An organisation must not transfer personal data to a country or territory outside Singapore except in accordance with the prescribed requirements ensuring a standard of protection comparable to the Act: under the Regulations 2021, the recipient must be bound by legally enforceable obligations (law, contract, binding corporate rules, or a specified certification such as APEC CBPR or PRP) to provide comparable protection, or the transfer must fall within a listed ground (consent after notice of the lower protection, contractual necessity, vital interests, data in transit, publicly available data); the Commission may exempt an organisation by written notice subject to conditions. The transferring organisation remains responsible for the data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.