M&A Compliance Under Singapore PDPA Personal Data Protection

During corporate due diligence in Singapore, target businesses must share immense amounts of historical records. Often, this documentation includes customer agreements, employee contracts, and billing databases. This triggers significant compliance demands under the Singapore Personal Data Protection Act (PDPA) managed by the Personal Data Protection Commission (PDPC).

Under PDPA regulations, personal data cannot be shared freely without consent, unless a specific legal exception applies. Fortunately, the PDPA contains provision for "business asset transactions" (BAT exceptions), allowing corporations to share personal data to evaluate prospective business mergers and acquisitions.

Strict Limits on the BAT Exception

The BAT exception is highly useful, but it comes with strict boundaries. The data shared must be strictly necessary for the buying party to evaluate and conclude the transaction. For example:

• Anonymize First: Before sharing full staff payroll lists, strip names and use anonymized structural labels like "Lead Engineer 1" or "Marketing Manager 2."
• Redact Sensitive Customer Data: Customer contact phone numbers, emails, and home addresses should remain redacted unless they are legally critical to verifying the customer contract values.
• Restrict Download Capabilities: Keep sensitive document files read-only inside secure, watermarked virtual data rooms (VDR) rather than allowing bulk downloads to unmonitored hard drives.

After the Deal Concludes

If the acquisition goes through, the acquiring company must notify the affected individuals that their data has been transferred under a business asset transaction. If the transaction collapses, the prospective buyer must safely destroy or return all personal data gathered during due diligence.