The task behind the biggest fine
Moving EU personal data to a server outside the EU is the most scrutinised thing a non-EU company does under the GDPR. Singapore has no adequacy decision, so every EU-to-Singapore flow needs a mechanism - and, since Schrems II, more than a signed contract. This session turns that into a concrete, repeatable procedure: SCCs, a transfer impact assessment, and supplementary measures. Get it right once and it protects every EU data flow you run.
SCCs, then the assessment 7 min live
The modern transfer is three moves: sign the Standard Contractual Clauses, assess the destination country, and add measures where the assessment shows a gap. Skipping the middle move is exactly what Schrems II forbids.
LivePutting SCCs in place3 min▶
- What SCCs are: a pre-approved contract, published by the European Commission, between the data exporter (in the EU) and the importer (you, in Singapore). You use the correct module for your relationship (controller-to-processor, etc.) and fill in the annexes describing the data and measures.
- Who signs: for a Singapore company receiving EU customer data, your EU customers (the exporters) and you (the importer). Many put the SCCs inside the data processing agreement (session a4's Art 28 contract).
- Not set-and-forget: the annexes must actually describe your real processing and measures, and you revisit them when things change.
LiveThe transfer impact assessment3 min▶
The TIA is the Schrems II homework: before you rely on SCCs, you assess whether the destination country's law would undermine the protection the SCCs promise - chiefly, can its government access the data in ways an EU person could not challenge?
- What it asks: what data is transferred, to whom, under what local laws, and whether those laws permit disproportionate government access without redress.
- Then, measures: where the assessment finds a gap, add supplementary measures. The strongest are technical - strong encryption with keys held outside the destination, pseudonymisation - because they protect the data even if local law reaches the server.
- Document it: the TIA is your evidence that you did the Schrems II analysis, not just signed a template.
Lumina's Singapore region. Lumina hosts EU customer data in a Singapore cloud region. It puts SCCs into its customer DPA, runs a TIA on Singapore, and encrypts the data at rest with keys held in an EU-based key service it controls - so even if the data sat on the SG disk, it is unreadable without keys outside SG. That combination is what makes the transfer defensible.
Sub-processors and the data map 8 min live
The transfer you sign SCCs for is the obvious one. The transfers that catch people are the ones hidden in the tools: analytics, support, email, backups - each may move EU data somewhere, and each is your responsibility.
LiveCover the sub-processors3 min▶
- Every vendor that processes EU data is a transfer if it sits outside the EU. Your analytics tool, your help desk, your email sender, your cloud backups.
- The chain flows down: your processor's sub-processors matter too. Your DPA (Art 28) should require SCCs down the chain, and your ROPA's transfers column (session b5) is where you track them.
- The audit question: for every row in your transfers column, is there a named mechanism - SCCs, adequacy, or a derogation? A blank is an unlawful transfer waiting to be found.
Self-studyWhy data localisation is sometimes the simplest answer2 min read▶
Sometimes the cleanest way to solve a transfer problem is to not transfer. If your EU customers' data can live in an EU cloud region, then for that data there is no third-country transfer at all - no SCCs, no TIA, no supplementary measures needed for it. Many cloud providers make this a configuration choice: pick an EU region for EU customers. For a Singapore company, this is worth weighing against the operational cost of running EU infrastructure. The trade is real: localisation removes the hardest compliance task entirely for the localised data, at the price of some architectural complexity and cost. It is not always right - your analytics and support tools may still transfer - but for the core customer database, "keep EU data in the EU" can be simpler and safer than perfecting an SCCs-plus-TIA-plus-encryption stack. Treat localisation as a genuine option, not a last resort.
Lawful transfers for Lumina ★ 10 min · pen and paper
Attach a mechanism to every EU-out flow.
Take your transfers column from the b5 ROPA (or Lumina's: SG servers, analytics, support, backups). List each destination.
Name the mechanism for each: adequacy (rare), SCCs, or a derogation. Flag blanks.
For the Singapore server flow, write the three-step plan: SCCs in the DPA, a TIA on Singapore, encryption with keys held outside SG.
Consider localisation for the core customer DB: would an EU region remove the transfer entirely? Note the trade-off.
Before session b7 ◐ 40 min total
- For every destination in your transfers column, write the mechanism. Flag any blanks as urgent.
- Confirm whether you have current SCCs with your EU counterparties and whether a TIA on Singapore exists.
- Check where your encryption keys live - keys held in the destination country weaken the supplementary-measure argument.
- Read: GDPR Article 46 and skim the EDPB Recommendations 01/2020 summary on supplementary measures.
Official sources covered
Taught from the GDPR text and EDPB guidance. This page covers ~80% of the working content on transfers in practice.
Three questions before you go 🎯 ◐ 90 seconds
1 · For a Singapore company receiving EU data, the modern lawful transfer is...
Post-Schrems II, SCCs alone are not enough. You must assess the destination (a TIA) and add measures - especially strong encryption - where local law falls short.
2 · The strongest supplementary measure for a transfer to Singapore is usually...
Technical measures carry the most weight. Encryption with keys you hold outside Singapore protects the data even if local law could reach the server.
3 · Your US analytics vendor processes EU user data. This is...
Every sub-processor outside the EU that touches EU data is a transfer you own. Track it in your ROPA transfers column and ensure SCCs flow down the chain.