In 2017, Veritas Technologies published a global study on readiness for the EU’s General Data Protection Regulation (GDPR). It found that 86% of organisations worldwide worried that failing to comply would badly hurt their business. In Singapore the concern ran higher: 92% of local organisations were worried, and 20% feared that non-compliance could shut them down.
Sheena Chin, Veritas’s country manager for Singapore, used the findings to argue that Singapore firms could not treat the regulation as a European problem. The GDPR was due to take effect the following year. It went into effect on 25 May 2018.
What the Veritas study found
The study put the maximum penalty at the greater of €20 million or 4% of annual turnover. Veritas expressed this as roughly US$21 million, or S$29.8 million. Readiness was weaker in parts of Asia-Pacific than elsewhere. In Singapore 56% of organisations feared they would miss the compliance deadline, against 63% in Japan and 61% in Korea. Veritas gave the global average as 47%.
Chin said the gap came from a common assumption in South-east Asia and the wider Asia-Pacific and Japan region that the GDPR applied only to companies based inside the EU. In her view that was wrong. Any business dealing with EU consumers or employees fell under it. She also pointed to trade exposure, since Singapore was the EU’s largest commercial partner in ASEAN, accounting for slightly under a third of EU-ASEAN trade in goods and services.
Veritas also reported that fewer than a third of organisations worldwide (31%) met the minimum GDPR requirements at the time of the study.
Chin’s argument: reach, not residence
Chin held that the regulation’s reach depended on whose data a company held, not where the company sat. Ecommerce was her first example. Asian online stores selling to EU customers would have to handle those customers’ data under the new rules. She said small and medium businesses faced a steeper climb because of competitive pressure, and advised them to research what transparency required and to be able to answer data subject requests.
She also stressed that outsourcing did not remove responsibility. A company acting as a data controller stayed liable for making sure its cloud provider, as processor, applied suitable technical and organisational protections. Processors were bound by the rules too.
Later legal guidance supports the core of this view. The law firm CMS wrote that the GDPR applies to Singapore companies that offer goods and services to individuals in the EU, or monitor their behaviour, even without an EU presence.
How Chin compared the GDPR with the PDPA
Chin described the Personal Data Protection Act (PDPA) as balancing individuals’ rights of access and correction against organisations’ legitimate need to use data. Firms had to tell people why they collected data and obtain consent, which could be deemed when an individual volunteered the information. Data no longer needed for its original purpose had to be deleted.
The GDPR, she said, went further in several ways. It gave EU residents expanded rights, including the “right to be forgotten”, and required breach notification within 72 hours. It also sought to unify EU data protection rules so that companies knew where personal data sat, who could reach it and who had recently handled it, leaving an audit trail.
She noted that Singapore applied a similar controller-and-vendor principle. In 2016 the Personal Data Protection Commission fined a local entertainment company S$50,000 over a PDPA breach and fined its IT vendor S$10,000 for inadequate protection measures.
Later comparisons confirm the overlap in territorial scope. DataGuidance’s comparison described both laws as comprehensive, with similar personal and extraterritorial scopes. It also noted that the PDPA excludes public agencies, while the GDPR covers public and private bodies. CMS said a company already compliant with the PDPA was well along the way to GDPR compliance. It added that several aspects of the GDPR went beyond the PDPA’s requirements.
Data hygiene and the audit burden
Chris Bridgland, Veritas’s CTO and technology practice lead for emerging regions in EMEA, argued that GDPR compliance would help firms meet local laws by forcing better data hygiene. He contrasted it with Sarbanes-Oxley, which centred on financial transactions. Much of the data in scope under the GDPR was unstructured, such as email. Organisations also had to prove they had audited every data store, not merely claim to have looked.
Chin made a similar point about over-retention. Holding data longer than needed raised exposure to ransomware and hacking, so the regulation would push firms to decide what to keep and what to delete. She cited Veritas’s Databerg and Data Hoarders reports, in which 82% of respondents admitted storing data that could harm their organisations.
On staffing, she said a permanent data protection officer role was worth considering only if it produced meaningful compliance outcomes, and that external help was available otherwise. Veritas launched 360 Data Management for GDPR, a mix of advisory services and software, to help firms start and sustain compliance.
Where the debate went
The arguments Chin made about extraterritorial reach carried into the years after the 2018 start date. The IAPP noted that the PDPA likewise reaches organisations with no presence in Singapore. CMS observed that in practice it was not actively enforced against entities outside Singapore.
A 2026 guide to the two laws repeats the point Chin made in 2017. It says a Singapore business targeting EU customers must comply even without a physical presence in Europe.