GMC has no data protection statute of its own. Its privacy, electronic transactions and anti-spam rules are applied statutes drawn from an established common law jurisdiction, read with modifications, and enforced for now by the GMC Authority, while Licensed Firms carry a second layer of technology and outsourcing rules from the regulator. Working out which text applies to you is the first job. Basnet Law Pte. Ltd. is the first law firm incorporated in GMC. We advise technology companies, Licensed Firms and data-driven businesses on the laws that apply in GMC through the Application of Laws Act 2024 and on the technology and outsourcing rules in the GEN Rulebook 2026. This page explains how those rules fit together and what we do to get you compliant.
How we help
- Data protection compliance under the Personal Data Protection Act 2012, which applies in GMC through Schedule A to the Application of Laws Act 2024, with modifications.
- Electronic contracting, e-signatures and digital records under the Electronic Transactions Act 2010, applied through the same Schedule.
- Marketing compliance under the Spam Control Act 2007, also applied through Schedule A.
- Technology, SaaS, cloud and outsourcing agreements, including the outsourcing and business continuity rules for Licensed Firms in the GEN Rulebook.
- Digital filings with the Registrar through the electronic transaction system and the use of electronic documents under the Companies Act 2025.
- Managing information requests and exchange-of-information obligations under the Income Tax Act 2025.
- Protecting the personal addresses of company officers from public inspection.
How GMC data protection and technology law works, in plain terms
GMC has not enacted a standalone data protection statute. Instead, the Application of Laws Act 2024 provides that the enactments listed in its Schedule A apply in GMC as amended from time to time, with modifications, and the GMC Authority may amend the Schedule by order. Three of the current items are technology laws: the Electronic Transactions Act 2010, the Personal Data Protection Act 2012 and the Spam Control Act 2007. The Official Secrets Act 1935 also applies. References to a regulator in these Acts are read with the modifications the Application of Laws Act provides, and where GMC has not designated a body, the GMC Authority administers and enforces the Act until separate bodies exist.
GMC's own statutes assume electronic dealing. The Registrar of Companies may require or permit any transaction under the Companies Act 2025 to be carried out "using the electronic transaction system in use by the Authority" and may issue approvals and certificates through it. The Registrar may also elect to issue and receive electronic versions of documents. Residential addresses of directors, chief executive officers and secretaries are excluded from public inspection where a contact address is available.
For Licensed Firms, technology risk is a supervisory matter. A firm that outsources functions directly related to Regulated Activities "is not relieved of its regulatory obligations": the outsourced function is treated as carried out by the firm itself, and the firm must conduct due diligence on the provider and supervise it. Material outsourcing arrangements must be reported to the Regulator. Firms must maintain tested business continuity arrangements, and the Regulator expects physical security and protection for information systems.
Data also flows to the tax authority. The Comptroller has full and free access to buildings, documents, computers and software for the purposes of the Income Tax Act 2025, and the designated officer may declare international tax compliance agreements, including a FATCA agreement with the United States and competent authority agreements.
Who this is for
- Software, platform and data companies establishing in GMC.
- Licensed Firms procuring cloud, core banking or trading technology.
- Employers processing employee and candidate data.
- Marketing-led businesses sending electronic messages to GMC recipients.
How an engagement runs
- Data map. What personal data is collected, where it is processed and which of the Schedule A Acts apply to each flow.
- Gap analysis. Policies, notices, consents and retention against the applied Acts and the GEN Rulebook, with a list of what needs to change.
- Contracts. Technology, outsourcing and data processing agreements under GMC law, ready to sign.
- Regulatory filings. Outsourcing notifications to the Regulator and Registrar electronic filings.
- Incident readiness. Breach response, business continuity testing and regulator communication, so the plan exists before it is needed.
Frequently asked questions
Which data protection law applies in GMC?
The Personal Data Protection Act 2012, applied in GMC through Schedule A to the Application of Laws Act 2024, as amended from time to time and with modifications. GMC has no separate data protection Act at present, and we track the Schedule for changes.
Are electronic signatures and contracts valid in GMC?
Yes. The Electronic Transactions Act 2010 applies through Schedule A, and the Companies Act 2025 itself operates through an electronic transaction system.
Can we send marketing emails to GMC customers?
Electronic messages are governed by the Spam Control Act 2007 as applied by Schedule A. We review consent, labelling and unsubscribe mechanisms against it.
Can a Licensed Firm use an offshore cloud provider?
Yes, but outsourcing does not relieve the firm of its obligations, material arrangements must be notified to the Regulator and the head office must remain in GMC. We paper the arrangement so it satisfies all three.
Who enforces these Acts in GMC?
Regulator references are read with the modifications in the Application of Laws Act 2024, and until separate bodies are established the GMC Authority administers and enforces them. We deal with the Authority on your behalf.
Talk to GMC counsel on the ground
Basnet Law Pte. Ltd. is the first law firm incorporated in the Gelephu Mindfulness City. A short conversation early in a matter usually saves time and cost later. Write to basnet@basnetgmc.com or office@basnetgmc.com with a few lines about your plans, and we will tell you plainly what is needed, how long it takes, and whether we are the right fit.
You may contact Basnet Law at basnet@basnetgmc.com or office@basnetgmc.com for any legal queries related to GMC.
