Govern · jurisdiction
Singapore
Singapore is the largest shared-service processing site in the estate. Every record class processed here that originates in the EEA needs clauses on file; two do not have them.
Units governed
512
Stamped on the unit itself
Placements here
12
1,838,362 records
Inbound routes
12
Records arriving from elsewhere
Outbound routes
0
Records leaving this jurisdiction
Breach notice
72 hr
Supervisor: Personal Data Protection Commission
The regime that applies here
Privacy and artificial intelligence obligations, as they stand.
Privacy regime
PDPA
Personal Data Protection Act 2012 (as amended 2020)
Artificial intelligence regime
Model AI Governance Framework
Voluntary framework — No binding regime. Adherence is a choice and should be described as one.
Transfer adequacy
No adequacy decision
Default mechanism: Standard contractual clauses, EU module two
Supervisory authority
Personal Data Protection Commission
Local obligations that change how work is run
These are operating constraints, not footnotes.
Localization rule
No general localization. MAS Notice 655 constrains outsourcing for regulated financial activity.
Employee consultation
No works council duty. Tripartite guidelines on fair employment apply to hiring.
What is stored and processed here
One row per class of record, per role, per system.
| Record class | Role | System | Facility | Volume | Note |
|---|---|---|---|---|---|
| agent-telemetry | Stored | This platform platform-core | AWS ap-southeast-1, Singapore | 1,611 | |
| candidate-applications | Processed | Recruiting and Applicant Tracking ats | Vendor cloud, Singapore | 135,009 | Primary screening and assessment processing for every region. |
| candidate-applications | Stored | Recruiting and Applicant Tracking ats | Vendor cloud, Singapore | 135,009 | |
| compensation | Stored | Core HR and Payroll hcm | Vendor cloud, Singapore | 13,605 | |
| customer-contact | Processed | Customer Relationship Management crm | Vendor cloud, Singapore | 312,340 | Follow-the-sun service processing including EEA records. |
| employee-master | Processed | Core HR and Payroll hcm | Workday APAC pod, Singapore | 25,973 | Shared-service processing for the non-German population. |
| employee-master | Backup | Core HR and Payroll hcm | Workday APAC pod, Singapore | 61,840 | Encrypted nightly snapshot, 35 day cycle. |
| health-safety | Stored | Occupational health record store ehs | Vendor cloud, Singapore | 794 | No agent access. |
| performance-records | Processed | Core HR and Payroll hcm | Workday APAC pod, Singapore | 16,498 | |
| supplier-bank | Stored | Group ERP — Financials erp-fi | AWS ap-southeast-1, Singapore | 5,763 | |
| support-transcripts | Processed | Contact Center Platform ccaas | Vendor cloud, Singapore | 564,960 | Out-of-hours service for every region. |
| support-transcripts | Stored | Contact Center Platform ccaas | Vendor cloud, Singapore | 564,960 |
Inbound — records arriving here
Lawful basis and impact assessment state for each route.
XFER-001DE→SGBlocked
Shared-service HR administration for the non-German population routed through the Singapore hub.
Standard contractual clausesEU SCC Module 2, executed 2024-11-04, Annex III updated 2026-03-12Assessment current0/mo
Route is contractually papered but operationally suspended. German employee records do not leave Frankfurt while the works agreement is unsigned. Volume is zero by design, not by accident.
XFER-002DE→SGCleared with conditions
Candidate screening, assessment scoring and interview scheduling performed at the Singapore hub.
Standard contractual clausesEU SCC Module 2, executed 2024-11-04Assessment in progress1,840/mo
The transfer impact assessment has been in progress for 94 days. Volume continues while it is open. This is the single largest unresolved item on the register.
XFER-003UK→SGCleared
Candidate screening and assessment for UK requisitions at the Singapore hub.
Standard contractual clausesUK Addendum to EU SCCs, executed 2024-11-18Assessment current2,310/mo
XFER-004DE→SGCleared with conditions
Follow-the-sun customer service outside European business hours.
Standard contractual clausesEU SCC Module 2, executed 2023-06-30, Annex III last updated 2024-09-02Assessment out of date46,200/mo
Annex III has not been refreshed since two sub-processors were added to the service chain in 2025. The assessment describes a supply chain that no longer matches the register.
XFER-005DE→SGCleared with conditions
Out-of-hours contact center handling and transcript storage.
Standard contractual clausesEU SCC Module 2, executed 2023-06-30Assessment out of date88,400/mo
Free-text transcripts occasionally carry Article 9 data. A transfer assessed for ordinary personal data is carrying special-category data some of the time.
XFER-006UK→SGCleared
Out-of-hours contact center handling for UK customers.
Standard contractual clausesUK Addendum to EU SCCs, executed 2023-07-14Assessment current51,300/mo
XFER-010AU→SGCleared
Shared-service HR administration for the Australian population.
Standard contractual clausesAPP 8 contractual arrangement, executed 2024-08-15Assessment current6,800/mo
Cleared, but APP 8 leaves the Australian entity accountable for anything the Singapore processor does. The accountability does not transfer with the data.
XFER-011DE→SGCleared
Supplier master maintenance performed by the Source-to-Pay tower.
Standard contractual clausesEU SCC Module 2, executed 2024-11-04Assessment current940/mo
XFER-012UK→SGCleared
Calibration preparation and review quality checks at the Singapore hub.
Standard contractual clausesUK Addendum to EU SCCs, executed 2024-11-18Assessment current2,140/mo
XFER-014US→SGCleared
Candidate screening for US requisitions at the Singapore hub.
Explicit consentCandidate notice and consent captured at application, US flow onlyNot required4,260/mo
XFER-015AU→SGCleared
Out-of-hours contact center handling for Australian customers.
Standard contractual clausesAPP 8 contractual arrangement, executed 2023-07-14Assessment current33,700/mo
XFER-016DE→SGProhibited
No transfer. Recorded as an explicit prohibition so the absence is auditable.
None recordedProhibited by policy POL-DP-004. No mechanism sought.Not required0/mo
The prohibition is enforced by a field-level deny list in the agent context builder, not by a network control. A direct database query from Singapore would not be stopped by it.
Outbound — records leaving here
Lawful basis and impact assessment state for each route.
No routes recorded.
Which functions run work here
Rolled up from the jurisdiction stamped on individual units.
Supply Chain43
Legal43
Information Technology42
Procurement & Source-to-Pay41
Revenue Operations39
Engineering38
Sales37
Human Resources36
Research & Development36
AI GBS & Global Business Services35
Marketing33
Administration32
Finance29
Customer Service28