ShareAndGoShareAndGo

Compliance

Where your documents are stored matters. Here is why, for Singapore businesses.

Most of the time nobody asks where a file physically sits. Then a client's procurement team sends a questionnaire, a regulator asks about an outsourcing arrangement, or a breach forces you to explain where personal data went, and the question suddenly has to be answered precisely.

This article explains why location matters under Singapore's data protection rules, why it is your responsibility even when a provider makes the choice, and what to ask before you trust anyone with your documents. It is general information, not legal advice.

Get started

The PDPA does not ban overseas storage. It sets conditions.

A common misunderstanding is that Singapore law requires personal data to stay in Singapore. The Personal Data Protection Act does not say that. What it contains is the Transfer Limitation Obligation in section 26, which the PDPC's Advisory Guidelines on Key Concepts in the PDPA summarise this way: an organisation must not transfer personal data to a country or territory outside Singapore except in accordance with the requirements prescribed under the PDPA.

In practice, the guidelines explain, this means ensuring that personal data transferred overseas is protected to a standard comparable with the PDPA. Data can go abroad. The organisation sending it has to be able to show that it stays properly protected when it does.

Your responsibility, even when a provider moves the data

The part that catches businesses out is who carries that responsibility. The PDPC's guidelines say that where an organisation engages a data intermediary to process personal data on its behalf, the organisation is responsible for the Transfer Limitation Obligation for any overseas transfer, whether the organisation sends data to an overseas provider or a provider in Singapore transfers it overseas as part of its processing.

The guidelines give two examples that are worth reading closely. In the first, a company uses a customer relationship management service from a provider in the United States, and so must make sure the provider can protect the personal data transferred. In the second, a company uses a cloud storage service from a provider in Singapore, and the provider transfers the data to its other servers in London and Hong Kong. Because the provider does this on the company's behalf, the company must comply with the Transfer Limitation Obligation.

The second example is the one to remember. Signing up with a provider that has a Singapore office does not tell you where your data is. Only the provider's answer to that specific question does.

The guidelines say the onus is on the transferring organisation to undertake appropriate due diligence and obtain assurances, and that it may rely on the provider's existing protection policies and practices, including their assurances that they meet relevant industry standards or hold certification.

Why location matters beyond the PDPA

Data protection is the obvious reason, but not the only one.

  • Regulated institutions. MAS's Guidelines on Outsourcing ask financial institutions to be aware that cloud services have a higher propensity for processing to be carried out in multiple locations, and to do due diligence accordingly. Firms that serve those institutions are often asked the same questions.
  • Client contracts. Clients, especially larger ones and public agencies, often write their own requirements on location into contracts and questionnaires. Those bind you regardless of what the law requires.
  • Incident response. When something goes wrong, you need to know which provider, which country and which copy is involved, quickly. The PDPC's breach rules leave little time to find out.
  • Trust. Counterparties in a deal or an audit increasingly ask where the documents they are reviewing are kept. A clear, accurate answer is part of looking organised.

Questions to ask any provider

Whether you are choosing a data room, a file store or any other service that will hold your documents, these questions get to the facts.

  1. Where are our documents stored, and are backups and copies kept in the same place?
  2. Which parts of the service run somewhere else, for example sign-in, email delivery, payments or AI processing, and what data do they handle?
  3. Is there a published list of those services?
  4. Would you tell us before changing where our documents are stored?
  5. If personal data is transferred outside Singapore, what protections apply to it?
  6. Can we export everything, in an organised form, if we leave?

A provider that answers in vague terms, such as data being held in the region or in secure data centres, has not answered. Ask again for a place.

ShareAndGo's answer

For ShareAndGo Singapore workspaces, the answer is short. Your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them, so you can see each one rather than take our word for it. Keeping them in Singapore is a choice we offer Singapore workspaces, not something the PDPA requires.

That location answer sits alongside the controls a data room is for: groups that see only the folders you allow, view-only sharing where the original file is never sent to the viewer's browser, per-recipient watermarks, invitations with end dates, and an audit log of every view, upload, download, invitation and change, chained so alterations are detectable. When you are finished, you can export a room as a ZIP with its folder structure and an index of every document.

Telling you where your data is does not make your obligations ours. It gives you an accurate fact to put in your own assessment.

Questions people ask

Does Singapore law require data to be stored in Singapore?
The PDPA does not impose a general data-localisation requirement. Its Transfer Limitation Obligation sets conditions on transfers overseas. Contracts, sector rules and clients may set stricter requirements, so check with your adviser.
If my provider is based in Singapore, does that tell me where my files are?
Not necessarily. The PDPC's own example is a Singapore cloud storage provider moving data to servers in London and Hong Kong. Ask the provider where your data is stored.
Where does ShareAndGo store documents for Singapore workspaces?
Your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them.

Keep reading

Privacy

Where we store data and which services run elsewhere.

MAS guidance on cloud

How MAS outsourcing guidance treats cloud services.

Evaluating data room vendors

A practical way for Singapore SMEs to compare providers.

Know where your documents are.

Stored in Singapore, with a published list of the services that run elsewhere.

Get started