Does the GDPR apply to us in Singapore?

It can, if you offer goods or services to people in the EU, monitor their behaviour there, or process personal data for EU clients. We assess this from your actual activities.

Is there a GDPR certification?

There is no general GDPR certificate. The regulation allows approved certification schemes, including European Data Protection Seal schemes endorsed by the European Data Protection Board, issued by accredited certification bodies.

Can EU clients send personal data to Singapore?

Yes, with safeguards. Singapore has no EU adequacy decision, so transfers usually rely on standard contractual clauses or other approved tools, supported by a transfer risk assessment.

How does the GDPR differ from the PDPA?

Both are principle-based. The GDPR adds more lawful bases, stronger rights, a 72-hour breach clock, and fines of up to 4% of worldwide annual turnover or EUR 20 million, whichever is higher.

GDPR

GDPR compliance (consulting and training)

The GDPR protects the personal data of people in the EU and can apply to Singapore organisations that serve or monitor them, or that process data for EU clients. ICFC maps your obligations, builds records of processing, impact assessments, transfer safeguards and breach procedures, and trains your team. There is no general GDPR certificate.

Service sheet (PDF)Word

Group

Cybersecurity, IT and Data Protection

Standard or scheme: GDPR; European Union
Type: Regulation; No official certification
Group: Cybersecurity, IT and Data Protection; View all 16 →
Funding: Not on the EDGE Standards list; Non-grant engagement

What is GDPR?

The General Data Protection Regulation (EU) 2016/679 governs the personal data of people in the European Union.

It applies to organisations outside the EU, including in Singapore, when they offer goods or services to people in the EU or monitor their behaviour there, and processors working for EU clients take on GDPR duties by contract. The EU has not issued an adequacy decision for Singapore, so transfers from the EU to Singapore rely on safeguards such as standard contractual clauses.

Who is GDPR for?

Singapore and regional organisations with EU customers, users, staff or clients, including SaaS, e-commerce, travel, education, research and outsourcing providers.

GDPR

Key details

Key obligations

A lawful basis and clear notices, records of processing activities, data protection impact assessments for high-risk processing, answers to rights requests within one month, security of processing, processor contracts, transfer safeguards, and notice to the supervisory authority within 72 hours of becoming aware of a reportable breach.

EU representative

Organisations outside the EU that fall under the GDPR because they target or monitor people in the EU usually need to appoint a representative in the EU. ICFC does not act as an EU representative; we help you decide whether you need one.

PDPA and GDPR together

Many PDPA practices carry over, but the GDPR adds lawful bases beyond consent, wider rights and a 72-hour breach clock. We map both so you run one privacy programme. ISO/IEC 27701 and the Data Protection Trustmark can support the same controls.

Rule changes to watch

The EU's Digital Omnibus proposals would amend parts of the GDPR and the cookie rules. When we checked on 12 October 2026 they were still being negotiated, so the current GDPR applies.

Our role

Consulting and training only. ICFC is not a law firm and does not give legal advice; for legal opinions on EU law, consult an EU-qualified lawyer.

Not on the EDGE Standards list

No grant found when checked - Non-grant engagement

We did not find this framework on the EDGE Standards list when we checked, so we quote it as a non-grant engagement. Check Enterprise Singapore before you assume any grant support.

About EDGE →Information checked 11 October 2026. Grant decisions are made by the funding agency.

Impartiality

Impartiality comes first. Every engagement begins with a conflict-of-interest check. We keep consulting and auditing roles separate, and our auditors never audit, on behalf of a certification body, an organisation that ICFC has consulted on the same scope within the period set by that body.

Our certification role

We do not certify organisations ourselves; certificates are issued by accredited certification bodies or scheme owners.

How we help

Certification

The GDPR allows certification under schemes approved by data protection authorities or the European Data Protection Board, issued by accredited certification bodies. ICFC does not issue GDPR certificates.

Compliance assessments

First-party gap assessments against the GDPR principles, lawful bases, rights handling, security, international transfers and accountability records, with a prioritised action list.

Processor reviews

Second-party reviews of your processors and sub-processors against your data processing agreements.

FAQ

Frequently asked questions

Service sheet

A one-page summary to share with your team.

Download PDF Word