Questions to ask an IT vendor in Singapore

You can outsource the work. You cannot outsource the obligation.

That is the whole of Singapore's position in one line, and it is written into section 4(3) of the Personal Data Protection Act. When a vendor processes personal data for you, you have the same obligations as if you were processing it yourself. Their mistake is your problem.

Most vendors are decent. Almost every bad outcome we have seen came from something nobody wrote down, so these are the questions worth asking before you sign. Some of them make vendors uncomfortable, ourselves included.

General information, not legal advice. Written September 2026, due for review March 2027. Every legal claim links to its source.

What your vendor actually owes you

Under the PDPA, a vendor processing data on your behalf is a data intermediary. Where you have a written contract, their own direct duties narrow to three things: protecting the data, not keeping it longer than needed, and telling you when something goes wrong.

Everything else stays with you. Consent, purpose, access requests, accuracy, and the notification to the regulator when there is a breach.

That is why the written contract matters more here than people assume. Without one, the narrowing does not apply, and you have no enforceable terms either way.

The PDPC publishes a guide with model data protection clauses you can lift directly. It is free, it is written by the regulator, and hardly anyone uses it.

Breach timing

You notify the PDPC within three calendar days of deciding a breach is notifiable, which it is where significant harm is likely or 500 or more people are affected. Affected individuals get told where harm is likely.

Three days is short. Your vendor's contractual deadline has to be shorter, because your clock starts when you find out, and you find out when they tell you. Twenty-four hours from their discovery, in writing, is the reasonable ask.

Since 1 October 2022, penalties reach S$1 million, or 10 per cent of annual Singapore turnover for organisations above S$10 million in turnover, whichever is higher.

Is this a real business

Ask for the UEN, then check it yourself on ACRA's Bizfile without involving them. Status and registered address are free. A Business Profile naming the directors costs S$5.50, and the Corporate Compliance and Financial Profile, which shows filed accounts, costs S$50.

Look for struck-off or dormant status, a registration dated weeks before your first meeting, and directors who are not the people you met.

Ask to speak to a client who left. Any vendor can produce a happy customer. Ask the one who moved on whether handover happened promptly and whether the final invoice matched the quote.

Ask what happens if their lead developer leaves. Small vendors run on one or two people, which is fine as long as somebody wrote things down.

This is not only a small vendor problem. In October 2025 the PDPC fined Marina Bay Sands S$315,000 after the personal data of 665,495 patrons was accessed and taken, and later found for sale on the dark web. During a software migration, one employee manually compiled the list of API configurations with no second layer of checks. A single identifier was omitted, and nobody found it for six months.

Who owns the code

This is where Singapore catches people out. Under the Copyright Act 2021, the creator owns commissioned work by default unless the contract assigns it otherwise.

So if your agreement is silent, your vendor owns the software you paid for. Not the licence. The copyright.

Get an assignment clause. A fair one transfers the custom code to you on payment and gives you a permanent licence to any reusable components the vendor brought with them.

Whose name is on the domain

Yours. Same for cloud accounts, the app store listing and certificates. Give the vendor administrator access, but the registered owner should be your organisation on an email address you control.

When a vendor holds the domain, a billing dispute can take your website and email offline while it is resolved. Getting it right at the start costs nothing.

Where the data lives

Ask for the hosting country and a written list of sub-processors, meaning the cloud host, the email service, the analytics tool, any AI service in the stack.

Section 26 requires any overseas recipient to be bound to a comparable standard of protection. The PDPC's guide to cross-border transfers sets out how, and it recognises the ASEAN Model Contractual Clauses as a practical route. The 2026 amendment regulations widened the recognised certification schemes further.

Ask who their data protection officer is. Every organisation in Singapore must designate someone responsible for PDPA compliance, your vendor included. "Nobody in particular" is not an available answer.

Ask what happens to your data when you leave. Returned in a usable format, deleted everywhere afterwards including backups, confirmed in writing.

Money and scope

Fixed price or time and materials both work. What matters is a written scope and a change process where every change gets priced and approved before anyone builds.

Ask about the warranty period. Thirty to ninety days after go-live with defects fixed at no charge is the usual arrangement for custom software. It is a market norm rather than a legal right, so it only exists if you ask.

Ask what the service level agreement actually promises. Response and resolution times by severity, support hours in Singapore time, and a remedy when they miss. An uptime percentage with nothing attached is decoration.

Ask what they will do to help you leave. A transition period at agreed rates, data and documentation returned, cooperation with whoever comes next.

Security, without needing to be technical

You do not have to understand the answers. You need to notice whether there is one.

Do all your staff use multi-factor authentication on our systems. How quickly do you apply critical security patches, and a number of days beats "when we can". When did you last restore a backup, and can we watch the next one. Who can reach our data, and how is access removed when somebody leaves.

On certifications, ISO/IEC 27001 and SOC 2 are real and expensive. The Cyber Security Agency's Cyber Essentials mark is the realistic baseline for a small Singapore vendor and covers asset inventory, secure configuration, updates, backup and incident response. A genuine certificate names the certifying body, the scope and an expiry date. A logo is not a certificate.

What to keep checking

Every month, check that backup jobs report success, look at patch status, and confirm the invoice matches what you use.

Every quarter, restore something for real. Remove leavers and dormant accounts. Audit licences and seats. Check the sub-processor list for quiet additions. CIS Controls v8 puts it plainly under Safeguard 11.5: test backup recovery quarterly for a sample of assets. A backup nobody has restored is an assumption.

Twice a year, check domain, certificate and subscription expiry dates with a named owner for each renewal.

Once a year, run a full recovery exercise, read the data processing agreement against current law, review how the service level actually performed, and look the company up on ACRA again.

Then the moments that do not follow a calendar. Someone leaves on either side, so access goes the same day. The vendor is acquired or loses a key person. A new integration or AI tool appears, so the sub-processor list needs updating. A renewal arrives, so you reread the exit terms.

When to walk away

They will not sign a data processing agreement. They register your domain in their own name. They will not put code ownership in writing. Nobody is named as responsible for data protection. They quote without a written scope. They cannot show documentation for systems they already run. One person holds every password. They discourage you from checking ACRA or calling references.

If you are using a grant

Social service agencies have Tech-and-GO!, and charities have the Charities Capability Fund ICT Grant, which funds up to 80 per cent of supported cost capped at $40,000 per charity over five years, running to 31 March 2027.

Both work the same way. Apply before you sign or pay, and use an approved vendor and package. A listed vendor is still a vendor, and every question above still applies.

One last thing

None of this requires you to be technical or suspicious. It requires you to write things down and check them occasionally.

If you want a second opinion on a contract or an arrangement you already have, we are happy to look at it. That includes telling you it is fine, which it often is.