Singapore Contract, Offshore Software Delivery: Entity, Law, SGD and PDPA Checks

If your software vendor signs through a Singapore company but the engineers sit offshore, the Singapore contract only protects you when five things line up: who actually signs and carries the risk, which law and forum settle disputes, how the SGD invoice is taxed, who owns the code each offshore developer writes, and how personal data leaves Singapore. A Singapore signature does not move your PDPA duties to the vendor. You stay responsible for overseas transfers.

This guide covers the offshore software development Singapore contract you are about to sign: what to check, what evidence to ask for, and when to pause. Educational only, not legal or tax advice. Have your counsel and tax adviser confirm anything that changes your position.

Who this is for, and who should skip it

For: Singapore finance, operations and product leads, procurement teams and in-house counsel buying custom software from a vendor with a Singapore entity on the paperwork and delivery capacity in another country.

Skip if: you are still choosing delivery geography (see our Philippines vs India comparison for Singapore buyers); you need clause wording for data processing roles (use PDPA vs NPC data processing clauses); or you are scoring several vendors (use the vendor scorecard). This article does one job: making the contract match where the work is really done.

The short answer: a Singapore signature is a wrapper, not a delivery model

A common structure: a Singapore private limited company holds the client contract, invoices in SGD and manages the account, while an affiliate or subcontractor overseas does most of the engineering. That is legitimate and often works well. The risk is a gap between paper and reality. Five checks close it:

• Entity: the signing company is live and accountable for the offshore work, not just a billing address.
• Law and forum: Singapore law governs, and the dispute route can be enforced where the vendor’s assets are.
• Money: price, currency, GST and any withholding tax are settled before the first invoice.
• IP chain: every person writing code has assigned their rights up the chain to you.
• Personal data: overseas access meets the PDPA Transfer Limitation Obligation, with named countries and a working breach-notice path.

Original element: the contract-to-delivery alignment matrix

Run this in a 60-minute pre-signature call with the vendor’s account lead and delivery lead together. Ask for the evidence in each row. If you cannot get it, negotiate the red flag.

Check	Question to ask	Evidence to request	Red flag	Sign-off
Contracting entity	Which entity signs, employs the delivery lead, and holds the insurance?	Bizfile Business Profile; insurance certificate naming the signing entity	No staff or insurance of its own	Procurement
Subcontracting	Which offshore entity does the engineering?	Named subcontractor clause; your consent for changes	“Affiliates and partners” with no names	Procurement, counsel
Law, forum, enforcement	Which law governs, where are disputes decided, and can we enforce where assets sit?	Singapore law clause; named court or Singapore-seated arbitration; counsel’s enforcement note	Delivery-country law, or silence	Counsel
SGD price and FX	Is the price fixed in SGD? Who carries currency moves?	SGD rate card; banded FX clause or none	Open-ended re-pricing on FX moves	Finance
GST and withholding	Who charges GST? Will any work happen in Singapore?	GST registration check; planned on-site days	On-site work planned, tax not discussed	Finance, tax adviser
IP assignment chain	Have all offshore developers and freelancers assigned their rights?	Template staff and contractor IP clauses	“Staff contracts are confidential”, no summary	Counsel
PDPA transfer and breach	Which countries access our personal data? How fast do we hear of a breach?	Countries listed; transfer mechanism; notice window and contacts	“Processed wherever our team is”	DPO
Exit	What do we receive, and from which entity, if we end the contract?	Handover list; escrow or repo access	Code held only in offshore accounts	Product owner

Check 1: the contracting entity is real and accountable

Start with the public record. ACRA lets anyone buy a Business Profile through Bizfile. Check registration status and the people behind the company, and compare them with what the proposal claims about headcount.

Then ask: does the Singapore entity employ the delivery lead, or only sales staff? Does its insurance cover the offshore affiliate’s work? The contract should name the offshore company, keep the Singapore entity fully liable for it, and require your written consent before work moves elsewhere. If the Singapore entity is thin, ask for a parent-company guarantee.

Check 2: governing law and a dispute route you can enforce

Most vendors with a Singapore entity accept Singapore law. The harder question is enforcement: a Singapore court judgment is easiest to use against assets in Singapore. If the money and people are elsewhere, ask counsel how it would be recognised in the delivery country.

That is why many cross-border technology contracts choose arbitration seated in Singapore. Singapore and the Philippines are both contracting states to the New York Convention on foreign arbitral awards, per the UNCITRAL status table, giving an award a recognised enforcement route in either country, subject to the convention’s limited refusal grounds. Arbitration has its own cost, so pair it with an escalation ladder (delivery leads, executives, mediation) so most disputes never reach a tribunal.

Check 3: SGD invoicing, GST and withholding tax

Price and currency. If the vendor’s costs are in another currency, it carries FX risk on an SGD price and may want an adjustment clause. For multi-year retainers that can be fair, but give it a band, a reference rate and a review date. Agree who pays bank charges so invoices reconcile. Our guide to Singapore software pricing models in SGD shows how pricing structure shifts this risk.

GST. A GST-registered Singapore entity charges GST at the current 9% rate; confirm status on IRAS’s GST registered business search. If you contract directly with the overseas entity, IRAS’s reverse charge rules require a GST-registered business that is not entitled to full input tax claims to account for GST on imported services itself.

Withholding tax. This applies to payments to non-residents, so it matters mainly if you contract directly with the offshore entity. IRAS’s withholding tax guidance says services delivered electronically from overseas, without staff sent to Singapore, are rendered outside Singapore and not subject to withholding tax; fees for work done in Singapore can be. If offshore engineers will fly in for workshops or on-site UAT, ask your tax adviser before you sign.

Check 4: the IP chain from each developer to you

Under Singapore’s Copyright Act 2021, creators are the default owners of commissioned content, and employers own works employees create in the course of employment, per the IPOS factsheet for businesses. Both defaults can be changed in writing, which is what you need.

Offshore delivery adds links: developer, delivery entity, Singapore contracting entity, you. The delivery entity’s staff contracts follow its own country’s law, and freelancers are the usual weak link. Ask for its template IP clauses, a warranty that every contributor has assigned their rights, and assignment to you on payment. Keep the vendor’s pre-existing tools as a written licence. If the code is operationally critical, add our software escrow guide to the review.

Check 5: PDPA Transfer Limitation Obligation and breach notice

This is the check buyers most often get wrong. Section 26 of the PDPA restricts transfers of personal data outside Singapore. PDPC’s Advisory Guidelines on Key Concepts say that when you engage a data intermediary, you remain responsible for the Transfer Limitation Obligation, whether you send data overseas or your Singapore vendor does so while processing for you.

Under the Personal Data Protection Regulations 2021, the overseas recipient must be bound by legally enforceable obligations giving protection at least comparable to the PDPA: through law, a contract that also names the countries the data may go to, binding corporate rules for related companies, or another binding instrument. A recognised APEC CBPR or PRP certification also counts. PDPC recognises the ASEAN Model Contractual Clauses as one route; its guide to cross-border data transfers covers the options.

On breaches, a data intermediary must notify you without undue delay once it has credible grounds to believe one occurred (section 26C of the PDPA, as explained in PDPC’s Key Concepts guidelines). If the breach is notifiable, PDPC expects you to notify it within three calendar days. The offshore team’s notice time is part of your clock, so contract a specific window and named contacts, then test them in a tabletop.

Controls that make this real: masked data outside production, named and logged production access, and the countries recorded in your data inventory. Our PDPA-by-design checklist covers the build side. MAS-regulated? MAS’s Guidelines on Outsourcing (Banks; other FIs) may also apply, so involve your outsourcing and technology risk teams before signature.

Worked example: a Singapore logistics SME

Illustrative figures, not a quote. A Singapore logistics SME agrees a S$180,000 fixed fee for a dispatch and proof-of-delivery platform. The vendor is a Singapore private limited company; a related Manila company does most of the engineering, and two of its engineers will fly in for ten days of on-site UAT.

• Entity: the buyer checks the Bizfile profile and insurance certificate. The contract names the Manila affiliate as approved subcontractor and keeps the Singapore entity fully liable.
• Law and forum: Singapore law; Singapore-seated arbitration after a 30-day executive escalation.
• Tax: the vendor is GST-registered, so 9% GST adds S$16,200. The buyer pays a Singapore-resident company, so withholding on the UAT trip is not the buyer’s issue; contracting with the Manila company directly would have needed a tax check first.
• IP: the vendor shares its template staff IP clauses and warrants all contributors have assigned rights. Its deployment tooling stays its own, under a written perpetual licence.
• PDPA: Manila engineers will see driver and customer contact data in support. The contract lists Singapore and the Philippines only, uses ASEAN MCC-based transfer clauses, requires masked data outside production, and sets a 24-hour suspected-breach notice (a negotiated term, not a legal one).

Same commercial deal, but every matrix row now has evidence behind it, for roughly two meetings and one round of mark-ups.

Decision framework: which contracting structure fits you

1. Singapore entity signs and delivers with offshore staff it controls: simplest for most SMEs. Focus on the IP and PDPA rows.
2. Singapore entity signs, offshore affiliate subcontracted: the most common. Insist on the named subcontractor, full liability, and PDPA and IP flow-down.
3. Direct contract with the offshore entity: suits large buyers with in-house counsel and tax teams. Expect reverse charge GST, possible withholding on on-site work, and harder enforcement.
4. Any matrix row still without evidence after two requests: pause signature.

Common mistakes

• Assuming a Singapore entity means Singapore delivery. Ask where each named role sits.
• Treating the PDPA transfer duty as the vendor’s problem. PDPC guidance keeps it with you.
• Leaving the contract silent on countries. Contract-based transfers must name them.
• Planning on-site UAT with a non-resident vendor without a tax conversation.
• Accepting “IP transfers on payment” without evidence offshore contributors assigned it first.

If the commercial model is project outsourcing rather than a dedicated centre, compare software outsourcing in Singapore. For the site decision itself, see Philippines vs Vietnam vs Singapore core.

FAQ

Does signing with a Singapore company mean PDPA transfer rules no longer apply?

No. PDPC’s guidance keeps the Transfer Limitation Obligation with your organisation even when your Singapore data intermediary moves the data overseas.

Do I have to use the ASEAN Model Contractual Clauses?

No. PDPC recognises them, but they are voluntary. Your own clauses work if they meet PDPA requirements, including naming the countries.

Will I pay withholding tax on an offshore development team?

Usually not if you pay a Singapore-resident company. Paying a non-resident directly, services delivered electronically from overseas fall outside Singapore, but work performed in Singapore can attract withholding tax. Confirm with your tax adviser.

Is arbitration always better than Singapore courts?

No. It helps when assets sit in another New York Convention state, but adds cost. Decide by where enforcement would actually happen.

What to do next

Put the alignment matrix on your next vendor call and ask for the evidence row by row. For a delivery partner that can show its Singapore contracting entity, offshore set-up and PDPA transfer position in writing, see our custom software services for Singapore, offshore development centre for Singapore teams, dedicated development teams and engagement models, or contact us. Keep the SOW red flags guide beside this checklist when you mark up the contract.