Standard Contractual Clauses

Where your data is transferred outside Malaysia/Singapore (e.g. to our LLM sub-processors), we incorporate the EU Standard Contractual Clauses (Commission Decision 2021/914) Module 2 (Controller → Processor) and Module 3 (Processor → Processor) by reference into our DPA. For UK GDPR transfers, we use the UK International Data Transfer Addendum. For Malaysian PDPA transfers, the equivalent NDPC-prescribed measures are followed: explicit consent + transfer impact assessment kept on file for 5 years. A copy of the executed clauses is provided with your DPA on signing.