Data protection: Comparison with Switzerland
The Swiss and Singapore regimes are close in structure and differ in enforcement. Switzerland has no administrative fines against organisations. Its sanctions are criminal fines of up to CHF 250,000 against the responsible individuals, which concentrates the mind of a compliance officer in a different way.1 Singapore fines the organisation up to 10 per cent of local turnover. Switzerland requires breach notification "as soon as possible" where the breach is likely to result in a high risk. Singapore gives three days after assessment and sets a numerical threshold. Switzerland treats data about an identifiable person as personal data in the same way as Singapore and has the same difficulty with public blockchains, on which the Federal Data Protection and Information Commissioner has not issued guidance comparable to the Singapore guide. A group that builds its privacy programme to the Singapore standard will generally satisfy the Swiss one, with the addition of the Swiss-specific documents: the register of processing activities and the data protection impact assessment for high-risk processing.2
Cross-border perspective
You can run a single privacy programme for a Zug–Singapore group if you adopt the stricter rule on each point. Keep personal data off every public chain. Treat wallet addresses linked to known customers as personal data in both places. Use the EU Standard Contractual Clauses with Swiss amendments for every transfer out of Switzerland and a binding intra-group agreement for every transfer out of Singapore. Set the breach clock to the shortest applicable period, which is the one-hour MAS incident notification for licensed entities and the three-day PDPC notification for personal data. A programme built this way will withstand an inspection by either regulator and, more to the point, will withstand the attention of the people who attack crypto businesses for their customer lists.
Notes
- Art. 60–63 FADP (SR 235.1). ↩
- Art. 12 (register of processing activities) and Art. 22 (data protection impact assessment) FADP (SR 235.1). ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.