Author: Lawyer Zhang Jingxinyue, PRC-qualified Lawyer | Singapore Registered Foreign Lawyer
Note: Against the backdrop of Singapore's role as a regional operations and data hub, personal data processing is deeply embedded in every aspect of enterprises' day-to-day operations. From customer management to cross-border collaboration, data compliance is no longer an ancillary issue but a core factor directly affecting continuous business operations.
In 2026, the Personal Data Protection Commission (PDPC) of Singapore has significantly tightened enforcement, not only increasing penalties but also further clarifying key regulatory areas such as cross-border data transfers, sensitive data management, and the use of NRIC numbers. Recent cases in which Chinese-funded enterprises were penalized for multiple data violations directly reflect that Singapore's data regulatory approach has shifted from a "principles-based" approach to "substantive review."
Against the background of parallel application of China's Personal Information Protection Law and Singapore's PDPA, Chinese enterprises operating in Singapore often face the structural challenge of "dual-jurisdiction compliance." This article uses the latest enforcement cases as a starting point, combines regulatory changes and practical operations, summarizes the compliance risks most likely to be triggered by Chinese enterprises in Singapore, and sorts out feasible rectification pathways and key points for linking China-Singapore data outbound transfer arrangements.
01 Typical Case in Focus
1. Violations by Chinese-Funded Enterprises and Core Signals of PDPA Enforcement Escalation
1. (1)Case Facts: Multiple Violations Triggering Regulatory Penalties
In February 2026, Singapore's PDPC announced its latest enforcement decision: Air Sino-Euro Associates Travel Pte Ltd, a Chinese-funded enterprise (hereinafter the "Chinese-funded travel enterprise"), was imposed a substantial fine for violating multiple provisions of Singapore's Personal Data Protection Act (PDPA) and was ordered to complete comprehensive compliance rectification within 30 days.
After verification by PDPC, the enterprise was found to have committed three core violations:
- Failure to implement reasonable security measures to protect customers' personal data: sensitive personal data such as collected tourists' passport information, contact details, and travel records were not stored in encrypted form, and the business system had security vulnerabilities, posing a real risk of data leakage;
- Failure to complete statutory compliance procedures for cross-border data transfer: personal data of local Singapore customers was directly transferred to related companies in mainland China for business analysis without completing the filing procedures with the PDPC and without signing a data protection agreement with the data recipient that complies with PDPA requirements;
- Misuse of NRIC numbers: the enterprise collected local Singapore customers' National Registration Identity Card (NRIC) numbers beyond the necessary scope during customer registration and failed to delete the relevant data promptly after the business was completed, violating the PDPA regulatory requirement of "minimum necessary collection" of NRIC numbers.
This penalty is not only a compliance warning from the PDPC to Chinese-funded enterprises but also sends a clear regulatory signal: Singapore's data protection enforcement in 2026 will become stricter and more targeted; scenarios such as cross-border data transfer, sensitive data storage, and the use of NRIC numbers have become regulatory priorities; and regulatory standards will be applied uniformly to both foreign-funded and Chinese-funded enterprises with no room for exceptions.
The core of such cases does not lie in whether individual applicants' qualifications meet the required standards, but in whether the enterprise has incorporated the employment structure itself into its compliance design.
2. Core Changes in the 2026 PDPA Enforcement Escalation: Compliance Thresholds Significantly Raised
Compared with previous regulatory rules, Singapore's PDPA enforcement standards and regulatory requirements have substantively changed in 2026, directly raising the data compliance threshold for Chinese enterprises going to Singapore and forming the core regulatory background for the penalty imposed on this Chinese-funded travel enterprise:
- Significantly tougher penalties, with the maximum fine raised to 10% of an enterprise's global annual revenue: breaking away from the previous fixed-amount fine model, the maximum fine for data violations is now linked to an enterprise's global annual revenue. For Chinese enterprises operating at scale, the cost of violations has risen substantially and the deterrent effect of regulation has significantly strengthened;
- Identifying key regulatory areas and drawing a hard red line for NRIC number use: sensitive personal data such as NRIC numbers and passport information of Singapore citizens and permanent residents are listed as key protection objects. Enterprises are expressly required to follow the principle of "minimum necessity and shortest retention"; collection beyond the necessary scope and retention beyond the required period will both be directly treated as violations;
- Further tightening compliance requirements for cross-border data transfer: certain exemptions for cross-border data transfer have been removed. Enterprises transferring Singapore local personal data overseas must complete filing with the PDPC and sign a data protection agreement with the overseas recipient that complies with PDPA requirements, ensuring that the protection standard for the data outside Singapore is no lower than Singapore's local requirements;
- Strengthening enterprise primary responsibility and upgrading DPO qualification requirements: enterprises operating in Singapore must appoint a dedicated Data Protection Officer (DPO), and the DPO must have corresponding professional data protection competence and experience (the PDPC recommends receiving relevant training). The enterprise must ensure that the DPO's performance is substantive and independent, avoiding "nominal DPO" arrangements, and must effectively supervise the DPO's performance to ensure that the data protection system is actually implemented.
02 High-Frequency Risk Scenarios for Data Compliance of Chinese Enterprises Going to Singapore
Based on the latest PDPC enforcement cases and the operational practice of Chinese enterprises going to Singapore, the following five types of scenarios are high-risk areas for data violations and are also the PDPC's key inspection directions after this enforcement escalation. Enterprises should conduct self-checks against these scenarios to prevent compliance risks.
1. Cross-Border Data Transfer Without Completing Compliance Procedures: "Bare Transfer" Is Common
This is the most common violation by Chinese enterprises. Due to business coordination needs with their headquarters in China, many Chinese enterprises directly transfer local Singapore customer data and business data to China via email, cloud drives, enterprise communication tools, or similar means without completing filing procedures, without signing data protection agreements, and without implementing supporting security measures. This directly violates the mandatory requirements on cross-border data transfer under the PDPA.
2. Sensitive Data Collection Beyond Statutory Scope: Prominent Abuse of NRIC Numbers
Some Chinese enterprises, for administrative convenience, collect sensitive data such as Singapore customers' NRIC numbers, home addresses, and bank account information beyond the necessary scope during business processing, and may even retain such data for a long period after the business ends. This violates the "minimum necessary" collection principle established by the PDPA.
3. Failure to Take Reasonable Security Measures for Data Storage, Creating Data Leakage Risks
Enterprises do not encrypt stored personal data, fail to set tiered access permissions in business systems, allow ordinary employees to view and download sensitive customer data at will, and do not conduct regular data security vulnerability testing. This creates major hidden risks of data leakage and directly violates the core data security protection obligations under the PDPA.
4. DPO Appointment Does Not Meet Regulatory Requirements, and the Data Protection System Becomes a Formality
To meet formal compliance requirements, some Chinese enterprises appoint administrative or finance personnel to serve as DPOs without providing professional training. The DPOs do not have the professional qualifications and performance capabilities recognized by the PDPA. At the same time, enterprises either fail to establish comprehensive data protection policies covering the entire data lifecycle, or their policies remain only on paper and are not actually implemented.
5. Irregular Customer Data Authorization and Failure to Obtain Lawful and Effective Informed Consent
When collecting customer personal data, enterprises fail to inform customers in a clear and understandable manner of the purpose, scope, methods of use, and cross-border transfer arrangements for the data collection. They may obtain customer confirmation only through boilerplate clauses in a general manner, or even collect and use personal data without obtaining customer consent at all, violating the core "informed consent" principle of the PDPA.
03 Practical Rectification Pathways for Data Compliance of Chinese Enterprises Going to Singapore Under the New Rules
In response to the regulatory requirements under the 2026 PDPA enforcement escalation, and taking into account the operating scenarios of Chinese enterprises going to Singapore, this article sets out a compliance rectification plan that can be directly implemented. From core procedures to day-to-day operations, it helps enterprises build a full-process data compliance system and avoid regulatory red lines.
1. Core Procedures: Two Compliance Actions That Must Be Completed for Cross-Border Data Transfer
Cross-border data transfer is a core pain point for Chinese enterprises in data compliance and a key regulatory area for the PDPC. Where an enterprise transfers Singapore local personal data overseas, whether the recipient is its headquarters in China or another related entity, it must complete the following two compliance procedures:
- Ensure that the cross-border data recipient provides a level of protection not lower than the requirements of the PDPA: Where an enterprise transfers Singapore personal data overseas, it should ensure, by signing a data protection agreement (DPA), adopting standard contractual clauses, or using other legal and technical measures, that the overseas recipient's data protection standards are comparable to Singapore's local requirements, and maintain internal records and ongoing review of the relevant arrangements;
- Sign a data protection agreement (DPA) with the overseas recipient: The agreement must specify core content including data protection standards, the recipient's data security obligations, data breach emergency response measures, and protection of data subject rights, ensuring that the overseas recipient's data protection standards comply with PDPA requirements. The agreement must be signed and sealed by the legal representatives of both parties and have full legal effect.
2. Sensitive Data Management: Strictly Follow the Principle of "Minimum Necessity and Shortest Retention"
- Strictly control the collection of NRIC numbers: Except in scenarios expressly mandated by Singapore law, enterprises must not collect customers' NRIC numbers and may use alternative means such as mobile phone numbers or email addresses for customer identification. If collection is truly necessary, the enterprise must clearly explain the purpose and scope of use of the collection to the customer, and after the collection purpose is achieved, delete or anonymize the relevant data within a reasonable period;
- Encrypted storage of sensitive data: Sensitive personal data collected from customers, such as passport information, contact details, and bank account information, should be encrypted for storage. Business systems should set tiered access permissions so that only personnel in relevant positions can view corresponding data, and all data operations should be fully logged and traceable;
- Establish a data retention period management system: Based on business needs and legal requirements, establish statutory retention periods for different types of data, and automatically delete data when the retention period expires. Where retention beyond the period is truly necessary, the data subject must be clearly informed of the reasons for the retention and separate consent must be obtained.
3. Primary Responsibility: Regulate DPO Appointment and Promote Implementation of the Data Protection System
- Regulate the appointment of a dedicated and qualified DPO: Engage a person with professional qualifications recognized by the PDPC to serve as a dedicated DPO. Non-professional personnel such as administrative or finance staff must not serve concurrently in this role. The DPO should report directly to the enterprise's legal representative, independently carry out data protection work, and have independence in performing his or her duties;
- Establish comprehensive data protection management policies: Based on the enterprise's specific business scenarios, formulate data protection policies covering the entire lifecycle of data collection, storage, use, transfer, and deletion. Clarify the compliance responsibilities of each department and position, publish the policies internally, and organize compliance training for all employees;
- Conduct regular data compliance self-inspections and vulnerability testing: Led by the DPO, carry out a full-process data compliance self-inspection once each quarter to promptly identify and rectify violations. Conduct at least one data security vulnerability test of business systems each year to ensure system security and prevent data leakage risks.
4. Daily Operations: Regulate Customer Data Authorization Processes and Fully Preserve Compliance Evidence
- Optimize the customer data collection authorization process: Inform customers in a clear and understandable manner of the purpose, scope, methods of use, and cross-border transfer arrangements for data collection; avoid using overly broad boilerplate clauses; and protect customers' right to make independent choices. Relevant authorization records must be retained for at least three years to form complete compliance evidence;
- Establish a full-process traceability system for data processing: Record operations across all stages of customer data handling, including collection, storage, use, transfer, and deletion, and specify the operator, time of operation, content of operation, and approval process. This creates a complete compliance evidence chain for PDPC regulatory inspections.
04 Key Points
1. Rules for Bridging Dual Compliance for China-Singapore Data Outbound Transfer
The data compliance issues of Chinese enterprises in Singapore can be summarized as three gaps: data flow gap, responsibility system gap, and compliance evidence gap.
Chinese enterprises going to Singapore must not only comply with the regulatory requirements of Singapore's PDPA but also meet the mandatory data outbound transfer requirements under China's Personal Information Protection Law and Data Security Law. Achieving "dual-jurisdiction compliance" is the core key, avoiding compliance conflicts in which an enterprise "complies with Singapore regulatory requirements but violates Chinese legal provisions":
- Clarify the dual filing requirements for data outbound transfer: Where personal data in China is transferred to Singapore, the enterprise must, depending on the type and scale of data, comply with China's legal requirements such as a data export security assessment, filing of standard contracts for outbound transfer of personal information, or certification. Where Singapore personal data is transferred into China, the enterprise must complete the cross-border data transfer filing with Singapore's PDPC. Both procedures are indispensable;
- Unify data protection standards: Whether in China or Singapore, personal data protection standards should remain consistent. Security measures such as encrypted storage, tiered access permissions, and full-process traceability should be adopted to ensure that data processing activities comply with the legal requirements of both jurisdictions;
- Establish an emergency response mechanism for cross-border data transfer: Formulate a special emergency response plan for data breaches. If a cross-border data breach occurs, reporting obligations must be performed within statutory time limits to both China's cyberspace administration authorities and Singapore's PDPC, and effective measures must be taken to prevent the expansion of losses and protect the lawful rights of data subjects.
Conclusion
The stricter PDPA enforcement in 2026 is not merely a numerical change in penalty levels. It reflects a fundamental shift in the focus of Singapore's data regulation—from formal compliance review to substantive compliance control over the entire process of enterprise data processing.
For Chinese enterprises going to Singapore, data compliance is no longer a localized or isolated operational risk but a foundational compliance requirement running through the enterprise's entire operating system. Any structural deficiencies in data collection, use, transfer, or retention may be magnified into significant compliance risks during regulatory inspections.
From a practical perspective, the key to cross-border data compliance lies not in responding to fragmented regulatory requirements item by item, but in establishing an overall compliance system that can simultaneously cover the regulatory logic of both China and Singapore. Cross-border transfer arrangements, sensitive data management, DPO function design, and the compliance records system must all form a closed loop at the design stage.
In the current regulatory environment, the question enterprises truly need to answer is no longer "whether formal compliance has been completed," but whether their data processing system can maintain consistency and verifiability of compliance logic under continuous regulatory scrutiny across different jurisdictions.
- If you would like to further discuss relevant issues or obtain professional services at the individual case level, please contact the professional team of China-Singapore Legal News.
This article is general information and not legal advice. Specific matters require assessment by appropriately qualified professionals.