ShareAndGoShareAndGo

Compliance

Singapore tax agents and the client data they hold.

A tax agent sees more of a client's affairs than almost anyone outside the business: income, expenses, bank accounts, shareholdings, sometimes family arrangements. Clients hand that information over on trust.

This article looks at how that trust is framed in Singapore: how IRAS authorises agents to act, what the PDPA asks of any organisation holding personal data, the role of the Singapore Chartered Tax Professionals, and practical habits for keeping client files safe. It is general information, not legal or professional advice.

Get startedTax audit rooms

How IRAS authorises a tax agent

For corporate clients, access to IRAS's digital services runs through Corppass. IRAS describes Singapore Corporate Access, or Corppass, as the sole authorisation system for entities to manage the access of employees and third parties, such as tax agents, to government digital services for corporate transactions. IRAS says employees or third parties must first be authorised via Corppass before they can access IRAS's digital services in an entity's myTax Portal account.

That arrangement is itself a data protection control. Access is granted by the client to a named firm, the firm in turn authorises its own staff, and the arrangement sits with the client rather than the agent. It is a useful model for the rest of the relationship: the client decides who can see what, and access can end.

Within the firm, the same thinking applies. Only the staff working on a client's affairs should have access to that client's documents and authorisations, and access should be reviewed when people change roles or leave.

The PDPA applies to tax practices like any organisation

A tax practice that collects, uses or discloses personal data is subject to the Personal Data Protection Act. The Personal Data Protection Commission's Advisory Guidelines on Key Concepts in the PDPA summarise ten main obligations. For client files, the most relevant are these.

  • Protection: making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data, and the loss of storage media or devices.
  • Retention limitation: not keeping documents containing personal data once the purpose is no longer served and retention is no longer necessary for legal or business purposes.
  • Transfer limitation: not transferring personal data outside Singapore except in accordance with the PDPA's requirements.
  • Data breach notification: assessing whether a breach is notifiable and notifying the PDPC and affected individuals where it is.
  • Accountability: having the policies and procedures needed to meet these obligations, and designating someone responsible, usually called a data protection officer.

How each obligation applies to a particular practice is a matter for that practice and its advisers. The direction is clear, though: the firm is responsible for the client data it holds, including when that data is on a laptop, in a mailbox or with a service provider.

Professional standards and SCTP

IRAS describes the Singapore Chartered Tax Professionals, formerly the Singapore Institute of Accredited Tax Professionals, as the accreditation body for tax professionals in Singapore, with the aim of promoting the standards of tax practice. IRAS says tax professionals with the necessary training and experience may apply to SCTP for accreditation, and it describes a separate framework set up to strengthen collaboration between IRAS and tax agents.

Accredited professionals and members of professional bodies may have their own codes and requirements on confidentiality. If you belong to one, its rules are the place to start. This article does not try to summarise them.

Where client data is most exposed

In most small and mid-sized practices, the weakest point is not the practice software. It is the movement of documents.

  • Clients email bank statements, payslips and identity documents, which then sit in several staff mailboxes.
  • Working files are shared with clients or third parties through links that are never closed.
  • Former staff and contractors keep access to shared folders.
  • Phishing emails impersonating IRAS target staff around filing deadlines. IRAS's scam advisory lists examples and says confidential tax matters are handled through myTax Portal.
  • Old client files are kept indefinitely because nobody decided when to dispose of them.

The PDPC's handbook on How to Guard Against Common Types of Data Breaches covers several of these, recommending periodic review and removal of accounts that are no longer needed, and regular phishing simulation exercises.

Practical habits for client files

  1. Collect documents through a controlled upload, not email attachments.
  2. Give each client or matter its own space, with access limited to the staff working on it.
  3. When a third party needs documents, share view-only access rather than copies where you can.
  4. Keep a record of who opened what, so you can answer a client's questions later.
  5. Review access at the end of each engagement and at least once a year.
  6. Set retention periods that reflect IRAS's record-keeping rules and your own obligations, then follow them.

How ShareAndGo supports a tax practice

ShareAndGo gives each client matter its own room. Document request lists come with a tax audit template, let you assign items and track status, and include a public request-a-file link so clients can upload without an account. Every upload is scanned for viruses. AI reads text from documents, including scans, so search finds words inside them.

Groups decide which folders each person can open, and you set download, print and copy controls per room and per group. Invited reviewers confirm their email address with a six-digit code, and view-only readers see documents with their name, email address and the date on every page. The audit log records every view, upload, download, invitation and change. ShareAndGo processes documents on your behalf as a data intermediary, and your practice remains responsible for the client data. Your documents, records and files are stored in Singapore, and our privacy page lists the services that run elsewhere.

Frequently asked questions

Is there a tax practitioners' board in Singapore?
IRAS describes SCTP as the accreditation body for tax professionals in Singapore and says professionals may apply to it for accreditation. For the rules that apply to your own practice, ask your professional body or adviser.
Who is responsible for client data stored in ShareAndGo?
Your practice remains the organisation responsible for it. ShareAndGo processes it on your behalf as a data intermediary and gives you the controls to decide who sees what.
Can clients upload without an account?
Yes. A request-a-file link lets a client upload straight into the right folder.

Keep reading

Phishing and Singapore accounting firms

Five red flags, using IRAS's own warnings.

How long to keep tax records

What IRAS says about record-keeping periods.

Tax audit rooms

Respond to a review with every request and response recorded.