |
| 03 | Block providers whose retention setting for the tenant is not zero when the request carries customer data. | Supports the retention limitation and protection obligations at the recipient. |
| 04 | Stamp the resolved country into every proof receipt. | Gives the data protection officer a per-request transfer record for audits and breach assessments. |
sg-pdpa-transfer
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.sg_pdpa_transfer
import rego.v1
default allow := false
allow if {
input.request.origin_country == "SG"
input.route.destination_country == "SG"
}
allow if {
input.request.origin_country == "SG"
input.route.destination_country != "SG"
some basis in data.tenant.s26_bases
basis.country == input.route.destination_country
basis.recipient == input.route.provider_id
input.guardrail.nric_masked
}
reasons contains "no section 26 basis for destination" if {
input.route.destination_country != "SG"
not input.route.destination_country in {b.country | some b in data.tenant.s26_bases}
}Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Is consent enough to send data overseas for inference?
Consent is one recognised route, but only if the individual was told in writing how the data will be protected abroad. For high-volume AI features a contract-based basis is more practical and more durable.
Does using a US provider's Singapore region solve section 26?
Only for flows that genuinely stay in that region, including logs and abuse monitoring. Check where support access and retained data sit.
How does YTT Secunet help?
The APAC data plane routes Singapore traffic to in-country endpoints where available, enforces the tenant's list of approved destinations, and signs a receipt per request recording the resolved country and facility.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.