Compliance

Sharing documents when you work with Singapore's public agencies.

Consultancies, contractors, accounting firms and technology suppliers all handle documents for Singapore government agencies. Tender submissions, project deliverables, audit evidence and correspondence move between the supplier and the agency, often through several hands.

The rules on where that material may sit and how it may be shared come from the agency and the contract, not from a generic checklist. This article explains how to approach the question, what is publicly known about how the government uses commercial cloud, and what ShareAndGo can and cannot tell you. It is not legal advice, and it does not suggest ShareAndGo meets any particular agency's requirements.

Get started

Start with the contract, not the cloud

The most common mistake suppliers make is assuming there is one public sector rule on data location that applies to every engagement. In practice, the requirements that bind you are the ones written into your tender documents, contract and any security schedule the agency attaches. Two engagements with two agencies can carry quite different terms.

Before choosing any tool for sharing project documents, read those terms for anything about where information may be stored, who may access it, how it must be classified and handled, and whether you need the agency's approval to use a particular service. If the documents are silent or unclear, ask the agency's contracting or project officer in writing, and keep the answer.

Questions worth putting to the agency

Is there a classification for the documents we will exchange, and what handling does it require?
Are there restrictions on where project information may be stored or processed?
May we use an outside document-sharing service for this engagement, and does it need approval first?
What records of access do you expect us to keep, and for how long?
Who on your side should receive documents, and how should we verify them?

How the government itself uses commercial cloud

It helps to know that the public sector is not hostile to commercial cloud. GovTech's Government on Commercial Cloud, known as GCC, is described on GovTech's developer portal as a wrapper platform that helps government agencies adopt commercial cloud services, from AWS, Microsoft Azure and Google Cloud Platform, more quickly and securely. GovTech says GCC supports hosting systems up to the Confidential classification level.

That tells you two things. First, government systems themselves can run on commercial cloud under defined governance. Second, that governance is specific: it is a government platform with its own controls, not a general statement that any commercial service is acceptable for any government information. A supplier's own tools are assessed under the supplier's contract, not under GCC.

Personal data still follows the PDPA

If your project documents contain personal data that you hold as a private organisation, the Personal Data Protection Act applies to you. The PDPC's Advisory Guidelines on Key Concepts in the PDPA describe the Protection Obligation, which requires reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal. They also describe the Transfer Limitation Obligation, under which personal data transferred outside Singapore must be protected to a standard comparable with the PDPA, and the guidelines say this remains your responsibility even where a service provider moves the data on your behalf.

Public agencies are governed by their own frameworks, so the agency's handling rules and your PDPA obligations can both apply to the same project. Where they overlap, follow the stricter requirement and ask your adviser if they conflict.

What a data room can and cannot settle

A virtual data room is a practical answer to a common problem on public sector work: the agency's evaluators, the supplier's team, subcontractors and advisers all need different slices of a large set of documents, and email attachments make it impossible to say afterwards who saw what.

ShareAndGo can give you facts to bring to that conversation. Your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them, so you can show the agency exactly what happens where. Within a room you can:

Put the agency, each subcontractor and your own team in separate groups, each seeing only the folders allowed.
Share view-only, so documents are rendered on our side with the viewer's name, email address and date watermarked on each page, and the original file is never sent to their browser.
Require recipients to confirm their email address with a six-digit code, so a forwarded invitation does not let someone else in.
Set an end date on each invitation and revoke access the day an engagement ends.
Keep an audit log of every view, upload, download, invitation and change, chained so alterations are detectable, and export it as CSV for the agency or your auditors.

What a data room cannot do is decide whether it is permitted for a given engagement. Only the agency and your contract can. Never assume a tool is approved because another agency or another project used it.

A sensible way to proceed

Read the tender, contract and any security schedule for location, classification and access terms.
Ask the agency in writing about anything unclear, including whether an outside sharing service may be used.
Check your own PDPA position for any personal data in the documents.
Choose a tool whose data location and controls you can describe accurately, and share that description with the agency.
Keep the audit record for as long as the contract or your own retention rules require.

Handled this way, the question of where documents sit becomes a short, documented conversation at the start of the project rather than an uncomfortable one at the end.

Questions people ask

Is ShareAndGo approved for Singapore government work?

We make no claim that ShareAndGo meets any agency's requirements. Each engagement's requirements are set by the agency and your contract, so ask the agency before using any outside sharing service.

Where does ShareAndGo store documents?

Your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them.

Does the government use commercial cloud?

GovTech describes its Government on Commercial Cloud platform as helping agencies adopt AWS, Microsoft Azure and Google Cloud Platform, supporting systems up to the Confidential level. That is the government's own platform, with its own controls.

Bring facts to the agency, not assumptions.

See exactly where your documents are and who has opened them.