Signing a non-disclosure agreement does not, by itself, settle whether your company may disclose personal data to a supplier or business partner. Before sending a customer list, identify the purpose, the information genuinely needed and the recipient’s role. Then check both confidentiality protection and the separate data protection arrangements for the proposed disclosure.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
What information does the recipient actually need?
A potential supplier may be able to quote using sample records, transaction volumes or anonymised information. A marketing partner assessing a campaign may not need your full customer database. Start with a smaller dataset and explain the business reason for every field requested.
Keep the distinction between anonymisation and simply removing a name in mind. Contact details, account numbers or a combination of transaction information may still identify someone. If the team cannot explain why a field is needed, pause before including it.
What should the NDA cover?
- A clear description of the confidential information and the permitted evaluation or service purpose.
- The people who may access it and how their obligations are controlled.
- Restrictions on onward disclosure, copying and use for the recipient’s own business.
- Handling of legally required disclosures and notice where appropriate.
- Return or deletion, with a workable approach to backups and required retention.
These terms should be tailored to the transaction. Do not assume a generic mutual NDA adequately covers an ongoing outsourced service. A separate services agreement or data processing schedule may be needed to describe instructions, security, incident handling and exit arrangements.
Is the recipient processing data for you or using it independently?
Ask what the recipient will do after receiving the information. A payroll provider following your instructions presents different issues from a commercial partner proposing to contact customers for its own purposes. Establish the actual relationship rather than relying on the label “partner” or “processor”.
The PDPC’s guide on managing data intermediaries is a useful starting point for outsourcing governance. Have your data protection officer or legal adviser assess the arrangement, the applicable PDPA obligations and whether notices, consent or another lawful basis need attention. A confidentiality promise is not a substitute for that assessment.
Questions to ask before uploading a file
- Who approved the disclosure and documented its purpose?
- Which fields will be shared, and which can be removed?
- Where will the information be stored and accessed?
- Will subcontractors or overseas teams receive it?
- Who must tell you about an incident, and through which channel?
- How will access be withdrawn when the project ends?
A practical example
Illustration: A retailer asks an agency to estimate the cost of a customer loyalty campaign. The agency requests the full customer list before it provides a proposal. The retailer can first provide customer numbers, broad segments and a fictional sample layout. If the project proceeds, it can assess the agency’s data handling and agree the appropriate contract before transferring live records.
What documents should you prepare for a review?
Bring the proposed NDA, the service proposal, your customer privacy notice, a sample of the fields to be transferred and the recipient’s explanation of its systems and subcontractors. This lets an adviser assess the actual disclosure and identify gaps between the confidentiality terms and the planned use. Avoid sending live customer data simply to obtain an initial quotation for legal advice.
Related guides
- Non-Disclosure Agreement (NDA)
- Personal Data Protection Act (PDPA)
- Data Protection Inventory Mapping (DPIM)
Official sources
How Raffles Corporate Services can help
If you would like assistance with contract drafting or review, email [email protected] or WhatsApp +65 8501 7133. We can coordinate relevant corporate services, tax advice and, where needed, legal assistance from advisers at associated law firms. Legal advice and representation are provided by those advisers. This article is general information and does not replace advice on your circumstances.