Every buyer wants to understand the people behind a business: who the key staff are, what they earn, how many are on work passes, which customers drive revenue. Much of that is personal data. In Singapore, the Personal Data Protection Act (PDPA) decides how much of it a seller can share, with whom and on what terms.
The good news is that the PDPA was written with deals in mind. The business asset transaction exception allows disclosure without consent in the right circumstances. The bad news is that many sellers treat it as a blanket permission and upload far more than they need to, often including NRIC numbers, home addresses and medical certificates. This guide explains the rule and how to apply it in a data room.
This is general information, not legal advice. Your data protection officer and counsel should confirm the approach for your transaction.
What counts as personal data in a deal
Personal data is any data about an individual who can be identified from that data, or from that data together with other information the organisation has or is likely to have access to. In due diligence it shows up in more places than people expect.
| Where it appears | Typical personal data | Usually needed by buyers? |
|---|---|---|
| Payroll and CPF records | Names, NRIC or FIN, salaries, bank accounts | Aggregated figures yes; identifiers rarely |
| Employment contracts | Names, roles, pay, restrictive covenants | Key staff yes, others as a sample |
| Work pass records | Names, FIN, pass type, expiry | Counts and expiry dates; names late |
| Customer contracts | Names and contact details of signatories | Commercial terms yes, contacts rarely |
| CRM exports | Individual customers’ purchase histories | Aggregated only |
| Disputes and HR cases | Complainants, medical details | Summaries only |
| Board and shareholder records | Directors’ and shareholders’ details | Yes, these are public in part through ACRA |
The business asset transaction exception
The PDPA lets an organisation collect, use and disclose personal data without consent in a business asset transaction: the purchase, sale, lease, merger, amalgamation or other acquisition or disposal of an organisation, a portion of it, or its business or assets. Three conditions shape what you can do before completion.
How the exception works across a deal
- Prospective partySeller discloses personal data that relates directly to the part of the business involved.
- Use limitedThe prospective buyer uses it only to decide whether to proceed.
- Deal failsThe prospective buyer returns or destroys the data.
- Deal completesThe parties notify individuals that their data has been transferred.
It must relate directly to the business being sold. In a carve-out of one division, data about employees of other divisions is out of scope. In a share sale of a whole company, most employee data will relate directly to it.
It is for evaluating the deal. The buyer cannot use staff data to recruit people if the deal fails, or customer data to market to them.
Return or destroy if it fails. The NDA or process letter should say so in terms, and the data room should make it practical: watermarks, download limits and an audit trail showing who took what.
The exception is not a licence to share everything
The exception permits disclosure where it is needed to evaluate the deal. Other PDPA obligations still apply, in particular the protection obligation, which requires reasonable security arrangements, and the transfer limitation obligation for overseas bidders. Uploading every payslip with NRIC numbers visible is hard to justify as reasonable.
NRIC numbers: mask them
The PDPC’s advisory guidelines on the NRIC say organisations should not collect, use or disclose NRIC numbers, or copies of the NRIC, unless required by law or necessary to accurately establish or verify identity to a high degree of fidelity. A buyer evaluating a business rarely needs any employee’s NRIC number.
Mask NRIC and FIN numbers in payroll reports, CPF contribution records, work pass lists and scanned identity documents before upload. Where a buyer later needs to verify identity, for example for a key executive’s service agreement at completion, handle it outside the room.
Some data rooms can redact inside the platform; in our data 7 of the 18 list redaction. Without it, redact files before upload and keep the originals offline.
Stage personal data in the room
Most Singapore sale processes have two or three rounds. Personal data should follow the same rhythm: aggregated early, named late, and only for those who need it.
Releasing personal data across a sale process
- Phase 1AggregatedHeadcount by function, total payroll, salary bands, turnover rates, work pass counts.
- Phase 2PseudonymisedEmployee census with IDs instead of names, key terms of contracts, anonymised disputes.
- Preferred bidderNamed, limitedKey executives' contracts and named files for counsel only, NRIC masked.
- CompletionTransferRecords transfer with the business; notify individuals.
An HR folder built for the PDPA
- 06.1 Headcount summaryBy function, location and pass type
- 06.2 Payroll summaryTotals and bands, no names
- 06.3 Census (pseudonymised)Employee ID, role, tenure, pay band
- 06.4 Standard contractsTemplates and handbook
- 06.5 Key executivesNamed, restricted to bidder counsel
- 06.6 Work passesCounts and expiry months
- 06.7 DisputesSummaries, complainants anonymised
Who sees which HR folder
| Folder | Bidder deal team | Bidder counsel | Bidder HR adviser | Lenders |
|---|---|---|---|---|
| Headcount and payroll summary | Download (watermarked) | Download (watermarked) | Download (watermarked) | View |
| Census (pseudonymised) | View | Download (watermarked) | Download (watermarked) | None |
| Key executives (named) | None | View | View | None |
| Disputes | None | View | None | None |
Overseas bidders and the transfer limitation obligation
Singapore deals often involve buyers in Japan, Europe, the US or elsewhere in Southeast Asia, and data rooms are often hosted outside Singapore. The transfer limitation obligation requires that personal data transferred out of Singapore receives a standard of protection comparable to the PDPA. Contractual terms in the NDA or a data transfer agreement are the usual tool.
Two practical steps help. First, ask the data room vendor where the room is hosted and which sub-processors it uses. Second, keep personal data aggregated or pseudonymised for as long as possible, which reduces what crosses the border.
If something goes wrong
A misconfigured permission or a leaked download can be a data breach. Under the PDPA, if a breach is likely to result in significant harm to individuals or affects 500 or more individuals, the organisation must notify the PDPC within three calendar days after assessing that it is notifiable, and notify affected individuals where required.
The data room’s audit trail is the first thing you will need: who had access, what they opened, what they downloaded and when. Choose a room that logs every action and lets you export the log.
PDPA checklist for a deal data room
- DPO involved before the room opens
- Inventory of personal data by folder
- NRIC, FIN, bank and medical details masked
- Aggregated data for phase 1
- Named files restricted to the preferred bidder
- NDA covers use, return and destruction
- Hosting region and sub-processors documented
- Audit trail export tested
- Notification to individuals planned for completion
Prepare personal data for due diligence
- Map the dataList every folder that will hold personal data and what kind.
- Decide what buyers needUsually totals, bands and key contracts, not individual records.
- Mask and pseudonymiseRemove identifiers; replace names with employee IDs in the census.
- Set staged permissionsAggregated for all bidders, named data later and only for counsel.
- Paper the termsUse, return and destruction in the NDA; transfer terms for overseas bidders.
- MonitorReview the audit trail weekly and remove access promptly when bidders drop out.
Which data rooms help most
Rooms with redaction, per-document download control, watermarks and a full audit trail make PDPA compliance easier to show. This table lists the top of our ranking with those features.
Features that help with the PDPA
| Data room | Score | Price (SGD) | Trial | Certifications | Redaction | View and download control | Dynamic watermarks | Audit trail |
|---|---|---|---|---|---|---|---|---|
 Ellty | 9.2 | ~S$191/mo | 14-day free trial | SOC 2 (hosting) | No | Yes | Yes | Yes |
 iDeals | 8.6 | On quote | Free trial | SOC 2, ISO 27001, GDPR | Yes | Yes | Yes | Yes |
 Datasite | 8.5 | On quote | Demo on request | SOC 2, ISO 27001, GDPR | Yes | Yes | Yes | Yes |
 Ansarada | 8.5 | On quote | Free trial | SOC 2, ISO 27001 | No | Yes | Yes | Yes |
 Firmex | 8.3 | On quote | Free trial | SOC 2, ISO 27001 | Yes | Yes | Yes | Yes |
 Drooms | 8.2 | On quote | Demo on request | SOC 2, ISO 27001, GDPR | Yes | Yes | Yes | Yes |
 Intralinks | 8.1 | On quote | Demo on request | SOC 2, ISO 27001 | Yes | Yes | Yes | Yes |
 Box | 8.0 | ~S$19/user/mo | Free trial | SOC 2, ISO 27001, HIPAA, GDPR | No | No | Yes | Yes |
For a full ranking for HR-heavy deals, see the HR and employee records use case, and for the rule itself the PDPA page. The PDPC publishes its guidelines at pdpc.gov.sg.
Questions people ask
Do I need employee consent to share HR data in due diligence?
Not if the business asset transaction exception applies: the data must relate directly to the business and be used only to evaluate the deal, with return or destruction if it fails.
Can buyers see salaries?
Usually as bands or totals early on. Named salaries for key executives can go to the preferred bidder's counsel late in the process.
Should NRIC numbers ever be in a data room?
Rarely. PDPC guidelines restrict NRIC disclosure, and buyers almost never need them to evaluate a deal. Mask them.
Does the PDPA apply to customer data in the room?
Yes. Share aggregated customer metrics and commercial terms; individual customer data is rarely needed.
What happens to the data if the deal fails?
The prospective buyer must return or destroy it. The audit trail helps confirm what was downloaded.