Data protection in the travel rule
Transmitting a customer's name, address and identification number to a foreign institution is a cross-border transfer of personal data. In Singapore the PDPA's transfer-limitation obligation requires the transferring organisation to ensure that the recipient is bound by legally enforceable obligations to protect the data to a standard comparable to the PDPA, unless an exception applies.1 The exception for transfers required by law covers the transmission itself where PSN02 requires it. It does not cover the choice of an insecure channel or the transmission to a counterparty that cannot protect the data. Firms should ensure that their travel-rule network's terms impose data-protection obligations on all participants and should record the assessment. On the Swiss side the Federal Act on Data Protection (FADP; DSG) of 2023 imposes comparable requirements, discussed in Part D, Chapter X.
Notes
- Personal Data Protection Act 2012, s. 26 (transfer of personal data outside Singapore) and Personal Data Protection Regulations 2021, reg. 10 (conditions for transfer). ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.