Before moving CRM support to an overseas team, map what the team can see, which organisation provides the service and where data may be accessed or copied. The change can affect personal-data handling even if the company keeps the same software subscription. Review the arrangement before access is enabled, rather than discovering the new data flow during a later incident.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The PDPA’s transfer provisions and PDPC guidance require attention to the applicable conditions for overseas transfers and comparable protection. Determine how the rules apply to the actual service and any relevant exceptions.
Distinguish hosting from support access
A CRM’s stated hosting location does not answer who can access customer records for troubleshooting. Ask whether the overseas support team can view records, take screenshots, download attachments or copy data into a ticketing system. Identify any support log or diagnostic file containing personal information.
Describe the flow from the company’s user account to each recipient or system. A general statement that “the data stays in our CRM” may overlook what happens in the support process.
Identify the party behind the support team
Is the support team employed by the contracted vendor, another group company or a subcontractor? Check the legal recipient and the instructions governing its work. A shared brand name does not remove the need to understand the arrangement.
Obtain the relevant service and data-handling terms, including the circumstances in which further providers may become involved. Record who is responsible for monitoring changes in the vendor’s support model.
Review the safeguards against the task
- Limit the support team’s access to the records necessary for the ticket.
- Use authorised accounts and a controlled access route.
- Specify how copied data, attachments and support logs are handled.
- Review incident escalation, onward disclosure and subcontracting.
- Check return, retention and deletion arrangements when support ends.
These are practical issues to evaluate with the applicable transfer requirements and agreement. A clause is useful only if it covers the service being supplied and is supported by workable controls.
Example: an attachment moves into the support ticket
A user uploads a customer document to illustrate a CRM error. The overseas support team receives it in a separate ticketing platform, although the CRM itself is hosted locally. The company should account for the attachment’s new location, access and retention rather than considering only the main database.
Test the arrangement before wider rollout
Use a non-sensitive test case to confirm the process, permissions and escalation route. Do not use a live customer file as demonstration material merely because it is available. Where real records are necessary for support, ensure the responsible person has reviewed the proposed handling.
Update the company’s data inventory and relevant procedures so staff know which route to use. Consider whether notices, consent or other requirements need attention; do not assume that a technical approval resolves every legal question.
Keep a change record
Document the previous arrangement, the new recipients and locations, the terms and controls reviewed and the date access was enabled. Keep an owner for later vendor changes. If facts remain unclear, obtain clarification or advice before treating the migration as approved.
Is remote viewing different from a database export?
The activities differ operationally, but both need an assessment of the actual personal-data handling and applicable requirements. Do not dismiss remote access as legally irrelevant.
Does encryption settle the transfer question?
Encryption can be an important safeguard, but assess the full arrangement, including recipients, permitted uses and the relevant legal conditions.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.