Executive summary
3
sentences a scope needs on data: where it is processed, where it is stored and who can access it
0
copies of client data that must leave the premises for a remote engineer to do the work
Key conclusions
- A delivery team spread across several jurisdictions becomes a data-handling problem only when nobody has written down where the data goes.
- The contract should state, in plain words, the three facts a procurement reader needs: where data is processed, where it is stored and who has access.
- Remote engineers work inside the client's environment. Any copy that must leave the premises is written into the scope as a specific event.
Our team is around fifteen people across Singapore, India, Indonesia, Hong Kong and Guangzhou. We publish this on our website because it is true, and because a buyer has a right to know who will do the work. It also raises the first question a government or critical-infrastructure client will ask: where exactly does our data go?
That is the right question, and a phone call is the wrong place to answer it. The answer belongs in the scope document. There, people who were not on the call can read it, the client can check the delivery against it, and the client can produce it when an auditor asks.
The question is where data is processed, where it is stored and who can access it
Under Singapore's Personal Data Protection Act (PDPA), the Transfer Limitation Obligation requires an organisation that moves personal data out of the country to ensure the data receives a standard of protection comparable to the Act's. Public-sector bodies have their own sets of instructions on top of that. A critical-infrastructure operator will usually also have its own contractual obligations, which pass down to every vendor.
An integrator's trustworthiness satisfies none of these requirements. Three facts do, once they are written down and then kept true: where the data is processed, where it is stored and who can access it. The security controls, access logs and retention rules all depend on those three facts.
A scope clause answers the data question in terms an auditor can check
| What a proposal usually says | What a scope clause says |
|---|---|
| We take data security very seriously | Client data is processed on the client's premises and stored by the client |
| Our offshore teams are fully vetted | Anything the integrator hosts is in Singapore-hosted environments only |
| Access is on a need-to-know basis | Named roles, the environment they reach it through, and the log that records it |
| We comply with the PDPA | No copy of client data leaves the premises unless this scope names the copy, the reason and the destination |
Engineers can work remotely while the data stays on the client's premises
In practice, the data stays where it is and the engineer is given controlled access to it. A software engineer in India working on a warehouse integration reaches the system through the client's own environment. The client's own access controls apply, and the client's own logs record what the engineer touched. The engineer works on the client's system, and no extract of the client's records sits on a laptop in another country.
Development and testing use synthetic data, or a client-approved subset that the scope names. Sometimes a real copy has to exist, for example for a migration, a one-off analysis or an audit sample. In that case the scope records it as a specific event, with a destination and an end date.
We scope our own engagements this way. That is why our site states the team's locations and the data's location as two separate facts.
Write five items about data into the scope
- Processing location, stated as a place: on the client's premises, or a named hosted environment in a named jurisdiction.
- Storage location and custodian: who holds the authoritative copy, and where.
- Access: which roles have it, through which environment, where access is logged, and whether any engineer outside Singapore is included.
- Exceptions, listed one by one: any copy that will leave the premises, the reason, the destination and the date it will be deleted.
- Retention and deletion at the end of the engagement, including the integrator's own working copies and backups.
If an integrator cannot write those five items, it has not yet decided how it will do the work. Find this out before you sign the contract.
