Cloud Hosting and Data Residency for Singapore Business Apps

Three obligations matter most. All appear in the PDPC's summary of data protection obligations.

Transfer Limitation Obligation. You may transfer personal data out of Singapore only in line with the regulations, so that it keeps a standard of protection comparable to the PDPA. The PDPC's guide to cross-border data transfers describes the main routes: contracts with the overseas recipient, for which the ASEAN Model Contractual Clauses offer a ready template, and recipients that hold specified certifications such as Global or APEC CBPR and PRP. Your cloud provider's data processing terms form part of this picture, so check which regions and sub-processors they list.

Protection Obligation. You must make reasonable security arrangements to protect personal data in your possession or under your control. For hosting, that means encryption, access control, patching, logging and tested backups, wherever the server sits.

Data Breach Notification Obligation. If a breach is likely to cause significant harm, or affects 500 or more individuals, you must notify the PDPC no later than three calendar days after assessing that it is notifiable, according to the PDPC's breach reporting page. Affected individuals must also be told where significant harm is likely. Meeting that clock depends on logs you kept before the incident, because they are how you find out what was accessed.

Financial institutions. Banks and other financial institutions follow MAS's Guidelines on Outsourcing, dated 11 December 2023 and in effect since 11 December 2024, and MAS is consulting on broader guidelines for third-party services. If you sell software to a bank, insurer or licensed payment firm, expect its due diligence to ask where data is stored, who can reach it, how it is backed up, and how you would hand it back at exit.

Government, healthcare and other regulated buyers often write hosting, data classification and security requirements into the contract itself. Read those clauses before you choose a region or provider, because they can rule options out.

Putting the database in a Singapore region takes one setting. Data also flows to:

• Backups and snapshots: cross-region copies for disaster recovery often go to another country by design.
• Logs and monitoring: many observability and error-tracking services store data in the US or Europe unless you choose a regional option.
• Email, SMS and WhatsApp providers: message content and phone numbers pass through their systems.
• AI APIs: prompts sent to a language model may be processed outside Singapore, so check the provider's region options and data use terms.
• Content delivery networks: cached files sit in edge locations worldwide.
• Remote access: developers or support staff overseas who can query production data.
• Analytics and marketing tools embedded in your web app.

Draw a data map listing each of these, the country involved, and the contract or certification that covers the transfer. Keep it with your PDPA records. A regulated client's due diligence will ask for it early.

AWS, Microsoft Azure and Google Cloud all operate cloud regions in Singapore, and several local and regional providers run data centres here too. For most business apps:

• Production: run databases and application servers in the Singapore region across at least two availability zones, so one data centre failure does not take you down.
• Managed services: use managed databases and object storage unless you have staff to patch and tune servers yourselves.
• Encryption: encrypt data at rest with keys held in your own cloud account's key management service, and use TLS everywhere in transit.
• Disaster recovery: set your recovery point and recovery time objectives first, then choose between backups in a second Singapore zone and a copy in another country under a documented transfer arrangement.
• Environments: keep development and test environments on synthetic or masked data, not copies of production.
• Cost: prices differ between regions and services, so compare the Singapore prices for the services you will actually use rather than headline compute rates.

Whoever sets it up, including our cloud and DevOps service, should define the environment as infrastructure as code so it can be rebuilt, audited and handed over.

Who holds the cloud account matters as much as where it sits.

• Open the cloud account in your company's name, with billing and the root login controlled by you.
• Give vendors and developers named accounts with only the permissions they need, multi-factor authentication and access logs.
• Keep infrastructure defined in code, for example Terraform, in your own repository.
• Restore a backup to a fresh environment at least twice a year and record how long it took.
• Write down how you would move providers: export formats, DNS, and the order of cut-over.

Remote access by an overseas team belongs in your transfer assessment. If your developers work from outside Singapore, as we do from Greater Noida, give them named, logged accounts in your cloud and masked data wherever the task allows. We keep source code and accounts in the client's name and sign an NDA on request.

• Primary database and file storage in a Singapore region, across two availability zones.
• A written data map covering backups, logs, email, SMS, AI APIs, CDN and remote access.
• A recorded transfer basis, contract clauses or certification, for every location outside Singapore.
• Encryption at rest with keys in your account, TLS in transit, and secrets in a managed vault.
• Centralised, retained logs that would let you answer "what was accessed" within hours.
• A breach response plan that can meet the three-day PDPC notification window.
• Backups tested by restoring them, not just by checking they exist.
• Cloud, domain and code accounts owned by your company.

If you are commissioning a new web application or SaaS product, put this list in the scope so it is priced and delivered rather than assumed.

Does the PDPA require us to store data in Singapore?

No. It requires comparable protection for personal data transferred overseas, reasonable security wherever data sits, and breach notification. Some contracts and sector rules add location requirements, so check yours.

Can an overseas development team work on our production system?

Yes, with care. Treat their access as part of your transfer assessment, use named and logged accounts with limited permissions, and keep real personal data out of the environments they work in day to day.

Should backups stay in Singapore too?

Not necessarily, but decide deliberately. A second Singapore zone keeps everything local; a copy in another country protects against a regional outage but needs a documented transfer basis.

What should we do first if we suspect a breach?

Contain it, preserve logs, and assess quickly whether it is notifiable. The PDPC's three-calendar-day clock starts once you determine the breach is notifiable, so do not let the assessment drift.

If you are choosing hosting for a new app or reviewing an existing one, send us your current setup or requirements. Discuss your project with us and we will map where your data goes and recommend a hosting design, with a written scope and fixed quote if you want us to build or migrate it.