What it covers
The PDPA governs how private organisations in Singapore collect, use and disclose personal data. It applies to data in a virtual data room just as it applies to an HR system or a CRM. The obligations that matter most in a deal are consent and its exceptions, purpose limitation, protection, retention and transfers out of Singapore.
Deals get a specific carve-out. The business asset transaction exception covers the sale, purchase, amalgamation or other acquisition of an organisation or a part of it. A seller can disclose personal data about employees, customers, directors and other individuals to a prospective party without consent, provided the data relates directly to the part of the business involved and the recipient uses it only to decide whether to proceed. If the deal fails, the recipient must return or destroy it. Once the deal completes, the parties must notify affected individuals that their data has been transferred.
The 2020 amendments raised the stakes. Financial penalties for organisations with annual Singapore turnover above S$10 million can reach 10% of that turnover, and mandatory breach notification applies when a breach is likely to cause significant harm or affects 500 or more individuals. A data room that leaks a staff census is a reportable event.
Key provisions and what they mean in the room
| Rule | What it says | In the data room |
|---|---|---|
| Business asset transaction exception | Personal data can be disclosed to a prospective party without consent if it relates directly to the business being acquired and is used only to evaluate the transaction. | Share what bidders need to price the deal, anonymise the rest, and put the use and return terms in the NDA. |
| Protection obligation | Organisations must make reasonable security arrangements to protect personal data in their possession or control. | Use two-factor login, per-document permissions, watermarks and an audit trail; avoid email attachments. |
| Transfer limitation obligation | Personal data sent outside Singapore must receive a standard of protection comparable to the PDPA. | Check where the vendor hosts the room and cover overseas bidders with contractual clauses. |
| Retention limitation | Data must not be kept once the purpose is served and there is no legal or business reason to keep it. | Close the room on a set date, export the archive to the parties and delete the rest. |
| NRIC advisory guidelines | Organisations should not collect, use or disclose NRIC numbers or copies unless required by law or necessary to verify identity to a high degree. | Mask NRIC and FIN numbers in payroll, CPF and staff records before upload. |
| Data breach notification | Notifiable breaches must be reported to the PDPC within three calendar days of assessing them, and to affected individuals where required. | Keep the activity log; it is the evidence you need to assess a suspected leak quickly. |
Setting up the room
Stage personal data
Give first-round bidders an anonymised staff census and aggregated customer data. Release named records only to the preferred bidder, after exclusivity, in a restricted folder.
Mask identifiers
Redact NRIC and FIN numbers, home addresses, bank details and medical information. CPF contribution reports and payslips are the usual problem files.
Write the use terms down
The NDA or process letter should state that personal data is for evaluating the transaction only and must be returned or destroyed if the deal does not complete.
Know where the room is hosted
If the servers are outside Singapore, document why the protection is comparable. Ask the vendor for its hosting region and sub-processors.
Checklist
- Data protection officer consulted before the room opens.
- Personal data inventory for each folder.
- NRIC, FIN and bank details masked.
- Named HR files restricted to the preferred bidder.
- NDA covers use, return and destruction of personal data.
- Vendor hosting region and sub-processors on file.
- Notification to individuals planned for completion.
Source: Personal Data Protection Act 2012 (as amended 2020); PDPC Advisory Guidelines on Key Concepts and on the NRIC. This page is general information, not legal or tax advice.
Questions people ask
Do I need employee consent to put HR files in a data room?
Not if the business asset transaction exception applies: the data must relate directly to the business being sold and the prospective buyer may use it only to evaluate the deal. In practice, share anonymised data first and named files only with the final bidder, and mask NRIC numbers throughout.
Does the PDPA require the data room to be hosted in Singapore?
No. The PDPA allows transfers out of Singapore if the data receives comparable protection, usually through contractual terms. Some financial institutions and government-linked buyers ask for Singapore hosting under their own policies, so check before choosing a vendor.
What happens if the room leaks personal data?
If the breach is likely to cause significant harm or affects at least 500 individuals, the organisation must notify the PDPC within three calendar days of assessing it as notifiable. Penalties can reach 10% of annual Singapore turnover for larger organisations.
Who is responsible, the seller or the data room vendor?
The seller remains responsible for the personal data it discloses. The vendor processes data on its behalf, which is why the PDPC expects organisations to check a processor's security and contract terms.