A transferring organisation must, before transferring an individual’s personal data to a country or territory outside Singapore take appropriate steps to ascertain whether, and to ensure that, the recipient of the personal data is bound by legally enforceable obligations (such as any law, a contract, binding corporate rules or any other legally binding instrument) to provide to the transferred personal data a standard of protection that is at least comparable to the protection under the Personal Data Protection Act 2012 of Singapore. An individual is not taken to have consented to the transfer of the individual’s personal data to a country or territory outside Singapore if the individual was not, before giving his or her consent, given a reasonable summary in writing of the extent to which the personal data to be transferred to that country or territory will be protected to a standard comparable to the protection under the Act. In addition, organisations that hold a 'specified certification' that is granted or recognised under the law of the country or territory to which personal data is transferred will be taken to be bound by such legally enforceable obligations. Under the Personal Data Protection Regulations, a 'specified certification' refers to certifications under the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules ('APEC CBPR') System, and the Asia Pacific Economic Cooperation Privacy Recognition for Processors ('APEC PRP') System. 