Introduction
Many Singapore companies are moving their corporate records from physical filing systems to cloud-based solutions. Moving from Paper to Cloud for Your Corporate Records: Risks and Controls explains the key legal, regulatory and operational considerations so boards, company secretaries and management can make informed choices.
The question for many businesses is not whether to adopt cloud storage but how to ensure compliance with the Companies Act, ACRA requirements, IRAS record-keeping rules and data protection obligations under the PDPA. This article summarises practical controls and steps to manage the transition safely.
Who this applies to
This guidance is relevant to:
- Companies incorporated in Singapore required to maintain statutory records under the Companies Act.
- Company secretaries, directors and finance teams responsible for Financial Year End, GST and IRAS filings via the myTax Portal.
- HR and payroll teams storing employment records, CPF contributions and records related to Employment Pass, S Pass or Work Permit holders.
- Organisations considering cloud vendors for compliance, accounting, tax and payroll support.
Key rules and requirements in Singapore
When moving corporate records to the cloud, consider the following Singapore-specific legal and regulatory obligations.
- Companies Act and statutory books: Companies incorporated in Singapore must maintain registers and statutory records. Records may be kept electronically provided they are reliable and accessible for inspection where required.
- ACRA requirements: Filings with ACRA must be accurate and supported by records. Use the ACRA BizFile+ portal as required for statutory submissions and retain supporting documents for the prescribed retention period.
- IRAS record-keeping: Tax and GST documents must be retained in a readable format for the retention period defined by IRAS and be accessible for audit; IRAS accepts electronic records if they are accurate and tamper-evident.
- PDPA and data protection: Personal data stored in the cloud are subject to PDPA obligations. Organisations must ensure appropriate consent, protection, retention and transfer safeguards.
- Employment records: Employment records, CPF contribution records and documents related to Employment Pass, S Pass and Work Permit holders must be retained and made available for inspections by MOM and CPF Board where required.
- Security and integrity: Ensure confidentiality, integrity and availability of records. Controls should provide audit trails, role-based access and logging.
Step-by-step process
Follow these steps to move corporate records from paper to cloud securely and compliantly.
1. Assess records and retention requirements
- Catalogue all documents (statutory registers, board minutes, contracts, invoices, payroll files, tax records).
- Identify retention periods under the Companies Act, IRAS, Employment Act and internal policies.
2. Select an appropriate cloud provider
- Choose providers with strong security certifications (e.g. ISO 27001) and data centres with appropriate controls.
- Check data residency and cross-border transfer implications; document where records will be stored.
3. Prepare records for digitisation
- Use consistent naming conventions, indexation and metadata for easy retrieval, and validate scanning quality for legibility and completeness.
- Apply tamper-evident measures such as digital signatures or secure hashes for key documents.
4. Implement access, authentication and audit controls
- Configure role-based access, multi-factor authentication and activity logging.
- Set retention and disposition policies aligned with statutory requirements and business needs.
5. Migrate and test
- Perform a phased migration and validate that records are complete, searchable and retrievable.
- Test procedures for responding to ACRA or IRAS information requests and internal audits.
6. Update policies and communicate
- Update corporate secretarial policies, data protection policies and document management procedures.
- Train staff on new processes, including password hygiene, record classification and incident reporting.
Common mistakes to avoid
- Assuming all cloud providers offer the same security — verify certifications and contractual commitments.
- Failing to maintain an audit trail — ensure change logs and access records are preserved for inspections.
- Overlooking retention rules — do not delete documents prematurely; align deletion schedules with IRAS and Companies Act requirements.
- Not validating scanned documents — unreadable scans can lead to compliance issues during audits or legal disputes.
- Ignoring data transfer considerations — ensure PDPA-compliant transfers and appropriate safeguards for cross-border storage.
Practical examples
These examples illustrate how controls work in practice.
Example 1: Board minutes and statutory registers
Board minutes scanned and stored in the cloud should include date/time metadata, a tamper-evident checksum and access controls limiting modifications to the company secretary. Originals can be retained or securely destroyed following documented procedures, provided electronic copies remain reliable and accessible for ACRA inspection.
Example 2: GST and tax invoices
GST invoices stored electronically must be legible and indexed for IRAS audits. Implementing search-friendly metadata and immutable storage ensures the company can retrieve supporting documents for GST and IRAS queries via the myTax Portal.
Example 3: Employment records and CPF documentation
HR teams should store employment contracts, CPF contribution records and leave records in a secured cloud folder with restricted access. Retention must comply with MOM and CPF Board expectations and be available for inspection if required.
How a corporate secretary can help
A corporate secretary in Singapore plays a central role in compliance when migrating records to the cloud.
- Advising on statutory record formats and storage obligations under the Companies Act and ACRA.
- Maintaining and certifying statutory registers and ensuring filings via ACRA BizFile+ are supported by accessible records.
- Coordinating with IT and vendors on retention policies, access controls and incident response procedures.
- Supporting accounting, tax and payroll compliance by ensuring relevant records are retrievable for IRAS, CPF and payroll audits.
Raffles Corporate Services can assist with filings, compliance, accounting, tax and payroll support to help ensure a smooth transition and ongoing compliance.
Frequently Asked Questions
Can I destroy original paper copies after digitising them?
Where electronic copies are reliable, legible and tamper-evident, the Companies Act and IRAS generally permit destruction of originals in accordance with internal policies and retention schedules. However, ensure you maintain audit trails and confirm any sector-specific requirements before destruction.
Will IRAS accept scanned invoices for GST purposes?
IRAS accepts electronic records provided they are accurate, complete and can be produced in a readable format on request. Maintain adequate metadata and ensure the integrity of scanned records for GST audits via the myTax Portal.
Does storing personal data in overseas cloud servers breach the PDPA?
Cross-border transfers are permitted under the PDPA if organisations ensure comparable protection of personal data. Implement contractual safeguards, perform transfer risk assessments and document measures taken to protect personal data.
What should I do if ACRA or IRAS requests original documents?
If authorities request originals, provide certified electronic copies and, if necessary, arrange secure retrieval of originals. Retain documentation demonstrating the integrity of electronic copies, such as checksums or digital signatures.
Key takeaways
- Moving from paper to cloud can improve accessibility and efficiency but requires careful planning and controls.
- Ensure compliance with the Companies Act, ACRA, IRAS and PDPA when digitising and storing records.
- Implement security, audit trails and retention policies aligned with statutory requirements and business needs.
- Test retrieval and inspection processes and provide training to staff responsible for records management.
- Engage corporate secretarial and compliance professionals to support filings, governance and ongoing obligations.
Requirements may change, so always check the latest guidance from ACRA, IRAS or MOM, or consult a professional adviser.
If you would like to find out more about how Raffles Corporate Services can assist with your company’s compliance and corporate secretarial requirements, please get in touch with the team at [email protected].
Yours sincerely,
The editorial team at Raffles Corporate Services
Disclaimer: This does not constitute legal advice. If you require legal advice, please contact a lawyer.