Company: GDHLF
Filing Date: 2025-04-28
Form Type: 20-F
Source: 0001410578-25-000935
Chunk: 228

Company: GDS Holdings Ltd
Filing Date: 2025-04-28
Form: 20-F
Item: Item 4
Chunk 228
---
 will be required to comply with the PDPA to the extent it carries out any collection, use or disclosure of personal data in Singapore. There are 10 data protection obligations contained in the PDPA which includes, among other things, (1) putting in place appropriate technical and organizational measures to protect the personal data from data breach incidents, (2) ceasing to retain personal data if the purpose for collection is no longer served and retention is no longer necessary for any other legal or business purposes, and (3) notifying the PDPC and/or the affected individuals in the event of a data breach incident (if the relevant notification thresholds have been met).

There is no data localization requirement in Singapore for data to be hosted, stored, or processed in Singapore, or any cross-border prohibition for the transfer of data out of Singapore. However, the transfer of personal data out of Singapore is permitted only if the transferor has taken appropriate steps to ensure that the overseas recipient is bound by legally enforceable obligations to provide the transferred personal data with a standard of protection that is comparable to that under the PDPA.

Table of Contents

The PDPC may give an organisation such directions as it thinks fit to ensure the organisation’s compliance with the PDPA, including for the organisation to (a) stop collecting, using or disclosing personal data in contravention of the PDPA; and/or (b) destroy personal data collected in contravention of the PDPA.

The PDPC also has the power to impose financial penalties on organizations that are found to have intentionally or negligently breached the data protection obligations under the PDPA of (a) up to S$1 million, or (b) 10% of the organisation’s annual turnover in Singapore (on organizations with an annual turnover in Singapore exceeding S$10 million), whichever is higher.

In addition to the PDPA, the revised Cybersecurity Act 2018, or CSA, seeks to regulate providers of Foundational Digital Infrastructure service, or FDI service. It is currently contemplated that cloud computing services and data center facility services would fall within FDI services. Hence, if our company is subsequently designated as an FDI service provider, we will have additional obligations in relation to the cybersecurity of our digital infrastructure, including adhering to cybersecurity codes and standards of practice, as well as reporting prescribed cybersecurity incidents to the Cyber Security Agency. However, the date that the amendments to the CSA regulating providers of FDI services will take effect has yet to be notified.

To address concerns beyond cybersecurity risks, in February 202