Why transfers are the sharp end for a SG company
The GDPR does not want EU personal data to lose its protection just because it crosses a border. So it restricts sending that data to a "third country" - which, for a Singapore business, is your own country. Unlike an EU-to-EU flow, moving EU customer data to a server in Singapore is a regulated transfer that needs a legal mechanism and, after the Schrems II ruling, a real look at whether Singapore law protects it. The biggest GDPR fine on record was exactly this failure. This session gives you the mechanisms and the decision.
Three ways to transfer 9 min live
A transfer to a third country needs one of three mechanisms. For a Singapore company with no adequacy decision, one of them does almost all the work.
LiveThe three mechanisms, ranked by how you will use them3 min▶
- Adequacy (Art 45): the easy path - if the European Commission has ruled a country's protection essentially equivalent, you transfer freely. But Singapore has no adequacy decision, so this door is closed for SG-bound data.
- Appropriate safeguards (Art 46): the workhorse. Standard Contractual Clauses (SCCs) - a pre-approved contract between exporter and importer - are how most Singapore companies lawfully receive EU data. Binding Corporate Rules are the intra-group version.
- Derogations (Art 49): narrow, mostly one-off exceptions (explicit consent, performing a contract). Not a foundation for routine, ongoing transfers - do not build a data pipeline on them.
LiveWhat Schrems II added3 min▶
In 2020 the EU's top court (the Schrems II judgment) struck down the EU-US Privacy Shield and made clear that signing SCCs is not enough on its own. You must also assess the destination country's laws - can its government access the data in ways that undermine EU protection? - and add supplementary measures where needed, with the most weight on technical ones like strong encryption.
- This is a transfer impact assessment (TIA). SCCs + a documented TIA + supplementary measures is the modern standard.
- Why it hit Meta: the EUR 1.2 billion fine was precisely for transfers to the US where SCCs plus measures were found not to remedy the risk. The lesson: the paperwork alone does not protect you if the destination's law does not.
Lumina picks a region. Lumina hosts EU customer data on a Singapore cloud region. To keep it lawful, Lumina puts SCCs in place with its EU customers, runs a transfer impact assessment on Singapore, and encrypts the data with keys it controls. The practitioner track (b6) walks through exactly this.
Self-studyvs the PDPA Transfer Limitation2 min read▶
The PDPA has its own cross-border rule - the Transfer Limitation Obligation (s.26) - but it works differently. Rather than the GDPR's prescriptive list of adequacy decisions and prescribed clauses, the PDPA uses an outcome-based "comparable protection" standard: before you send personal data overseas, you must ensure the recipient provides a standard of protection comparable to the PDPA, typically through a contract. It is more flexible and more self-assured than the GDPR's mechanism-driven approach. For a dual-regime company the practical consequence is that the GDPR is the stricter master here: satisfy the GDPR transfer rules (SCCs + TIA) and your PDPA comparable-protection obligation is comfortably met on the same data. Build to the GDPR standard and document once.
The transfer decision, for you 7 min live
Transfers are not abstract for a Singapore business - they are your architecture. The decision is: for each flow of EU data leaving the EU, what mechanism carries it, and have you done the Schrems II homework.
LiveKnow where your EU data physically sits3 min▶
You cannot govern a transfer you cannot see. The first move is a map: which of your systems hold EU personal data, and where - physically - does that data live? Cloud regions, backups, analytics tools, support platforms, sub-processors all count.
- Every EU-data flow leaving the EU needs a mechanism. If you cannot name it, you have an unlawful transfer running.
- Sub-processors are transfers too. Your analytics vendor in the US, your support tool's servers - each is a transfer you are responsible for.
- The leadership question: not "are we compliant" in the abstract, but "do we have a data map, and does every EU-out flow on it have a named mechanism".
Map your cross-border flows ★ 12 min · pen and paper
Find every place EU data leaves the EU in your operation.
List the systems that hold personal data of EU individuals - your app database, CRM, analytics, support tool, backups.
For each, write where the data physically sits (cloud region, country) and whether that is inside or outside the EU.
For every "outside the EU" row, name the transfer mechanism (adequacy / SCCs / derogation). Blanks are unlawful transfers to fix.
Circle the flows going to Singapore or the US - those are your SCCs-plus-Schrems-II priorities.
The SCCs readiness check ★ 8 min · your next vendor review
Four questions that reveal whether your transfers would survive scrutiny.
"Do we have SCCs in place with the EU parties whose data we receive?" No SCCs and no adequacy = no lawful basis for the transfer.
"Have we done a transfer impact assessment on Singapore (and any other destination)?" Post-Schrems II, SCCs alone are not enough.
"Is the data encrypted, and who holds the keys?" Encryption with keys you control is the strongest supplementary measure.
"Do our sub-processors' transfers meet the same bar?" Their non-compliance is your exposure.
Before the practitioner track ◐ 30 min total
- Finish your cross-border data map and mark the flows missing a mechanism. Session b6 turns it into an action plan.
- Check whether you have current SCCs with your EU counterparties, and whether a transfer impact assessment exists for Singapore.
- List your sub-processors and where they hold data - each is a transfer you own.
- Optional: read GDPR Articles 45 and 46 - adequacy and safeguards, the two mechanisms you will actually use.
- Do we have a map of where EU personal data physically lives across our systems and sub-processors?
- For every flow of EU data leaving the EU, what is the named transfer mechanism?
- Do we have SCCs with the EU parties whose data we receive, and a transfer impact assessment on Singapore?
- Is EU data encrypted in transit and at rest, and who controls the keys?
- Given the Meta case, do we treat transfers as our top GDPR fine risk?
Official sources covered
Taught from the GDPR text and EDPB guidance. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · A Singapore company receives EU customer data on a Singapore server. Because Singapore has no EU adequacy decision, it most likely needs...
No adequacy means the adequacy door is closed. SCCs (Art 46) are the workhorse safeguard, and post-Schrems II they must be paired with a transfer impact assessment and supplementary measures.
2 · What did the Schrems II ruling establish about SCCs?
Schrems II kept SCCs valid but required a case-by-case assessment of the destination plus supplementary measures (especially strong encryption) where local law falls short.
3 · Compared with the GDPR, the PDPA's cross-border rule is...
The PDPA Transfer Limitation Obligation uses a comparable-protection standard the org self-assures, rather than the GDPR's prescriptive adequacy lists and prescribed clauses. Meet the GDPR bar and the PDPA one follows.