Singapore: compliance overview

Regulatory timeline: what comes next

1. 2026-07-20

   Advisory Guidelines on Use of Personal Data in Generative AI issued

   PDPC Advisory Guidelines on Use of Personal Data in Generative AI

2. 2026-07-20

   The generative AI guidelines are issued and apply alongside these guidelines

   PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems

Data transfer routes

• Singapore PDPA transfer limitation obligation (s 26 + Part 3 of the 2021 Regulations)

  No volume threshold - any transfer of personal data outside Singapore is caught. Regulation 10(2) deems regulation 10(1) satisfied in five cases: (a) the individual consents to the transfer to that recipient in that country or territory, subject to regulation 10(3); (b) the individual is deemed to have consented to disclosure to that recipient under section 15(3), (4), (5), (6), (7) or (8) of the Act; (c) the transfer is necessary for the data to be used or disclosed under Part 1 or paragraph 2 of Part 2 of the First Schedule to the Act and the transferring organisation has taken reasonable steps to ensure the recipient will not use or disclose it for any other purpose; (d) the data is data in transit; (e) the data is publicly available in Singapore. Under regulation 10(3) consent does not count where: (a) the individual was not given, before consenting, a reasonable summary in writing of the extent to which the data will be protected to a comparable standard in that country or territory; (b) the organisation required consent as a condition of providing a product or service, unless the transfer is reasonably necessary to provide it; or (c) the organisation obtained or attempted to obtain consent by providing false or misleading information about the transfer or by other deceptive or misleading practices. Regulation 10(4) preserves the right to withdraw consent. The minimum contract requirements in regulation 11(2): the contract must require the recipient to provide a comparable standard of protection and must specify the countries and territories to which the data may be transferred. Binding corporate rules under regulation 11(3) may be used only for recipients related to the transferring organisation, must require every related recipient to provide a comparable standard, and must specify the recipients covered, the countries and territories, and the rights and obligations provided.

  Lead time: Estimate: 1-3 weeks for the contract route; 4-8 weeks for intra-group binding corporate rules; the certification route depends on whether the recipient already holds one - a new CBPR/PRP certification typically takes months, and accreditation-body timelines were not verified in this pass. · Cost band Low

What has actually happened here

• Temu fined KRW 1.369 billion by the Korean PIPC for unlawful cross-border transfers and RRN processing, plus KRW 17.6 million for undisclosed offshore processing and no domestic agent2025