Hosting Singapore business data in the EU: PDPA Transfer Limitation and GDPR explained

How the PDPA Transfer Limitation Obligation applies when your server is in the EU, and what GDPR adds. As of 30.09.2026.

Short answer

1. 1Singapore's Personal Data Protection Act 2012 (PDPA) does not ban hosting personal data outside Singapore. Its Transfer Limitation Obligation (section 26) says an organisation may transfer personal data overseas only in line with prescribed requirements, so that the data keeps a standard of protection comparable to the PDPA.
2. 2According to summaries of the Personal Data Protection Commission's (PDPC) guidance, an organisation can meet this through legally enforceable obligations on the recipient, such as contract clauses, or through other routes the rules allow, such as consent. We could not open the official text for this page, so check it before you rely on it.
3. 3Your company stays accountable for its customers' data when a host in Frankfurt processes it for you. The move is something you assess, document and put in a contract.
4. 4GDPR is a separate EU law. It can apply to the hosting provider's own operations in the EU; it does not replace your PDPA duties.
5. 54hosting runs a datacentre in Frankfurt, not in Singapore, and does not certify legal compliance for clients. As of 30.09.2026; general information, not legal advice.

What the Transfer Limitation Obligation asks of you

Section 26 of the PDPA is the transfer rule. As summarised in PDPC guidance and law-firm commentary, the recipient of data sent abroad must be bound by legally enforceable obligations to give it protection comparable to the PDPA. Those obligations can come from a contract, from the law of the recipient's country, or from other mechanisms the rules recognise.

This page relies on those summaries: the official statute site returned an access error and the PDPC documents did not open for us. Read the current text of the PDPA and the PDPC's Advisory Guidelines on Key Concepts before you sign anything.

What GDPR adds when the server is in the EU

GDPR governs how a provider operating in the EU handles personal data, including the duty to process on the customer's documented instructions under a data processing agreement (Article 28). It gives you a framework you can point to in your own assessment.

It does not decide whether your PDPA transfer is lawful. That question stays with you as the organisation that collected the data. Keep the two analyses side by side: PDPA for your obligations in Singapore, GDPR for what the EU host must do.

Questions to ask any overseas hosting provider

Where exactly are the servers, and who are the sub-processors? Will the provider sign a data processing agreement that binds it to your instructions and to a comparable standard of protection? Which transfer safeguards does it offer? How are backups, deletion and incident notification handled?

Store the answers, the signed agreement and a short written assessment together. If a regulator or customer asks how you protect data abroad, that file is your evidence.

Two Singapore scenarios

Common mistakes

• Treating the server location as a purely technical choice and keeping no written assessment.
• Assuming a provider's standard terms are enough without a data processing agreement.
• Believing GDPR compliance by the host settles your own PDPA obligations.
• Forgetting that access control, keys and backups on your side count toward protection too.

How 4hosting helps

Our datacentre is in the EU (Frankfurt), not in Singapore. We provide a data processing agreement under GDPR Article 28 and standard contractual clauses for transfers, and we invoice in EUR.

We align with ISO 27001 but hold no ISO 27001, SOC 2 or NIS2 certification, and we do not certify or sign legal compliance for you. Your legal adviser decides how the PDPA applies to your data.

Frequently asked questions

See also

• Contact 4hosting
• 4hosting Singapore