A Singapore company that sends personal data to its Indian subsidiary must satisfy the PDPA's Transfer Limitation Obligation, usually through a contract that gives the data comparable protection, and the Indian subsidiary must meet India's Digital Personal Data Protection Act as its duties take effect. The DPDP Rules were notified on 13 November 2025 and the main duties start on 13 May 2027, so the practical plan is to build one privacy programme that meets both laws.
← Back to the complete guide: How to Set Up a Subsidiary in India from Singapore
Key facts
| Singapore law | Personal Data Protection Act 2012, enforced by the PDPC |
|---|---|
| Transfer rule | Transfer Limitation Obligation: data sent outside Singapore must receive protection comparable to the PDPA, by contract, binding corporate rules, consent or another prescribed means |
| Breach notice | Notify the PDPC and affected people when a breach is notifiable; the PDPC expects notice within three calendar days of assessing it as notifiable |
| Penalty (Singapore) | Up to SGD 1 million or 10% of annual turnover in Singapore, whichever is higher, for larger organisations |
| Indian law | Digital Personal Data Protection Act, 2023; Rules notified 13 November 2025 |
| Indian timing | Main duties from 13 May 2027, with earlier steps such as the Board and consent managers |
| Indian penalty | Up to INR 250 crore for serious failures such as security safeguards |
| Cross-border | DPDP permits transfer outside India except to countries the government restricts |
PDPA: sending data from Singapore to India
The Transfer Limitation Obligation says that an organisation may transfer personal data out of Singapore only if it takes appropriate steps to ensure the recipient provides a standard of protection comparable to the PDPA. In practice a Singapore company does this with an intra-group data transfer agreement, binding corporate rules for a larger group, or consent where it is properly given.
- Contract: a data transfer agreement that mirrors PDPA protection obligations: purpose limits, security, retention, breach notice and onward transfer limits.
- Accountability: the Singapore organisation remains responsible for data it holds, and for data processed for it by the Indian subsidiary as a data intermediary.
- Data Protection Officer: appoint one and publish contact details.
- Notification: a breach that is likely to cause significant harm, or affects a large number of people, is notifiable.
India: the DPDP Act and Rules
- Who is covered: processing of digital personal data within India, and outside India if connected to offering goods or services in India.
- Notice and consent: clear notice and free, specific consent for most processing, with allowed 'legitimate uses' such as employment purposes.
- Data fiduciary duties: security safeguards, breach notice to the Data Protection Board and to affected people, erasure when the purpose ends.
- Significant data fiduciaries: larger or riskier processors face extra duties, including an audit and an impact assessment.
- Children's data: verifiable parental consent before processing a child's data.
- Timeline: the Rules were notified on 13 November 2025 and the main obligations take effect on 13 May 2027.
A comparison
| Topic | PDPA (Singapore) | DPDP Act (India) |
|---|---|---|
| Scope | Personal data of individuals, with business contact exceptions | Digital personal data and non-digital data that is digitised |
| Grounds | Consent, deemed consent, legitimate interests, business improvement | Consent and listed legitimate uses |
| Cross-border | Transfer Limitation Obligation | Allowed unless the destination is restricted by notification |
| Breach notice | PDPC and individuals, with timelines | Board and individuals, under the Rules |
| Officer | Data Protection Officer required | Data Protection Officer for significant fiduciaries |
| Maximum penalty | Up to SGD 1 million or 10% of Singapore turnover | Up to INR 250 crore per breach category |
A build plan for one privacy programme
- Map what personal data moves between Singapore and India and why: employee, customer, supplier and marketing data.
- Sign an intra-group data transfer agreement that satisfies the PDPA and states the DPDP duties of the Indian entity.
- Choose a single breach response procedure with clocks that satisfy both regulators.
- Update notices and consent flows for Indian individuals before 13 May 2027.
- Set retention periods and a deletion routine that both laws accept.
- Train the Indian team and test the process with a tabletop breach exercise.
Sector rules on top
Banks, insurers and other financial institutions regulated by the MAS must also satisfy MAS outsourcing and technology risk expectations when an Indian group company processes their data, and Indian regulators have their own data-localisation rules for payments data. Check your sector rules before moving workloads.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, IRAS, ACRA and the Singapore Academy of Law (apostilles).
Frequently asked questions
Can a Singapore company send personal data to its Indian subsidiary?
Yes, if it complies with the PDPA's Transfer Limitation Obligation, usually through a contract giving comparable protection.
When do India's DPDP duties start?
The Rules were notified on 13 November 2025 and the main duties take effect on 13 May 2027.
What is the PDPA penalty?
Up to SGD 1 million or 10% of annual turnover in Singapore for larger organisations, whichever is higher.
What is the DPDP penalty?
Up to INR 250 crore for serious breaches such as failing to keep reasonable security safeguards.
Does India allow transfers of personal data to Singapore?
Yes. The DPDP Act allows cross-border transfer except to countries the government restricts by notification.
Do I need a Data Protection Officer in both countries?
Singapore requires one for organisations covered by the PDPA. India requires one for significant data fiduciaries, and appointing one early is good practice.
How quickly must a data breach be reported in Singapore?
The PDPC expects notice within three calendar days after the organisation assesses that the breach is notifiable.
Related guides
Hiring in India as a Singapore Employer: What Changes from Singapore Practice
A comparison for Singapore HR teams hiring in India: employment contracts, provident fund, ESI, gratuity, labour codes, notice and termination, payroll tax and share plans, set against Singapore practice.
Read the guide →Setting Up a Global Capability Centre in India for a Singapore Group: Models, Pricing, Tax and Risk
How Singapore headquartered groups build captive centres in India: build-operate-transfer, captive subsidiary and hybrid models, cost-plus pricing, GST on exports, PE risk, MAS outsourcing and talent.
Read the guide →Contracts, Courts and Arbitration: Using Singapore as the Seat and Enforcing in India
How a Singapore parent protects its Indian subsidiary contracts: choice of law, SIAC arbitration, enforcing Singapore awards and judgments in India, stamping, interim relief and drafting points.
Read the guide →12 Common Mistakes Singapore Companies Make When Entering India, and How to Avoid Each
The twelve mistakes we see most often when a Singapore company sets up an Indian subsidiary: treaty assumptions, holdco substance, EPF for PRs, services PE, FEMA clocks, stamping, data transfers and year-end gaps.
Read the guide →Sources
Last updated 21 October 2026. General information only, not legal or tax advice. Indian and Singapore rules change often; confirm current requirements before acting.