Cross-border transfers

The Transfer Limitation Obligation

An organisation may transfer personal data outside Singapore only if it takes appropriate steps to ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to the Act. The Personal Data Protection Regulations 2021 specify that such obligations may arise from law, contract, binding corporate rules or any other legally binding instrument. The Commission has recognised the ASEAN Model Contractual Clauses as a suitable contractual basis.¹ Transfers may also be made with the individual's consent after notification of the risks, or where necessary for the performance of a contract with the individual. A Singapore exchange that shares customer data with a group company in Zug for compliance review, with a Swiss custodian for onboarding, or with a cloud provider in Europe must have one of these bases in place.

The Swiss side

Switzerland's revised Federal Act on Data Protection (FADP, DSG) has been in force since 1 September 2023. It permits transfers abroad only to countries whose legislation the Federal Council has recognised as providing adequate protection, or where safeguards such as standard contractual clauses or binding corporate rules are in place.² Singapore is not on the Swiss adequacy list as of 30 June 2026. A Zug entity sending personal data to its Singapore affiliate must therefore rely on standard contractual clauses, which in practice means the EU Standard Contractual Clauses with the Swiss amendments recognised by the Federal Data Protection and Information Commissioner. The Singapore entity sending data to Switzerland has the easier task, since Swiss law provides comparable protection and a simple intra-group agreement incorporating the Singapore obligations suffices. Part D, Chapter X discusses the Swiss rules.

Checklist

A Swiss–Singapore crypto group should have the following data protection documents in place before sharing customer data across the border. - A data map identifying what personal data each entity holds, where it is stored, and which cloud and analytics vendors process it. - An intra-group data transfer agreement incorporating the EU Standard Contractual Clauses with Swiss amendments for transfers from Switzerland, and the ASEAN Model Contractual Clauses or equivalent for transfers from Singapore. - Privacy notices in each jurisdiction that disclose cross-border transfers, blockchain analytics vendors and the retention periods required by AML law. - A breach response plan that meets the three-day PDPC notification, the Swiss "as soon as possible" notification to the Commissioner, and the one-hour MAS incident notification. - A data retention schedule reconciling the five-year AML retention requirement with the retention limitation obligation. - An on-chain data policy stating that no personal data is written to a public blockchain and that wallet-address linkages are stored off-chain under access control.

Notes

Personal Data Protection Act 2012, s 26, and Personal Data Protection Regulations 2021, regs 10–11 (transfer of personal data outside Singapore). ↩
Art. 16–17 FADP (SR 235.1). The list of adequate countries is in Annex 1 to the Data Protection Ordinance (SR 235.11). ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.

English

Contact

Dr Alexander Ressos, TEP

Of Counsel, KGP Legal LLC

I am Of Counsel with KGP Legal LLC in Singapore, where I work with a global client base of successful entrepreneurs and their families, independent asset managers, commodity trading houses and other commercial clients. I am a German and Swiss attorney-at-law, also admitted as a solicitor in England & Wales and in Hong Kong. I divide my time between Zug in Switzerland, Singapore and Hong Kong. Since 2017 I have advised international clients on more than 700 crypto and digital asset projects. I also have extensive experience in cross-border litigation and arbitration in Singapore, Hong Kong and other markets in South-East Asia and Greater China.

I operate across the key financial centres in South-East Asia, the Middle East and Switzerland, with a particular focus on asset protection, international tax and estate planning, as well as trusts, company administration and other fiduciary services. My philosophy is to serve as a trusted advisor working closely with my clients and to help them achieve their commercial objectives.

All Singapore law advice is provided through KGP Legal LLC, an established and duly licensed firm of Singapore advocates and solicitors.

KGP Legal LLC is a medium-sized law firm in Singapore that is capable of providing the full range of legal services and corporate administration work. Please contact me if you need any further information.

Get in touch →

Articles and Insights

Setting up or expanding in Singapore?

SingaporeIQ is edited by Dr Alexander Ressos, an international business lawyer with more than 15 years of local experience in Singapore as a permanent resident, a Singapore registered foreign lawyer and managing partner of a Singapore foreign law practice. In addition to significant experience in cross-border investments and transactions, UHNWI private client work and sanctions/export controls, Dr Ressos has extensive experience in cross-border business and in crypto and digital-asset projects in Singapore, drawn from more than 700 projects since 2017.

If you are planning a company incorporation, an investment, a holding structure or a market entry through Singapore, you can reach Dr Ressos directly at [email protected]. Singapore law advice is provided by KGP Legal LLC, a licensed firm of Singapore advocates and solicitors. Dr Ressos and his team facilitate the full range of Singapore legal, compliance and company administration services, including company incorporation, corporate transactions, commercial contracts, crypto and digital assets, financial regulatory work and dispute resolution, including litigation in the Singapore courts. For Hong Kong, our parallel site HongkongIQ.com offers the same practical guidance. For crypto and digital assets, dltreg.com covers legal, tax and fiduciary services. For legal, tax and fiduciary services in Switzerland, see helveticaregister.com.