Singapore rules

Singapore rules for data rooms

Eight sets of rules that decide what goes into a Singapore data room, who may see it and what it costs.

Rule	Regulator	Key figure	Matters for
PDPA	Personal Data Protection Commission (PDPC)	10%: Maximum penalty: share of annual Singapore turnover for organisations above S$10 million turnover	4 use cases
SGX listing rules	Singapore Exchange Regulation (SGX RegCo) and MAS	2 boards: Mainboard for established companies, Catalist for growth companies with a sponsor	4 use cases
MAS technology risk	Monetary Authority of Singapore (MAS)	2021: Current MAS Technology Risk Management Guidelines issued in January 2021	4 use cases
Companies Act and ACRA	Accounting and Corporate Regulatory Authority (ACRA)	BizFile: ACRA's portal for company profiles, filings and annual returns	4 use cases
Take-over Code	Securities Industry Council (SIC)	30%: Acquiring 30% or more of voting rights generally triggers a mandatory offer	4 use cases
CCCS merger control	Competition and Consumer Commission of Singapore (CCCS)	40%: CCCS is likely to examine a merger where the merged entity has 40% or more market share	4 use cases
GST on software	Inland Revenue Authority of Singapore (IRAS)	9%: GST rate since 1 January 2024	4 use cases
Stamp duty on shares	Inland Revenue Authority of Singapore (IRAS)	0.2%: Duty on the higher of price or market value of the shares	4 use cases

Personal Data Protection Commission (PDPC)

The PDPA and your data room

The Personal Data Protection Act 2012 lets a seller share employee and customer personal data with a prospective buyer without consent, but only data that relates directly to the business being sold, only for evaluating the deal, and on terms that it is returned or destroyed if the deal does not go ahead. Everything else should be anonymised or redacted before it goes into the room..

SGX listing rules and the IPO data room

An SGX listing runs on due diligence. On the Mainboard the issue manager, and on Catalist the full sponsor, must satisfy themselves that the company is suitable and that the prospectus or offer document is accurate.

MAS technology risk rules and data room vendors

A bank, insurer, capital markets licensee or fund manager regulated by MAS must manage technology and outsourcing risk under the MAS Technology Risk Management Guidelines, the outsourcing guidelines and the cyber hygiene notices. In practice that means a vendor security review before the data room is used: certifications, encryption, access controls, hosting location, sub-processors, audit rights and exit arrangements..

Companies Act and ACRA records in due diligence

Corporate due diligence on a Singapore company starts with ACRA. Buyers pull the BizFile business profile, then check the constitution, the electronic register of members, the register of registrable controllers, the register of directors, share allotments and the resolutions behind them.

The Singapore Take-over Code and data rooms

When the target is a Singapore listed company or a large public company, the Singapore Code on Take-overs and Mergers applies. It sets the 30% mandatory offer threshold, requires shareholders to be treated equally, and means information given to one offeror must be given to a competing bona fide offeror if asked.

CCCS merger control and your data room

Singapore has a voluntary merger notification regime. Section 54 of the Competition Act 2004 prohibits mergers that substantially lessen competition, and parties decide for themselves whether to notify the CCCS.

GST on data room software in Singapore

Singapore GST is 9%. Most data room vendors are overseas companies.

Stamp duty on share transfers in Singapore

A transfer of shares in a Singapore company attracts stamp duty of 0.2% of the higher of the purchase price and the market value of the shares, usually paid by the buyer. The document must be stamped within 14 days of signing if signed in Singapore, or 30 days if signed overseas.

GST on data room fees

At 9%, a S$191 monthly subscription for four months costs S$764 before GST and S$833 with GST.

USD to SGD vendor prices

Most data room vendors publish prices in US dollars.

Stamp duty on shares

Singapore stamp duty on a share transfer is 0.2% of the higher of the price paid and the market value of the shares.

CCCS merger guides

Singapore merger notification is voluntary.

Data room size estimator

A mid-market sale of a Singapore group with three companies and three years of records typically needs around 1,700 documents, 19,000 pages and a few gigabytes of storage.

Due diligence timeline

A mid-market private sale in Singapore usually needs about four to six weeks to prepare the room and six to ten weeks of due diligence before signing.

Questions people ask

Which Singapore law matters most for a data room?

For most deals, the PDPA, because data rooms often hold employee and customer personal data. Listed company deals add the SGX rules and the Take-over Code; financial institutions add MAS technology risk expectations.

Does Singapore require data rooms to be hosted locally?

No general rule requires it. The PDPA allows overseas transfers with comparable protection. Some institutions require Singapore hosting under their own policies.

Is this legal advice?

No. These pages explain how common rules affect data room setup. Take advice from Singapore counsel for your transaction.