Why this hour is worth your calendar
You already run to the PDPA. The question this session answers is whether a second, stricter regime also applies to you - and for a growing Singapore business, the answer is increasingly yes. The GDPR was written to follow EU residents' data wherever it goes, so a Singapore SaaS with European users, an e-commerce site that ships to Europe, or an app that tracks EU visitors is squarely in scope. Getting this wrong is expensive in a way the PDPA is not: GDPR fines are tied to global turnover. This hour makes the applicability test something you can apply in a meeting.
The three triggers 9 min live
Article 3 is short, and it is the whole applicability question. The GDPR reaches you through any one of three triggers. Two of them catch companies with no EU presence at all - which is exactly how a Singapore business gets pulled in.
LiveThe two triggers that catch a Singapore company3 min▶
Trigger (a), establishment, is the obvious one: an EU office or branch. Most Singapore firms do not have that. The two that catch them are (b) and (c) - and they do not care where your company is.
- Offering goods or services to people in the EU (Art 3(2)(a)). If you target or serve individuals located in the EU - a checkout that ships there, prices in euros, a language toggle, EU customers on your SaaS - you are in scope. Payment is not required; a free service still counts.
- Monitoring the behaviour of people in the EU (Art 3(2)(b)). Analytics, tracking, profiling, ad-tech aimed at or capturing EU visitors brings you in even if you sell nothing.
- The pivot is the person's location. It is about individuals who are physically in the EU, not their citizenship. A French tourist buying from you in Singapore is a different question than a customer in Paris.
LiveThe stakes - why this is not the PDPA3 min▶
Being in scope matters because the GDPR's penalties dwarf the PDPA's. The GDPR has two tiers, and the serious one reaches EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. That percentage is on global turnover - not, as under the PDPA, on Singapore turnover alone.
- Real numbers: Meta was fined EUR 1.2 billion in 2023 for unlawful EU-to-US data transfers - the largest GDPR fine to date. Amazon was fined EUR 746 million in 2021.
- The contrast: the PDPA caps at S$1 million or 10% of Singapore turnover. For a multinational, the GDPR exposure is an order of magnitude larger, because the base is global.
- The leadership point: "are we in scope for the GDPR?" is a board-level risk question, not a compliance-team footnote. This session gives you the test to ask it.
Lumina's surprise. Our running-case Singapore SaaS (fictional) assumed the PDPA was its whole world - until a third of its signups turned out to be EU-based startups. That single fact put Lumina squarely in Article 3(2)(a). Nothing about the company changed; the customer base did. The practitioner track rebuilds Lumina to satisfy both regimes.
Self-studyThe one representative you may need (Art 27)2 min read▶
If the GDPR catches you under Article 3(2) and you have no EU establishment, Article 27 generally requires you to designate an EU representative - a contact point in the EU for individuals and authorities - unless a narrow exemption applies. It is an administrative step, not a huge one, but it is the practical tail of being in scope: the moment (a) or (b) catches your Singapore company, you have a representative to appoint and a lawful basis to establish for the EU data you already hold. Do not treat "the GDPR applies to us" as an abstract finding; it comes with a short list of concrete first actions the practitioner track walks through.
When both laws apply 8 min live
A Singapore company in scope for the GDPR does not stop being subject to the PDPA. It runs both. Knowing where the two regimes agree and where they diverge is what keeps you from building two disconnected compliance programmes.
LiveWhere GDPR is stricter, where PDPA is3 min▶
They are not ranked - each is stricter in places. Knowing which is which tells you where to level up.
| Dimension | GDPR | PDPA |
|---|---|---|
| Lawful basis | 6 co-equal bases; consent is one | Consent-first + exceptions |
| Individual rights | Broad (erasure, portability, object, restrict) | Access + correction only |
| Breach clock | 72h to authority from awareness | ~30-day assess, then 3 days; 500+ threshold |
| Penalty base | 4% of GLOBAL turnover | 10% of SINGAPORE turnover |
| DPO | Only in defined cases | Mandatory for EVERY org |
The practical rule: on any given point, meet the stricter requirement and you satisfy both. The PDPA already makes you appoint a DPO; the GDPR already makes you offer erasure. One well-built programme covers the union of the two.
LiveThe one scope nuance to keep honest3 min▶
It is tempting to say "the PDPA reaches overseas companies just like the GDPR does". Do not. The PDPA can apply to organisations whether or not formed in Singapore, but its reach is anchored to data activity connected to Singapore - not a GDPR-style test of "targeting or monitoring" Singapore residents from abroad. There is no clean PDPA parallel to GDPR Article 3(2).
- Say it this way: the GDPR can catch you purely for targeting EU individuals from Singapore; the PDPA's extraterritorial bite generally needs the data activity itself to touch Singapore.
- Why it matters: a Singapore company selling into the EU is more likely to be surprised by GDPR reach than a European company is to be surprised by PDPA reach. The asymmetry runs in your direction - which is the whole reason this course exists.
Run the Article 3 test on your business ★ 12 min · pen and paper
Applicability is not abstract once you run it on your own company. Three honest answers settle it.
Answer the three triggers for your organisation: do you have an EU establishment? Do you offer goods or services to people in the EU? Do you monitor behaviour of people in the EU? Yes to any one means in scope.
For each "yes", write the evidence - the EU customers, the euro pricing, the analytics on EU visitors. Vague "we might have some" becomes a concrete finding.
If you are in scope with no EU establishment, note the two first actions: appoint an EU representative (Art 27) and confirm a lawful basis for the EU data you already hold.
Circle whether you are single-regime (PDPA only) or dual-regime (PDPA + GDPR). That circle sets which parts of this course are urgent for you.
The stricter-of-the-two audit ★ 8 min · your next privacy review
If both regimes apply, four questions tell you where the GDPR raises your bar above what the PDPA already required.
"Do we rely only on consent, or have we documented a lawful basis for each use?" The GDPR wants a basis (of six) recorded, not just consent.
"Can an EU customer get their data erased, ported, or object to processing?" These rights have no PDPA equivalent - if your process only does access and correction, it is short.
"Could we notify an authority within 72 hours of becoming aware of a breach?" That is tighter than the PDPA's assessment window.
"When we send EU data to a Singapore server, what is our transfer mechanism?" The GDPR needs SCCs or adequacy, not just the PDPA's comparable-protection standard.
Before session a2 ◐ 30 min total
- Finish the Article 3 test for your organisation and record whether you are single- or dual-regime. Keep it - a5 (breach) and a6 (transfers) both build on it.
- Run the scope-check prompt and note the evidence for any "yes" - especially the offering-to-the-EU question, which turns on targeting, not mere website accessibility.
- Ask your team: what share of our customers or users are in the EU, and do we actually know?
- Optional: read GDPR Article 3 - it is three short paragraphs and repays the five minutes.
- Which of the three Article 3 triggers, if any, applies to us - and what is the evidence?
- If we are in scope, have we appointed an EU representative (Art 27) and set a lawful basis for our EU data?
- Where does the GDPR raise our bar above what the PDPA already required - rights, breach clock, transfers?
- What is our current mechanism for sending EU personal data to servers in Singapore?
- Are we running GDPR and PDPA as one programme, or two disconnected ones?
Official sources covered
Taught from the GDPR text and reputable comparative guidance. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · A Singapore company with no EU office sells its SaaS to customers in Germany. Under GDPR Article 3...
Offering goods or services to people in the EU brings a non-EU company into scope, payment or no payment. The pivot is the customer being in the EU, not where the company is.
2 · The GDPR's top-tier fine is tied to...
The upper tier is EUR 20M or 4% of global turnover. That global base is why GDPR exposure dwarfs the PDPA cap (10% of Singapore turnover) for a multinational.
3 · A right that GDPR gives individuals but the PDPA currently does NOT is...
Access and correction exist under both. Erasure, restriction, objection, and portability (legislated but not in force) are GDPR rights with no live PDPA equivalent.