Singapore's Personal Data Protection Act v the EU's GDPR

The European Union’s General Data Protection Regulation (GDPR) is often said to be the ‘gold standard’ regarding data protection.  (I would argue that China’s Personal Information Protection Law requires higher standards than the GDPR, but that’s a subject for another day.)

Singapore’s Personal Data Protection Act (PDPA) appears to be quite different from the GDPR – while the GDPR has six lawful bases for processing personal data and the data controller must choose the correct basis, the PDPA always requires the data subject’s consent … except where there is an applicable exception to consent.

Broadly speaking, the exceptions to consent required under the PDPA result in consent being required under the PDPA in the same situations as consent is required under the GDPR.

Despite the similarity in outcomes, in global data processing arrangements data processing agreement and a privacy policy that satisfy the requirements of the GDPR do not satisfy the requirements of the PDPA – or, in other words, a global organisation is typically mistaken if it believes that compliance with the PDPA in Singapore follows from compliance with the GDPR.  (It does not give rise to compliance with China’s Personal Information Protection Law and other relevant laws and regulations regarding data processing with a Chinese connection either.)

Consequently, global data processing arrangements that include personal data collected, used or disclosed in Singapore need to be reviewed from a Singaporean perspective with a view to avoid giving rise to regulatory action in Singapore.