ShareAndGoShareAndGo

Compliance

GDPR for Singapore businesses: when it reaches you, and when it does not.

Singapore businesses deal with Europe constantly: European customers, investors, acquirers, suppliers and staff. Somewhere in that relationship, someone usually asks whether the EU's General Data Protection Regulation applies.

The honest answer is that it depends on what you do, not where you are. This article explains the test the European Commission describes, how the GDPR sits next to Singapore's Personal Data Protection Act, and what to think about when European personal data ends up in documents you share. It is general information. A lawyer who knows both regimes should confirm your position.

Get started

The test: targeting or monitoring people in the EU

According to the European Commission's guidance on who data protection law applies to, the GDPR applies to a company established outside the EU where it offers goods or services, paid or free, to individuals in the EU, or monitors the behaviour of individuals in the EU.

The Commission gives a useful contrast. A small online education company based outside the EU that targets mainly Spanish and Portuguese language universities in the EU is covered. A service provider based outside the EU that serves customers outside the EU, whose clients happen to use its services while travelling in the EU, is not covered, provided it does not specifically target its services at individuals in the EU.

For a Singapore business, the practical questions are therefore:

  • Do we market to people in EU countries, for example with pages in their languages, prices in euros, or delivery to EU addresses?
  • Do we track the behaviour of people in the EU, for example through profiling or analytics aimed at them?
  • Do we have an establishment, such as an office or branch, in the EU?

A yes to any of these is a reason to take advice. Having European clients through a business-to-business relationship is a different question again, and the answer depends on the detail.

What being in scope involves

The European Commission's enforcement page says a data protection authority can impose fines of up to EUR 20 million or 4% of a business's total annual worldwide turnover. Its example of a shop whose customer database is breached says the shop must notify its data protection authority within 72 hours, unless the breach is unlikely to put its clients' rights at risk.

The European Data Protection Board's guidance for small businesses notes that an organisation not established in the EEA but within the GDPR's territorial scope might need to appoint a representative in one of the EEA countries. Whether you need one, and who it should be, is a question for your adviser.

Side by side with the PDPA, at a high level

Many Singapore businesses will be subject to both regimes for different data, so it helps to see where they line up. This comparison is deliberately broad and leaves out a great deal.

TopicPDPA (Singapore)GDPR (EU)
Who it coversOrganisations collecting, using or disclosing personal data in SingaporeIncludes organisations outside the EU that target or monitor people in the EU
Breach notice to regulatorNo later than three calendar days after determining a breach is notifiable (PDPC breach guide)Within 72 hours in the Commission's example
Maximum fineUp to S$1 million or 10% of Singapore turnover, whichever is higher, where turnover exceeds S$10 million (PDPC)Up to EUR 20 million or 4% of worldwide turnover (European Commission)
Sending data abroadTransfer Limitation Obligation (section 26)Adequacy decisions let data flow to listed countries without further safeguards

The PDPA figures come from the PDPC's Guide on Managing and Notifying Data Breaches and its Advisory Guidelines on Enforcement of the Data Protection Provisions. The two breach clocks start from different events and run for different lengths, so a business under both needs a response plan that can meet the shorter one.

Singapore and EU adequacy

The European Commission can decide that a country outside the EU offers an adequate level of protection, so that personal data can flow there from the EU without further safeguards. We checked the Commission's list of adequacy decisions on 25 October 2026. It names Andorra, Argentina, Brazil, Canada for commercial organisations, the Faroe Islands, Guernsey, Israel, the Isle of Man, Japan, Jersey, New Zealand, the Republic of Korea, Switzerland, the United Kingdom, the United States for organisations in the EU-US Data Privacy Framework, Uruguay, and the European Patent Organisation. Singapore is not on it.

That matters when European personal data is sent to you in Singapore. The European sender will usually need some other basis for the transfer, and may ask you to sign up to contractual terms. Your adviser can tell you what is being asked of you.

What this means for shared documents

Cross-border deals and audits often put European personal data into the documents a Singapore business shares: employee lists of a European subsidiary, customer contracts, shareholder registers. Whichever law applies, the same practical habits help.

  • Share only what the recipient needs. Remove personal data that does not serve the purpose.
  • Know where the documents are stored. For a ShareAndGo Singapore workspace, your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them.
  • Limit each party to its own folders with groups, and share view-only where downloads are not needed.
  • Keep a record. ShareAndGo's audit log captures every view, upload, download, invitation and change, chained so alterations are detectable, which helps you answer questions from either regulator about who saw what.

None of this decides whether the GDPR applies to you, or satisfies it if it does. It makes the facts easier to find when you need them.

Questions people ask

Does the GDPR apply to every Singapore company with European customers?
Not automatically. The European Commission's guidance turns on whether you offer goods or services to, or monitor the behaviour of, individuals in the EU. Ask an adviser about your specific situation.
Is Singapore an EU adequate country?
Not as of 25 October 2026, when we checked the European Commission's list of adequacy decisions.
Can one breach plan cover both the PDPA and the GDPR?
It can be one plan, but it must meet both clocks. The PDPC requires notice no later than three calendar days after a breach is determined notifiable, and the European Commission's example gives 72 hours. Have an adviser review the plan.

Keep reading

Why data location matters

How the PDPA governs personal data sent outside Singapore.

Data sharing agreements

What a Singapore data sharing agreement should cover.

Privacy

Where ShareAndGo stores data and which services run elsewhere.

Know where your shared documents are, and who opened them.

Stored in Singapore, with a chained record of every view.

Get started