Yes, unless a statutory or legal exception applies.

While there is no requirement to obtain express consent from customers to move data to the cloud per se, financial institutions are subject to a common law duty of confidence and, in the case of banks, merchant banks and trust companies, a statutory duty of confidence. Additionally, under the Singapore Personal Data Protection Act, disclosing any personal data (e.g., to a third-party cloud service provider) also requires the data subject's consent, unless a statutory or legal exception applies.

Disclosing or transferring customer information to a cloud service provider will therefore require a customer's consent. In the case of banks, merchant banks and trust companies that are subject to a statutory duty of confidence, such consent needs to be in writing (unless other statutory exemptions apply). Financial institutions should also ensure that any disclosures to their service providers are made in accordance with the terms of the customer contracts.