Compliance

Sharing documents under the PDPA: what Singapore businesses should know.

Most business documents carry personal data somewhere: an employee list in a due diligence pack, customer names in a sales ledger, a director's NRIC number on a company form. When those documents leave your business, the Personal Data Protection Act 2012 travels with them.

This guide walks through the parts of the PDPA that matter most when you share documents, based on the Personal Data Protection Commission's own guidance. It explains the ideas. It is not legal advice, and your data protection officer or lawyer should help you apply them.

Get started How we protect documents

The ten obligations, in one paragraph each

The PDPC's Advisory Guidelines on Key Concepts in the PDPA say the Act's data protection provisions contain ten main obligations. Several of them apply directly to the act of sharing a document. Here is how the PDPC summarises the ones most relevant to sharing.

Consent, purpose and notification

Under the Consent Obligation, an organisation must obtain the consent of the individual before collecting, using or disclosing their personal data for a purpose, unless an exception applies. The Purpose Limitation Obligation limits collection, use and disclosure to purposes a reasonable person would consider appropriate in the circumstances. The Notification Obligation requires you to tell individuals the purposes for which you intend to collect, use or disclose their data. When you hand a document to a third party, you are disclosing whatever personal data is inside it, so it is worth asking whether that disclosure fits the purposes you collected the data for.

Protection

The Protection Obligation requires an organisation to protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal, and the loss of any storage medium or device on which personal data is stored. For document sharing, this is the obligation that most directly concerns how you send files and who can open them.

Retention limitation

An organisation must stop retaining documents containing personal data, or remove the means of linking the data to individuals, once the purpose is no longer served and retention is no longer necessary for legal or business purposes. A data room that stays open after a deal has closed, with every document still available to every bidder, sits uneasily with that principle.

Transfer limitation

An organisation must not transfer personal data outside Singapore except in accordance with the requirements prescribed under the PDPA. The PDPA does not require data to stay in Singapore. It sets conditions on transfers so that the data continues to be protected to a comparable standard. If your counterparty or your tools sit overseas, this obligation is worth discussing with your adviser.

Data breach notification and accountability

The Data Breach Notification Obligation requires an organisation to assess whether a data breach is notifiable and to notify the affected individuals and the PDPC where it is. The Accountability Obligation requires you to put in place the policies and procedures you need to meet your obligations, and to make information about them publicly available. The PDPC also notes that section 11(3) of the PDPA requires every organisation to designate one or more individuals, usually called a data protection officer, to be responsible for ensuring compliance.

Who is responsible when you use a sharing tool

The PDPA distinguishes between an organisation and a data intermediary, which processes personal data on behalf of another organisation. When you use a service such as ShareAndGo to share documents, you remain the organisation responsible for the personal data in them, and the service acts as a data intermediary processing it for you. The PDPC's guidance explains that a data intermediary in Singapore is itself subject to the Protection, Retention Limitation and Data Breach Notification Obligations for the data it receives.

In practice, that means choosing a tool is part of your own protection arrangements. You should understand where the provider stores documents, what controls it gives you, and how it would tell you about an incident. You decide who sees what. The provider's job is to make those decisions enforceable.

Practical habits when sharing documents

Share the minimum. Before a pack goes out, remove documents and pages the reader does not need. A buyer at the first round rarely needs full payroll details.
Know who has access. Invite named individuals rather than sending links anyone can open.
Separate parties. Two bidders, or a buyer and a lender, should not see each other's folders or questions.
Control copies. Use view-only access where readers do not need the file itself.
Keep a record. Be able to show who opened which document, and when.
End access on time. Close invitations when a matter ends, and archive or delete what you no longer need.
Plan for mistakes. Know who in your business assesses an incident, and how quickly.

None of these habits is a legal test on its own. Together they make it far easier to explain, if you are ever asked, how you protected the personal data you shared.

How ShareAndGo supports those habits

ShareAndGo gives each matter its own room. You invite people by email address, and they confirm that address with a six-digit code before they see anything. You put each party in a group and choose the folders that group can open. You decide per room and per group whether people can download, print or copy, and view-only readers see documents rendered on our side with their name, email address and the date on every page.

Invitations can carry an end date and be revoked at any time. Every view, upload, download, invitation and change is recorded in an audit log, chained so that alterations are detectable and exportable as a spreadsheet. When a matter ends, you can export the room with its folder structure and an index, then delete it. Deleting removes the stored files and their previews.

Your documents, records and files are stored in Singapore. That is a choice we offer, not something the PDPA requires. Some services, such as sign-in and sending email, run elsewhere, and our privacy page lists them.

Frequently asked questions

Does the PDPA require data to be stored in Singapore?

No. The PDPA sets conditions on transferring personal data outside Singapore, but it does not require data to stay in Singapore. ShareAndGo stores your documents in Singapore as a choice.

Is ShareAndGo responsible for the personal data in my documents?

You remain the organisation responsible for that data. ShareAndGo processes it on your behalf as a data intermediary and gives you the controls to decide who sees what.

Do I need a data protection officer?

The PDPC's guidance notes that section 11(3) of the PDPA requires organisations to designate one or more individuals to be responsible for ensuring compliance. How to set that up in your business is a question for your adviser.