The Singapore Law Gazette

The Deal Room as a Data Export

What Singapore Lawyers Should Know When Advising on the Acquisition of a PRC Business

A Singapore buyer may encounter PRC data regulation before it acquires a single share. Uploading target records to an offshore virtual data room or permitting access from Singapore to systems hosted in China can amount to a data export. This article explains how Singapore transaction counsel can identify that issue early, structure proportionate due diligence, translate findings into the acquisition agreement and plan for post-completion access and integration.

This article states the law and regulatory materials available as at 21 August 2026.

Introduction: The Export May Happen Before Signing

A Singapore buyer evaluating a PRC target opens a data room of employee lists, customer contracts, complaints, sales records, incident reports and system extracts to its Singapore deal team, advisers and W&I insurer. No database changes hands. Yet personal information may leave China, or become accessible from outside it, before the first SPA draft.

Under PRC law, cross-border data transfer includes the transfer of data collected within the territory to overseas servers, as well as scenarios where data is stored domestically but can be accessed remotely by overseas organisations or individuals. CAC guidance treats data queried, downloaded or exported from overseas as an export, even if it stays in China.¹Personal Information Protection Law of the People’s Republic of China (PIPL), arts 4-6 and 55; Cyberspace Administration of China (CAC), Data Export Security Management Policy Q&A (October 2025), Q5 (confirming that overseas querying, retrieval, downloading or exporting of data stored in China is a data export where the access or call occurs overseas), https://www.cac.gov.cn/2025-10/31/c_1763633376984070.htm.

Data compliance shapes how diligence is run, not just what it finds. Build the questions into the data room protocol before access opens.

1. Start with the Data, Not the Document Request List

A conventional legal due diligence request list is usually organised by subject matter: corporate records, material contracts, employment, disputes, compliance and intellectual property. For a PRC target, counsel should add a preliminary data-screening exercise across those workstreams. The purpose is to identify which material can be disclosed conventionally, which requires safeguards, and which should not leave China without further analysis.

Personal Information and Sensitive Personal Information

The Personal Information Protection Law (“PIPL”) defines personal information as recorded information relating to an identified or identifiable natural person, excluding anonymised information. De-identification alone does not take information outside the PIPL if a person can still be identified with additional information. Common transaction materials therefore present obvious risks: employee registers, payroll and social insurance records, customer contact details, individual supplier records, litigation files, whistleblowing reports and user-level datasets.

Some of those records may contain sensitive personal information, including biometric, religious, specific identity, medical and health, financial account and location information, as well as information concerning minors under 14. Sensitive personal information attracts heightened requirements, including specific purpose, sufficient necessity, strict protective measures and, where consent is the basis, separate consent.²PIPL, arts 28-30

The threshold question is not simply whether the buyer would find the record helpful. The target must have a lawful basis to process and disclose it for diligence. Consent may be available in some cases, and another statutory basis may apply on the particular facts, but transaction necessity is not itself a freestanding legal basis.³PIPL, art 13. Compare Singapore’s Personal Data Protection Act 2012 (PDPA), First Schedule, Part 4.

Important Data and Sector-Specific Restrictions

Personal information is only one part of the analysis. A target may hold operational, industrial, mapping, mobility, healthcare, financial, communications or other datasets capable of being classified as important data. Under the 2024 Provisions on Facilitating and Regulating Cross-Border Data Flows (“2024 Provisions”), a data processor is not required to submit data for a security assessment as important data unless the relevant authority or region has notified it, or the data has been publicly identified, as important data. That clarification is helpful, but it should not be read as permission to ignore applicable sectoral catalogues, regulatory communications or an existing classification made known to the target.⁴CAC Provisions on Facilitating and Regulating Cross-Border Data Flows 2024 (2024 Provisions), art 2, https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm.

The Network Data Security Management Regulations, effective from 1 January 2025, add governance and risk-assessment requirements for handlers of important data. Among other matters, important data handlers must identify responsible personnel, assess risk before providing, entrusting or jointly processing important data, and undertake annual risk assessments. A merger, division, dissolution or bankruptcy that may affect important data security can also require reporting of the data disposal plan and recipient details to the competent authority.⁵PRC Network Data Security Management Regulations, arts 29-33, effective 1 January 2025, https://www.cac.gov.cn/2024-09/30/c_1729384452307680.htm.

Cybersecurity Obligations Are Part of the Asset Being Acquired

The inquiry should also cover the target’s networks and systems. The amended PRC Cybersecurity Law requires network operators to comply with the multi-level protection scheme and to maintain internal controls, technical measures, logs, classification, backup and encryption appropriate to the system. The Network Data Security Management Regulations similarly require access controls, authentication, encryption, backup and incident response. A buyer that focuses only on privacy notices and consents may therefore miss a more substantial operational exposure: an under-classified system, unremediated vulnerabilities, absent incident records or inadequate access management.⁶PRC Cybersecurity Law, as amended with effect from 1 January 2026, arts 23 and 27; Network Data Security Management Regulations, arts 9-11.

2. Determine Whether the Diligence Exercise Uses a Regulated Export Route

The PIPL requires an exporter of personal information to meet an applicable outbound-transfer condition and to take measures ensuring that the overseas recipient’s handling reaches the PIPL standard. The available mechanisms include a CAC security assessment, personal information protection certification and the PRC standard contract. The 2024 Provisions recalibrated the thresholds and introduced exemptions, but did not remove the underlying duties of lawfulness, necessity, transparency, security and impact assessment.

The Current Threshold Framework

Subject to applicable exemptions and sector-specific rules, the principal thresholds under the 2024 Provisions can be summarised as follows:

1. A critical information infrastructure operator exporting personal information or important data must apply for a CAC security assessment.
2. A non-critical information infrastructure operator exporting important data, at least one million individuals’ non-sensitive personal information, or at least 10,000 individuals’ sensitive personal information from 1 January of the relevant year must apply for a security assessment.
3. A non-critical information infrastructure operator exporting at least 100,000 but fewer than one million individuals’ non-sensitive personal information, or fewer than 10,000 individuals’ sensitive personal information, must generally use the PRC standard contract or certification route.
4. A non-critical information infrastructure operator exporting fewer than 100,000 individuals’ non-sensitive personal information from 1 January of the relevant year is exempt from the three procedural mechanisms, provided the data does not include important data.

Other exemptions address specified circumstances, including data collected overseas and merely transiting China, necessary for the performance of contracts to which the individual is a party, qualifying cross-border human resources management and emergencies. A buyer should not assume that due diligence falls within them. In particular, the individual-contract exception refers to a contract with the individual, not the acquisition agreement between buyer and seller; and the human-resources exception is directed at necessary cross-border HR management under lawfully formulated employment rules or a collective contract, rather than a general review of employee records by a prospective acquirer.⁷2024 Provisions, arts 5, 7 and 8.

Duties That Survive the Exemption

The procedural threshold is often where transaction teams stop their analysis. That is unsafe. Article 10 of the 2024 Provisions expressly preserves duties to notify individuals, obtain separate consent where required and conduct a personal information protection impact assessment. The PIPL requires such an assessment before exporting personal information and before entrusting processing or providing personal information to another handler. The assessment should address legality, necessity, proportionality, risks to individuals and whether protective measures are effective.⁸2024 Provisions, art 10; PIPL, arts 39 and 55-56.

In transaction terms, a target may therefore be below the filing threshold but still unable to justify giving the buyer an unrestricted copy of a customer or employee dataset. Threshold analysis determines the route; it does not answer whether the disclosure should occur at all.

3. Design the Due Diligence Process Before Opening Access

A proportionate protocol can preserve deal momentum without treating every document as prohibited. The exercise should be risk-based and staged.

Map the Proposed Disclosure

Before access is granted, the target and its PRC advisers should work through the same mapping questions collected in the checklist at section 8 (data categories and volumes, their classification, hosting and access locations, each recipient, the target’s lawful basis and impact-assessment status, and the applicable export mechanism or exemption) and record the answers.

Use Staged and Minimised Disclosure

The first diligence round rarely requires raw datasets. Headcount by function, compensation ranges, customer concentration, claims summaries and incident chronologies can often answer the commercial question without identifying individuals. Where individual-level review is necessary, the parties can move progressively from anonymised or redacted summaries to a limited sample, then to controlled review by a clean team. Truly anonymised data falls outside the PIPL, but masking names alone may not achieve anonymisation where the person remains identifiable from role, location, account or other attributes.

Other controls include disabling bulk download, limiting access to named reviewers, applying view-only permissions, watermarking, maintaining access logs, segregating highly sensitive folders and setting automatic expiry. For the most sensitive material, physical or virtual review from within China may be appropriate. These measures do not create a lawful basis by themselves, but they help demonstrate necessity, minimisation and security and may materially reduce the data that crosses the border.

Contract for the Actual Roles and Flows

A conventional data protection agreement should be supplemented where personal information is disclosed. The parties should identify the target as the relevant PRC personal information handler, the capacity in which the buyer receives the information, and the role of the data room provider and advisers. The PIPL distinguishes between a handler that determines purpose and method, an entrusted party processing on instructions, and handlers that jointly determine processing. Those categories do not map perfectly onto the Singapore concepts of organisation and data intermediary, or the UK and EU GDPR labels of controller and processor. A contract should describe the real processing rather than rely on a label imported from another jurisdiction.⁹PIPL, arts 20-23; PDPA, s 2(1) (definition of “data intermediary”).

At minimum, the transaction protocol should address permitted purpose, authorised users, access location, security measures, onward disclosure, incident notification, assistance with rights requests, retention, return and deletion. If the PRC standard contract filing is required, a bespoke NDA or ASEAN Model Contractual Clauses cannot replace it. Conversely, signing the PRC standard contract should not be treated as a substitute for the buyer’s own Singapore-law assessment of its collection, security and any onward transfer.

4. What Singapore Counsel Should Ask in Substantive Diligence

Once the process is controlled, substantive diligence should test both compliance and operational resilience. The following areas commonly reveal whether the issue is documentary, remediable or fundamental to the target’s business model.

Governance and Records

1. Data maps and inventories, classification policies, retention schedules and records of processing;
2. The appointment and reporting of the personal information protection officer and network data security personnel, where applicable;
3. Personal information protection impact assessments, important-data risk assessments and compliance audit reports; and
4. Multi-level protection scheme classification, filings, testing and rectification records for material systems.

The Personal Information Protection Compliance Audit Measures, effective from 1 May 2025, require handlers processing 10 million or more individuals’ personal information to conduct an audit at least once every two years and permit regulators to require professional audits in specified high-risk or incident scenarios. Handlers processing at least one million individuals’ information must appoint a personal information protection officer responsible for the audit work. Missing audits or appointments may therefore be more than a matter of best practice.¹⁰CAC Personal Information Protection Compliance Audit Measures, arts 4, 5 and 12, effective 1 May 2025, https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm; CAC, Personal Information Protection Policy and Regulatory Q&A (April 2026), Q2.

Collection, Use and Disclosure

1. Privacy notices, consent language and other claimed legal bases for major customer, employee and user datasets;
2. Separate consent and enhanced notices for sensitive personal information, disclosure to other handlers and overseas transfers;
3. Mechanisms for access, correction, deletion, withdrawal and other individual rights; and
4. Whether actual processing, including analytics, profiling and marketing, matches the disclosed purposes.

Third Parties, Cloud and Cross-Border Flows

1. Cloud, SaaS, payroll, CRM, analytics and other vendors, including subcontracting and data locations;
2. Intra-group access by an offshore parent or regional headquarters;
3. PRC standard contracts, filings, certifications, CAC assessments and transfer impact assessments; and
4. Whether the actual recipients, systems, purposes and volumes remain within the filed or assessed scope.

This last point is easily missed. CAC guidance indicates that changes affecting the purpose, method, scope, recipient, retention period or actual control may require a new assessment or an updated standard contract and filing. An acquisition itself can therefore affect an existing export arrangement even where the same PRC legal entity continues to operate the system.¹¹CAC Data Export Security Management Policy Q&A (October 2025), Q6-Q8; CAC Measures for Security Assessment of Data Exports, art 14.

Incidents and Regulatory Exposure

1. Security incidents, ransomware, unauthorised access, data loss and near misses, not merely incidents formally notified to regulators;
2. Regulatory inquiries, complaints, litigation and requests by individuals;
3. Penetration tests, vulnerability reports, incident response plans and evidence of remediation; and
4. Cyber insurance coverage, exclusions, notification requirements and prior claims.

5. Protection and Onward Transfers

The Singapore buyer should apply reasonable security arrangements from the moment it receives personal data. The ASEAN Model Contractual Clauses can assist with Singapore compliance, but they do not replace the PRC standard contract or a CAC security assessment for a China-origin export.¹²PDPA, s 26; Personal Data Protection Regulations 2021, Part 3; Personal Data Protection Commission, Guide to Cross-Border Data Transfers (updated 14 April 2026), https://www.pdpc.gov.sg/organisations/resources/guidance-by-topic/guide-to-cross-border-data-transfers; CAC Measures on the Standard Contract for Cross-Border Transfers of Personal Information 2023.

The buyer should also consider sector-specific Singapore duties. Banking secrecy, healthcare confidentiality, professional duties, contractual restrictions and legal privilege may constrain disclosure independently of the Personal Data Protection Act 2012. A data protocol should not be treated as overriding those obligations.

6. Integration Raises Fresh Export Questions

How Deal Structure Changes the Position

In a share acquisition, the target stays the same legal entity and personal information handler, so the share transfer does not itself move its database to the Singapore parent. But new parent access, offshore reporting, system migration and centralised analytics are separate processing and export events needing their own analysis, and a change in actual control can affect an existing CAC assessment if it alters the risk profile.

An asset transfer or statutory merger moves personal information more directly. Article 22 of the PIPL requires notice of the recipient on a merger, division, dissolution or bankruptcy, and the recipient inherits the original handler’s duties; any change in purpose or method needs fresh consent. For important data, the Network Data Security Management Regulations may also require reporting the disposal plan and recipient details. Other asset transfers may engage the rules on provision to another handler and separate consent, depending on the facts.¹³PIPL, arts 22-23; Network Data Security Management Regulations, art 32. The above compliance measures do not exempt the entity from compliance obligations regarding cross-border data transfer. Where cross-border data transfer is involved, it is also necessary to assess whether obligations such as PRC standard contract filings or CAC security assessments are triggered.

Build a Day 1 and Transitional-Services Data Plan

The closing agenda should allocate responsibility for:

1. the systems and datasets to which the buyer will have access on Day 1, from which locations and through which accounts;
2. required notices, consents, impact assessments, standard contracts, filings or approvals;
3. identity and access management, least-privilege permissions, logging, encryption and incident escalation;
4. data retained by the seller, including backups, archives and records required for defence of claims or legal retention;
5. separation, migration, validation, return and deletion milestones; and
6. responsibility for individual requests, complaints, investigations and incidents spanning the pre- and post-completion periods.

A transitional services agreement should state more than that each party will comply with data protection law. It should describe the data, purpose, systems, locations, roles, security measures, subcontractors, assistance obligations, incident deadlines, audit rights and exit steps. The data schedule should align with the separation plan and the acquisition agreement’s risk allocation.

7. A Checklist Before the PRC Data Room Opens

1. What categories of personal information, sensitive personal information, important data and sector-regulated data will the requested materials contain?
2. Where are the source systems and data room hosted, and from which countries will reviewers access, download or print the material?
3. Who will receive access, including affiliates, advisers, lenders and insurers, and does each recipient need the same level of information?
4. What lawful basis permits the target to disclose the information for due diligence, and have required notices and separate consents been addressed?
5. Is a personal information protection impact assessment required and, if so, has it been completed for the actual diligence flow?
6. Does an exemption apply, or is a PRC standard contract, certification or CAC security assessment required?
7. What technical controls will govern access, downloading, onward disclosure, logs, expiry, return and deletion?
8. What will change at signing, completion and integration, including the target’s control, recipients, systems, purposes and retention periods?

Conclusion

For a Singapore buyer, PRC data risk begins earlier than many transaction timetables assume. The first regulated event may be the buyer’s access to the target’s records, not the post-completion migration of a database. Treating the data room as part of the transaction structure allows counsel to preserve confidentiality, avoid unnecessary exports and obtain the evidence needed to assess the business.

Effective practice lies between prohibiting cross-border diligence and papering over it with a generic consent warranty: identify the data, choose the minimum necessary disclosure route, document the roles and safeguards, and carry the result through the SPA and integration plan. That is where Singapore transaction counsel adds particular value: translating a specialist regulatory issue into a workable deal process and an allocation of risk the parties can actually perform.