Most Singapore organisations transfer personal data overseas every day — to cloud providers, group companies, payroll processors and SaaS vendors. Under the PDPA's Transfer Limitation Obligation, each of these transfers needs a legally recognised safeguard. In 2026 the rules on one of those safeguards — certifications — were updated. This article explains what changed and what it means in practice. Our article on this year's other PDPA developments covers the NRIC deadline, the GenAI guidelines and recent penalties.
What Changed in 2026
- 2 March 2026: The Personal Data Protection (Amendment) Regulations 2026 came into force. They amend regulation 12(2) of the Personal Data Protection Regulations 2021 and expand the scope of certifications recognised for overseas transfers.
- April 2026: The PDPC published a sample clause for data transfers to organisations certified under the APEC and Global CBPR and PRP systems.
- 1 April 2027: IMDA, which runs the certification programmes in Singapore, lists updated programme requirements taking effect from this date. Organisations planning to apply should check which version applies to them.
Global CBPR and Global PRP in Brief
The Global Cross-Border Privacy Rules (CBPR) system certifies the privacy practices of data controllers. The Global Privacy Recognition for Processors (PRP) system certifies data processors. Both grew out of the APEC systems and are now run by the Global CBPR Forum, with IMDA acting as the certifying body in Singapore.
According to IMDA, Singapore recognises Global CBPR and PRP certifications for overseas transfers under the PDPA. In practice, this means an organisation in Singapore can transfer personal data to a certified overseas recipient without putting additional safeguards such as contractual clauses in place for that transfer.
What This Means for Your Organisation
As a sender of data
When you choose or review an overseas vendor, ask whether it holds a Global CBPR or Global PRP certification. A valid certification can simplify the transfer assessment, but you remain accountable: check the scope of the certification, its validity and whether it covers the services you actually use.
As a recipient or service provider
Singapore organisations that serve customers abroad can apply for certification themselves. This can shorten due diligence with international clients and signal mature privacy practices — particularly for SaaS, outsourcing and fintech providers.
Contracts remain the default
Certifications are one option among several. Most transfers will still rely on contractual clauses, binding corporate rules within groups, or consent in limited cases. The key is that every transfer has a documented basis.
Your Cross-Border Transfer Checklist
- Map your transfers: list every vendor and group company that receives or can access personal data from outside Singapore
- Record the safeguard for each transfer: contract, certification, binding corporate rules or another recognised basis
- Verify certifications on the official directories before relying on them, and diarise their expiry dates
- Review your contracts against the PDPC's sample clauses where no certification is in place
- Update your privacy notice so individuals know that their data may be transferred overseas
Our guide to cross-border data transfers in Singapore explains the Transfer Limitation Obligation in more detail.
How ResGuard Can Help
The ResGuard Data Protection Manager keeps your applications, vendors and transfers in one inventory, and our vendor management module sends security and privacy questionnaires — with AI support to pre-fill answers. Our PDPA experts can review your transfer documentation. Contact us to get started.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: Singapore Statutes Online, IMDA programme pages on Global CBPR and PRP, PDPC guidance and published summaries of the Amendment Regulations.