Accounting records hold some of the most sensitive information a business owns: bank details, payroll data, customer and supplier lists, and the financial position of the company itself. If you run a company in Singapore, data security best practices for protecting your accounting information are not a technical luxury. They are part of running a compliant and trustworthy business.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
This article explains the general principles, the Singapore rules that sit behind them, and a practical way to put sensible safeguards in place. It is written for directors, finance managers and business owners who want a clear starting point rather than a technical manual.
Who this applies to
Every Singapore company that keeps accounting records needs to think about data security, whatever its size. That includes the sole-director company with a cloud accounting subscription and the group with a full finance team.
- Directors, who are responsible for ensuring proper accounting records are kept and safeguarded.
- Finance and bookkeeping staff who handle bank statements, invoices and payroll files every day.
- Business owners who share records with external accountants, tax agents or a corporate secretary.
- Companies that hold personal data of employees, customers or vendors inside their accounting systems.
Key rules and requirements in Singapore
There is no single statute titled “accounting data security”. Instead, several obligations work together, and it is more honest to say so than to invent one rule.
Companies Act record-keeping
Under the Companies Act, directors must ensure that proper accounting records are kept for at least five years from the end of the financial year to which they relate. Records that are lost, altered or destroyed cannot be relied upon, so protecting them is a practical necessity for meeting this duty.
IRAS recordkeeping
IRAS generally expects businesses to keep the records that support their income tax and GST filings for five years. GST-registered businesses must be able to produce tax invoices and supporting documents on request. A ransomware incident that wipes your files does not remove that obligation.
Personal Data Protection Act (PDPA)
Accounting files often contain personal data, such as employee NRIC or FIN details, salary information and customer contact details. The PDPA requires organisations to make reasonable security arrangements to protect personal data in their possession. It also contains a data breach notification regime, so a serious breach may need to be reported to the Personal Data Protection Commission and affected individuals.
Directors’ general duties
Directors must act with reasonable care, skill and diligence. Leaving company financial data unprotected, without any sensible controls, is difficult to defend if something goes wrong.
Step-by-step process
You do not need an enterprise budget to improve your position. A staged approach works well for most small and medium-sized companies.
- Map where your data lives. List every place accounting information is stored: the accounting software, email inboxes, shared drives, laptops, phones and paper files.
- Classify what is sensitive. Payroll files, bank credentials and tax computations deserve tighter controls than a blank invoice template.
- Control access. Give each person only the access their role requires. Remove accounts promptly when staff leave or when an external adviser’s engagement ends.
- Turn on multi-factor authentication. Use it for accounting software, email, internet banking and the ACRA BizFile+ and IRAS myTax Portal logins where available.
- Back up and test. Keep regular backups in a separate location, and test that you can actually restore from them.
- Secure the devices. Use screen locks, device encryption and up-to-date software on every laptop and phone that touches financial data.
- Write a short policy and train your people. A two-page policy that staff actually read is better than a long one nobody opens.
- Prepare an incident plan. Decide in advance who to call, what to isolate and who decides whether a breach must be notified.
Common mistakes to avoid
- Sharing one login among several staff, which makes it impossible to see who changed what.
- Sending bank statements, payroll files or NRIC copies by ordinary email without protection.
- Assuming the cloud provider handles everything. The provider secures the platform, but you remain responsible for passwords, permissions and what you upload.
- Keeping backups on the same device or network as the original files, so one incident destroys both.
- Failing to remove access for former employees, interns or freelancers.
- Approving payment changes on the strength of an email alone, without calling the supplier on a known number.
- Ignoring software updates because the business is busy.
Practical examples
A payment diversion attempt
A finance executive receives an email that appears to come from a regular supplier, announcing a new bank account. A simple rule, that every change of bank details must be confirmed by a call to a known contact, stops the fraud before any money moves.
A departing bookkeeper
A bookkeeper resigns and leaves at the end of the month. Because the company keeps a short access checklist, her accounting software, email and banking access are removed on her last day. Nothing is left open by accident.
A lost laptop
A director leaves a laptop in a taxi. Because the drive was encrypted and the accounting files live in a cloud platform with multi-factor authentication, the company changes a few passwords and carries on, with no personal data exposed.
How a corporate secretary can help
A corporate secretary in Singapore is not an IT security specialist, but a good one helps you build the governance around your data. Raffles Corporate Services can support you with maintaining statutory registers and records, ACRA filings, accounting, tax and payroll support, and with keeping a clear record of who is authorised to access and sign off on what. Where specialist cybersecurity work is needed, we can help you identify the right questions to ask a qualified provider.
Because we handle financial and personal data for our clients, we also see first-hand which habits protect businesses and which ones expose them.
Frequently Asked Questions
How long must a Singapore company keep its accounting records?
Generally, for at least five years from the end of the financial year to which the records relate. IRAS expects tax-related records to be kept for a similar period.
Is cloud accounting software safe?
Reputable cloud platforms invest heavily in security, often more than a small business could afford alone. The risk usually lies in weak passwords, shared logins and excessive access, which remain your responsibility.
Do I have to report a data breach?
Under the PDPA, certain data breaches must be notified to the Personal Data Protection Commission and, in some cases, to affected individuals. Whether a particular incident qualifies depends on its scale and likely impact, so take advice quickly if one occurs.
Can I email financial documents to my accountant?
It is common, but better to use password-protected files or a secure sharing platform, and to send the password through a separate channel.
Who in the company is responsible for data security?
Ultimately the directors. They can delegate tasks to staff or advisers, but the accountability for proper record-keeping and reasonable security arrangements stays with the board.
Key takeaways
- No single law covers accounting data security, but the Companies Act, IRAS requirements and the PDPA together set clear expectations.
- Start by mapping where your financial data lives and who can access it.
- Use multi-factor authentication, role-based access and tested backups.
- Verify any change of payment details by phone before acting on it.
- Remove access promptly when staff or advisers leave.
- Keep a short written policy and an incident plan, and review both each year.
Requirements may change, so always check the latest guidance from ACRA, IRAS or MOM, or consult a professional adviser.
If you would like to find out more about how Raffles Corporate Services can assist with your company’s compliance and corporate secretarial requirements, please get in touch with the team at [email protected].
Yours sincerely,
The editorial team at Raffles Corporate Services
Disclaimer: This does not constitute legal advice. If you require legal advice, please contact a lawyer.