Cross-Border Data Transfers for AI: Compliance Requirements

Your AI vendor is based in the US. Your customer data is in Singapore. The model training happens in Europe. AI-generated insights flow back to your regional offices. This is a cross-border data transfer scenario—and it triggers specific compliance obligations that many organizations overlook.

With cloud-based AI services and global vendors, cross-border transfers for AI are nearly unavoidable. This guide explains the compliance requirements in Singapore, Malaysia, and Thailand, and shows you how to transfer data responsibly.

Executive Summary

• Cross-border transfers for AI require specific compliance attention under PDPA and equivalent regulations
• Key considerations: jurisdiction adequacy, contractual protections, consent requirements, and documentation
• Third-party AI often involves international data flows, even when not obvious
• Cloud AI services create implicit cross-border transfers that many organizations don't recognize
• Documentation is essential—you must be able to demonstrate compliance basis for transfers
• Non-compliance penalties can be significant, with enforcement increasing across the region

Why This Matters Now

AI services are overwhelmingly cloud-based. Major AI platforms operate globally. Your data likely crosses borders even if you don't realize it.

Third-party AI providers may process data offshore. When you use an AI tool, where does the data actually go? Many organizations don't know.

Regulatory scrutiny of international transfers is increasing. Data protection authorities are paying more attention to cross-border flows, especially involving AI.

Data localization requirements are emerging. Some jurisdictions are considering or implementing requirements to keep certain data local.

Definitions and Scope

What Constitutes a Cross-Border Transfer?

A cross-border transfer occurs when personal data is sent outside the jurisdiction where it was collected. This includes:

• Direct transfers: Exporting a data file to a server in another country
• Remote access: Allowing someone in another country to access data in your jurisdiction
• Cloud processing: Uploading data to a cloud service that processes it abroad
• API calls: Sending data to an AI API hosted in another jurisdiction

Key insight: Many AI interactions are cross-border transfers. Sending customer data to ChatGPT's API transfers that data to wherever OpenAI processes it.

Personal Data vs. Non-Personal Data

Cross-border transfer restrictions under PDPA apply to personal data—data that identifies or can identify an individual.

Personal data examples:

• Customer names, emails, phone numbers
• User behavior data linked to individuals
• Employee information
• Any data with individual identifiers

Non-personal data (anonymized, aggregated, synthetic) may have fewer transfer restrictions, but verify that data is truly anonymized.

Controller vs. Processor Roles

Data controller: Organization that determines why and how personal data is processed. You're the controller for your customers' data.

Data processor: Organization that processes data on behalf of the controller. Your AI vendor is typically a processor.

Both roles carry obligations for cross-border transfers, but they differ.

Regional Requirements

Singapore PDPA

Transfer Obligation (Section 26): Personal data can only be transferred outside Singapore if:

• Recipient country has comparable data protection laws, OR
• Recipient organization provides comparable protection (typically via contract), OR
• Consent was obtained specifically for the transfer

Practical approaches:

1. Standard contractual clauses: Agreements with recipients that bind them to data protection standards
2. Binding corporate rules: For transfers within a corporate group
3. Consent: Specific consent for transfer to identified countries

PDPC Guidance:

• Maintains list of countries with comparable laws
• Provides guidance on contractual protections
• Enforcement increasing for transfer violations

Malaysia PDPA

Cross-Border Transfer (Section 129): Personal data cannot be transferred outside Malaysia except to countries specified by the Minister, OR with appropriate safeguards.

Current state:

• Whitelist of approved countries exists
• Additional countries can be added
• Contractual safeguards are an alternative basis

Practical approaches:

1. Transfer to whitelisted countries: Currently limited list
2. Contractual protections: Agreements ensuring adequate protection
3. Consent: May provide basis for transfer in some circumstances

Note: Malaysia PDPA is being amended; transfer provisions may be updated.

Thailand PDPA

Cross-Border Transfer (Section 28): Personal data can be transferred abroad if:

• Destination country has adequate data protection standards, OR
• Transfer is necessary for contract performance, OR
• Consent was obtained, OR
• Appropriate safeguards are in place (contracts, BCRs, certifications)

Practical approaches:

1. Adequate protection countries: PDPC to publish list (framework still developing)
2. Contractual safeguards: Standard contractual clauses
3. Consent: Explicit consent for transfer
4. Contract necessity: Transfer necessary to perform contract with data subject

Note: Thailand PDPA enforcement is ramping up; expect clearer guidance on transfers.

Comparison: Key Requirements

Step-by-Step Compliance Guide

Phase 1: Map Data Flows in AI Systems (Week 1-2)

You can't comply with transfer requirements if you don't know where data goes.

For each AI system:

• Where is the AI service hosted?
• Where does data processing occur?
• Are there sub-processors? Where are they?
• Where are outputs stored?
• Who can access data and from where?

Questions to ask AI vendors:

• In which countries is our data processed?
• Do you use sub-processors outside our country?
• Where is data stored?
• Can you guarantee data stays in specific jurisdictions?

Document everything. Create data flow diagrams showing where personal data moves.

Phase 2: Identify Cross-Border Transfers (Week 2)

From your data flow mapping, identify transfers that cross borders.

Common AI-related transfers:

• Data sent to cloud AI APIs (often US or EU)
• Data accessed by vendor support staff abroad
• Model training in offshore data centers
• AI outputs sent to international colleagues
• Backup and disaster recovery locations

Classify transfers:

• Personal data vs. non-personal data
• Volume and frequency
• Sensitivity of data transferred
• Destination countries

Phase 3: Assess Destination Jurisdiction Adequacy (Week 2-3)

Determine whether destination countries have adequate protection.

Check:

• Is the country on any official adequacy list?
• What data protection laws does the country have?
• What's the enforcement track record?

Resources:

• Singapore PDPC guidance on overseas transfers
• Malaysia PDPA whitelist
• Thailand PDPC guidance (emerging)
• Independent assessments of country data protection

Phase 4: Implement Appropriate Safeguards (Week 3-5)

For transfers without adequacy, implement alternative safeguards.

Standard Contractual Clauses (SCCs):

• Pre-approved contract terms ensuring protection
• Must be between data exporter and importer
• Binding commitments to protect data
• Rights for data subjects

What SCCs should include:

• Purpose limitation for transferred data
• Security requirements
• Data subject rights support
• Restrictions on onward transfers
• Breach notification obligations
• Audit rights

Vendor agreements:

• Ensure AI vendor agreements include data protection terms
• Address cross-border transfers specifically
• Require notification of sub-processor changes
• Include data return/deletion provisions

Phase 5: Document Compliance Basis (Week 5-6)

For each transfer, document how you're complying.

Documentation should include:

• Description of transfer (what, where, why)
• Legal basis for transfer
• Safeguards in place
• Vendor agreements reference
• Risk assessment findings
• Review date

Maintain records to demonstrate compliance if regulators ask.

Phase 6: Monitor and Review (Ongoing)

Transfer compliance requires ongoing attention.

Regular activities:

• Review vendor sub-processor changes
• Update documentation when transfers change
• Monitor regulatory developments
• Reassess when entering new AI services
• Annual review of all cross-border transfers

Decision Tree: Is This AI Data Transfer Compliant?

Common Failure Modes

Failure 1: Not Recognizing Cloud AI as Cross-Border Transfer

Symptom: Data flows internationally without compliance measures Cause: Assumption that "cloud" means no transfer Prevention: Always ask where cloud services process data; treat cloud AI as likely cross-border

Failure 2: Assuming All Transfers Are Permitted

Symptom: No compliance assessment before using international AI Cause: Unawareness of transfer requirements Prevention: Treat cross-border transfers as requiring justification; default to assessment

Failure 3: Insufficient Contractual Protections

Symptom: Vendor agreements don't adequately address data protection Cause: Standard contracts without customization; procurement not involving privacy Prevention: Data protection review of all AI vendor agreements; require adequate terms

Failure 4: No Documentation of Transfers

Symptom: Can't demonstrate compliance basis when asked Cause: Compliance assessment done but not documented Prevention: Document every transfer's compliance basis; maintain accessible records

Failure 5: Forgetting Sub-Processors

Symptom: Vendor transfers to sub-processors you didn't know about Cause: Focus on vendor, not vendor's vendors Prevention: Require vendor disclosure of sub-processors; address in contracts

Implementation Checklist

Assessment

• AI systems inventoried
• Data flows mapped
• Cross-border transfers identified
• Destination countries identified
• Data types classified

Compliance Basis

• Adequacy assessed for each destination
• Contractual safeguards in place where needed
• Consent obtained where relied upon
• Compliance basis documented for each transfer

Vendor Management

• AI vendor data locations confirmed
• Data protection terms in agreements
• Sub-processor requirements addressed
• Ongoing monitoring process established

Documentation

• Transfer inventory maintained
• Compliance basis documented
• Supporting contracts accessible
• Review schedule established

Metrics to Track

• Documented data flows: All AI-related transfers mapped
• Compliance basis coverage: All transfers have documented legal basis
• Vendor compliance status: All AI vendors meet data protection requirements
• Transfer-related incidents: Any breaches or complaints involving transfers
• Regulatory inquiries: Any questions from authorities about transfers

Tooling Suggestions

Data flow mapping tools: Visualize where personal data moves. Essential for complex AI ecosystems.

Contract management systems: Track vendor agreements and data protection terms. Enable quick retrieval when needed.

Vendor risk management platforms: Assess and monitor AI vendor data protection practices.

Compliance documentation tools: Maintain transfer records, assessments, and compliance basis documentation.

Frequently Asked Questions

Does using US cloud AI providers violate PDPA?

Not automatically, but it requires appropriate safeguards. You must ensure adequate protection (typically via contract) before transferring personal data to US services.

What safeguards are required for transfers?

Depends on jurisdiction and destination. Generally: contractual commitments from the recipient to protect data, security measures, restrictions on use, and data subject rights support.

How do we know where our data goes?

Ask your AI vendors explicitly. Review their documentation on data processing locations. If they can't tell you, that's a red flag.

What about model training on our data overseas?

If your personal data is used for training abroad, that's a cross-border transfer. Same compliance requirements apply. Ensure this is addressed in vendor agreements.

Can we rely on vendor certifications (SOC 2, ISO 27001)?

Certifications demonstrate security practices but don't automatically satisfy transfer requirements. You still need appropriate legal basis (adequacy, contracts, consent).

What if regulations change?

Monitor developments and adapt. Design compliance programs with flexibility. Review vendor agreements periodically. Budget for compliance program updates.

Does encryption solve the transfer problem?

Encryption is a security measure, not a legal basis for transfer. You still need to comply with transfer requirements even if data is encrypted.

Conclusion

Cross-border data transfers for AI are nearly ubiquitous—and nearly unavoidable. Every cloud AI service, every international vendor, every API call may involve moving personal data across borders.

Compliance isn't optional. Singapore, Malaysia, and Thailand all have transfer requirements under their PDPAs. Enforcement is increasing, and penalties can be significant.

Start by mapping your data flows. Understand where AI systems send personal data. Assess compliance basis for each transfer. Implement appropriate safeguards. Document everything.

Cross-border compliance isn't a one-time exercise—it requires ongoing attention as you adopt new AI services and as regulations evolve.

Book an AI Readiness Audit

Need help ensuring your AI data flows are compliant? Our AI Readiness Audit includes cross-border transfer assessment and provides actionable recommendations.

Book an AI Readiness Audit →

Disclaimer

Cross-border data transfer requirements are complex and jurisdiction-specific. This article provides general guidance and should not be relied upon as legal advice. Regulatory requirements may change. Consult qualified legal counsel for specific situations and current requirements.

References

• Singapore PDPA transfer provisions (Section 26)
• Singapore PDPC guidance on overseas transfers
• Malaysia PDPA cross-border requirements (Section 129)
• Thailand PDPA transfer provisions (Section 28)
• ASEAN data governance frameworks
• Regional data protection comparative analyses