If a customer asks your company to send their records to a rival provider, identify the request before promising or refusing a transfer. A personal-data access request, a contractual data export and a voluntary migration service are different matters. The customer’s wording may raise more than one of them, and the company should review each on its proper basis.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
As at 15 October 2026, the PDPC’s obligations guidance states that the data portability obligation takes effect when regulations are issued. The current operative PDPA should be checked alongside that guidance. Do not present a proposed portability framework as an unconditional current right to transfer every company record.
Separate the three questions
| Request | What to examine |
|---|---|
| Access to personal data | The individual’s rights, scope and applicable exceptions |
| An export promised in the service contract | The agreement, data scope, format and authorised requester |
| A voluntary migration to a new provider | Authority, lawful disclosure, security and agreed work |
A commercial disagreement about an export fee does not dispose of a separate statutory access question. Equally, an access right does not automatically settle every technical migration obligation.
Identify the requester and receiving organisation
Verify the customer’s identity and any agent’s authority. If the request is made by a company, establish who can instruct on its behalf and which records are covered by the agreement. Confirm the actual recipient through an appropriate channel; a new email address supplied in the request should not be accepted unquestioningly.
If personal data is involved, review the applicable basis for disclosure and any overseas handling. An instruction to “send everything to my new consultant” may be too broad to act on without clarification.
Define the data bundle before producing it
List the records the customer seeks and identify third-party personal information, confidential company material and items requiring legal review. Distinguish customer-provided information from internal working files and advice. Do not infer that every document in a folder belongs in the transfer simply because it relates to the account.
For a contractual export, confirm the promised format and scope rather than inventing a new deliverable. For voluntary additional work, agree the task clearly without obscuring any separate legal obligation.
Example: a service account and internal notes
A customer moving providers asks for their transaction history and all internal discussions about their account. The company should assess the transaction records and the request for personal data on the applicable basis, while reviewing internal discussions and other people’s information separately. A one-click full-folder export can bypass those distinctions.
Plan a secure delivery and handover
- Confirm the approved recipient and transfer channel.
- Check the scope against the reviewed bundle.
- Use appropriate access controls and avoid unrelated attachments.
- Record what was supplied and when.
- Explain genuine format or scope limitations accurately.
Do not delete the company’s own required records merely because an export has been delivered. Review retention and account closure separately, including any ongoing legal or business purpose.
Explain the outcome without overstating the law
Tell the customer which part of the request is being addressed, what clarification is needed and the basis for any disputed issue. Seek advice where access rights, contract terms and third-party information conflict. Avoid statements such as “portability means we must send everything” or “you are leaving, so you have no data rights”.
Must the company build a system integration for the rival?
Identify any actual legal or contractual requirement. A request for records is not automatically a commitment to build a new integration.
Can we ignore a request because it is called portability?
No label should replace an assessment of the substance. It may contain a valid access request or another matter requiring a response.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.