Digital business in Singapore: overview
A Q&A guide to digital business in Singapore.
The Q&A gives a high level overview of matters relating to regulations and regulatory bodies for doing business online, setting up an online business, electronic contracts and signatures, data retention requirements, security of online transactions and personal data, licensing of domain names, jurisdiction and governing law, advertising, tax, liability for content online, insurance, and proposals for reform.
To compare answers across multiple jurisdictions, visit the Digital Business Country Q&A tool.
This Q&A is part of the global guide to digital business law. For a full list of jurisdictional Q&As visit www.practicallaw.com/digital-business-guide.
The relevant regulations governing the conduct of business online in Singapore are set out in a number of different statutory laws. The following regulations are of particular significance in Singapore:
The Electronic Transactions Act (Cap. 88), which governs the formation and validity of electronic contracts.
The Spam Control Act (Cap. 311A), which imposes certain requirements on bulk commercial messages sent electronically.
The Personal Data Protection Act (No. 26 of 2012), which contains provisions around the use of personal data, including personal data of website users.
The Unfair Contract Terms Act (Cap. 396), which regulates exclusion and limitation of liability clauses in most consumer and standard form contracts.
The Sale of Goods Act (Cap. 393), which governs contracts for the sale of goods in Singapore.
The Singapore Parliament is responsible for passing legislation in this area. The legislation passed by Parliament often empowers government ministers or statutory bodies to make further, more detailed regulations in specific areas of the law.
The main statutory body responsible would be the Infocomm Media Development Authority (IMDA), which was recently established as part of a restructuring of the the Media Development Authority (MDA) and the Infocomm Development Authority (IDA).
Setting up a business online
The most common steps a company must take to set up an existing/new business online are:
Establishing a corporate vehicle for its business operations (for example, a limited liability company and a limited liability partnership).
Appoint a third party contractor to design and develop the website.
Liaise with third parties for the logistics required to fulfil customer orders. For online transactions, the company can set up an online payment system, whether by itself or by engaging a third party payment systems provider.
This depends on the nature of the business, but an online business can typically expect to contract with the following parties:
Third party contractors to develop and host the website.
Content licensors, in order to obtain licences for third party website content.
The starting point is to consider whether the online business has any internal capabilities. If not, it must engage a third party to develop the app. The contract with the app developer must address the intellectual property rights and licences relating to the app, its development, distribution and maintenance.
Once the app has been developed, the online business can distribute the app through its own website, or through an established app store such as those provided by Apple, Google and Microsoft. Users of the app must be governed by an end-user licence agreement. If the app provides for any in-app transactions, an agreement with a third party payment systems provider may be required.
Running a business online
Section 11 of the Electronic Transactions Act expressly provides that contracts can be formed electronically.
The same general rules of contract formation apply to online contracts (that is, offer, acceptance, consideration, intention to create binding legal relations, and certainty of terms.)
There is no "cooling off" period that applies specifically to electronically-formed contracts. However, a consumer can cancel a regulated contract within a five-day cancellation period (Consumer Protection (Fair Trading) (Cancellation of Contracts) Regulations 2009). Contracts regulated by this Act include sales contracts, long-term holiday product contracts, time share contracts or time share related contracts.
In Chwee Kin Keong v Digilandmall.com Pte Ltd, the Singapore Court of Appeal held that the contract was formed when the retailer sent out automated e-mail responses containing the confirmation of purchase. In this case, the offer was made when the purchaser placed an order. This offer was then accepted when the retailer responded with a confirmation of the order. On acceptance, a binding contract was formed (assuming other elements of contract formation are met, that is consideration and intention to create legal relations). This case illustrates clearly that contracts can be formed electronically.
There have been no Singapore cases that have expressly discussed the enforceability of click-wrap, browse-wrap and shrink-wrap contracts. Generally, a click-wrap contract which prompts a purchaser to accept the retailer's terms and conditions before purchase is unlikely to be controversial. There is a clear acceptance of the terms of contract before the agreement.
Generally, the enforceability of a browse-wrap contract will depend on how frequently and prominently the terms are displayed to the purchaser.
A shrink-wrap contract, whereby the product is delivered with terms and conditions attached, is arguably more controversial. As a binding contract has already been made prior to delivery, it is likely that the retailer will be unable to introduce fresh terms into the contract.
See Question 1.
The difference between business-to-consumer and business-to-business contracts are as follows:
The Sale of Goods Act (SGA) applies to any and all contracts for the sale of goods, regardless of whether it is a business-to-consumer or business-to-business contract. However, the SGA does give consumers some consideration over and above that enjoyed by business buyers. For example, the SGA does not allow various implied terms (such as, quality, fitness for purpose and sale) to be excluded against a party dealing as a consumer.
The Unfair Contracts Terms Act (UCTA) recognises the weaker bargaining position of consumers when contracting with businesses, and protects consumers against unreasonable contractual terms.
Under the Consumer Protection (Fair Trading) Act (CPFTA), a consumer who has entered into a consumer transaction involving an unfair practice can bring an action against the supplier, regardless of whether the transaction was concluded online.
The differences between the supply of goods, services and digital products are as follows:
The SGA applies to any and all contracts for the supply of goods (including digital products), but does not apply to supply of services.
The UCTA applies to all contracts.
The CPFTA applies to all consumer contracts.
The contracts that must be signed by hand and cannot be signed electronically are set out in the First Schedule to the Electronic Transactions Act and include:
The creation or execution of a will.
The transfer of any document or instrument that entitles the bearer or beneficiary to claim the delivery of goods or the payment of a sum of money.
The creation, performance or enforcement of an indenture, declaration of trust or power of attorney (with the exception of implied, constructive and resulting trusts).
Any contract for the sale or other disposition of immovable property, or any interest in such property.
The conveyance of immovable property or the transfer of any interest in immovable property.
The data retention requirements in the Personal Data Protection Act (No. 26 of 2012) apply to all contracts and transactions generally and are not specific to online contracts. Section 25 of the Personal Data Protection Act requires organisations to cease retaining documents containing personal data, or remove the means by which the personal data can be associated with particular individuals, as soon as:
The purpose for which that personal data was collected is no longer being served by retention of the personal data.
Retention is no longer necessary for legal or business purposes.
Other data retention requirements also exist for tax and other financial purposes.
E-signatures are recognised in Singapore.
The applicable legislation is section 8 of the Electronic Transactions Act (Cap. 88) (2011 Rev. Ed.), which provides the electronic methods (such as, e-signatures) that can be used by people to indicate their intention with regards to electronic documents.
Definition of e-signatures
A ''signature'' is defined as a method (electronic or otherwise) used to identify a person and to indicate the intention of that person in respect of the information contained in a record.
Format of e-signatures
There is no prescribed format of e-signatures.
Prevalence of e-signatures
E-signatures have become increasingly prevalent in Singapore as more businesses move online due to convenience.
Implications of running a business online
Cyber security/privacy protection/data protection
The Personal Data Protection Act (No. 26 of 2012) establishes the law for the protection of personal data in Singapore. The law applies to:
Companies, associations or bodies of persons that are corporate or unincorporated and:
formed under the law of Singapore;
resident in Singapore; or
have an office or a place of business in Singapore.
For further information on data protection laws in Singapore, see Data Protection in Singapore: overview.
Personal data is regulated under the Personal Data Protection Act. Personal data is defined as data (whether true or not) about an individual who can be identified from that data, or from that data and other information, which the organisation has or is likely to have access to.
Ordinary business data (non-personal data) is not subject to any different regulations. However, if the business data is confidential, the law of confidence would apply.
The Personal Data Protection Act prescribes certain conditions for the collecting of personal data. For example, the data subject must either give consent or be deemed to have given consent to the collection, use or disclosure of their data. The Act also prescribes circumstances where the collection, use or disclosure of data must be authorised by the data owner. These include circumstances where the collection, use or disclosure of personal data about the individual is reasonably necessary to provide the product or service to that individual.
The Personal Data Protection Act does not expressly restrict the storage of data on the cloud. However, when personal data is stored by any means, the organisation has certain obligations that are outlined in the Act, such as ensuring the accuracy and protection of the personal data.
The Personal Data Protection Act does not expressly include cookies in its definition of personal data. However, cookies can qualify as personal data if they fall within the broad definition of personal data that is, if they identify an individual either by themselves or together with other information, which the organisation has or is likely to have access to.
If cookies containing personal data arise from individuals who voluntarily provide this personal data, their consent may be deemed to be provided for the purpose for which the personal data was provided. However, the obligation to obtain the individual's consent for the collection of his personal data rests with the organisation that is collecting this personal data, whether by itself or through its data intermediaries. Where an organisation operates a website which a third party uses to collect personal data, and the website operator itself is not collecting this personal data, the obligation is on the third party organisation to obtain the consent required.
The Personal Data Protection Act prescribes measures that apply to the security of personal data generally. An organisation (including companies and internet providers) must protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks.
Government bodies can access or compel disclosure of personal data in Singapore.
The Personal Data Protection Commission can, (if it thinks fit, or after reviewing an organisation's refusal to provide access to personal data requested by an individual), direct the organisation to provide access to the personal data (sections 28 and 29, Personal Data Protection Act).
There are no specific rules or guidance pertaining to websites whose intended audience is children.
However, internet service providers, as a condition of their Class License (Broadcasting (Class License) Notification, Schedule 2A(1)(a)), must offer optional internet filtering services to prevent children from being exposed to undesirable content. As such, any site aimed at children should not include such content to avoid being filtered out.
There are no specific regulations in place regarding the licensing of domain names. General contract law applies.
For Singapore's .sg domain name registry, a person based outside Singapore can register a ".sg" domain name in this category, provided that it appoints a local agent with a valid Singapore postal address as the Administrative Contact.
However, for a ".per.sg" domain name, a registrant must be an individual and must be either a Singapore citizen or a permanent resident aged 18 years and above.
A domain registration does not automatically entitle the owner of the domain to a trade mark of the domain name.
It is possible to register domain names as trade marks with the Intellectual Property Office of Singapore, provided they meet the requirements for registration set out in the Trade Marks Act (Cap. 332). Once registered, the proprietor will acquire all the rights and remedies associated with ownership of the trade mark.
The use of a domain name can give rise to unregistered trade mark rights (passing off) for the owner/user of the domain name if, over time, it acquires the attributes of a trade mark (for example, if it serves as a ''badge of origin'' to distinguish the trade mark owner/user's goods or services from others).
It is possible to apply for and obtain a business name through the website of the Accounting and Corporate Regulatory Authority of Singapore (ACRA). The selected business name must not be identical to the name of another company or business.
Business names that imply a connection to a public authority or the government or contain ''unsavoury'' words or expressions will be refused registration by ACRA.
Jurisdiction and governing law
There are no statutes that regulate the jurisdiction for internet transactions or disputes specifically. In the absence of an exclusive jurisdiction clause, the Singapore court will apply the common law principles to determine the most appropriate forum for the dispute (that is, the forum that has the most real and substantial connection with the dispute). The factors that the court can consider in determining the most appropriate forum include but are not limited to the following:
The country in which the evidence on the issues of fact is situated or more readily available.
An assessment of the convenience and expense if the trial was to take place in Singapore or a foreign court.
Whether the law of the foreign court applies and if so, whether it differs from the Singapore law in material aspects.
Which country is either party connected with and if so, how closely.
Whether the defendant(s) genuinely desire trial in the foreign country, or are only seeking procedural advantages.
Whether the claimants would be prejudiced by having to sue in the foreign court because they would be deprived of security for their claim, unable to enforce any judgment obtained, faced with a time-bar not applicable in Singapore or for political, racial, religious or other reasons be unlikely to get a fair trial.
There are no statutes regulating the governing law for internet transactions or disputes specifically. General common law principles apply.
To determine the governing law of transactions or disputes, the court must:
Examine the contract to see if it expressly provides for a governing law.
In the absence of an express governing law clause, examine the contract to see if the intention of the parties with regards to the governing law can be inferred from the circumstances.
Determine which system of law the contract has its most real and close connection with.
There are no specific ADR/ODR options available to online traders and their customers in Singapore.
Online traders and customers can benefit from the alternative dispute resolution services provided by the general ADR institutions such as the Singapore Mediation Centre and the Singapore International Arbitration Centre.
There are no requirements to notify customers of these methods.
The internet service providers and internet content providers in Singapore are regulated by the Media Development Authority of Singapore (MDA). The MDA's regulatory framework for the internet is embodied in the Broadcasting (Class Licence) Notification (Class Licence Notification). Under the Class Licence Notification, internet content providers and internet service providers are deemed automatically licensed and must observe and comply with the Internet Class Licence Conditions and the Internet Code of Practice, which outline what the community regards as offensive or harmful to Singapore. In its approach to internet regulation, the MDA encourages self-regulation and therefore encourages content providers in Singapore to develop industry codes of practice to facilitate greater self-regulation.
All advertising and marketing activities (on broadcast media or otherwise) are guided by the Singapore Code of Advertising Practice (SCAP).The SCAP is issued by the Advertising Standards Authority of Singapore (ASAS), an advisory council under the Consumers Association of Singapore and was drafted against the background of international law and practice, including the International Code of Advertising Practice issued by the International Chamber of Commerce. The purpose of the SCAP is to promote a high standard of ethics in advertising by self-regulation. As such, the ASAS relies principally on a system of guidance and voluntary compliance, rather than punitive measures, to facilitate observance of the SCAP.
Although the SCAP does not have the force of law, it has been endorsed by organisations representing advertisers, advertising agencies and the media. The SCAP includes general guidelines that all advertisements must comply with, as well as certain industry-specific guidelines. Generally, under the SCAP, all advertisements (regardless of industry and mode of advertisement), must meet the following requirements:
Not incite people to engage in illegal activities.
Not be offensive to prevailing norms of decency.
Not undermine social and family values.
The types of services or products that are specifically regulated when advertised/sold online are:
Second hand goods.Every person dealing in second hand goods must obtain a licence from the Deputy Commissioner of the Police regardless of whether the dealing takes place at a shop or over the internet (The Secondhand Dealers Act (Cap. 288A)).
Medicines and medical services. The advertisement and sale of medicines and medical services is regulated by the Medicines (Advertisement and Sale) Act (Cap. 177).
Tobacco products. The Tobacco (Control of Advertisements and Sale) Act (Cap. 309) prohibits the advertisement and sales promotion of tobacco products.
Financial services. The promotion of financial services is regulated by the Code of Advertising for Banks issued by the Association of Banks in Singapore. Although the Code does not have the force of law, it is derived from the collective effort of the banks and financial institutions in Singapore. As such, financial institutions are committed to abide by it.
Gambling. The Remote Gambling Act (No. 34 of 2014) prohibits remote gambling activities and also the advertisement of online gambling services, unless these activities are provided by an exempt operator. Singapore-based operators can apply for a remote-gambling licence to provide remote gambling services to Singapore, if the Minister of Home Affairs considers it to be in the public interest to do so.
In addition to the above regulations, the Singapore Code of Advertising Practice imposes additional specific guidelines for the advertisement of products such as medicinal products, slimming products and services, hair and scalp products, alcoholic drinks, trading, financial products and services and audiotex services.
The Spam Control Act imposes the following requirements on bulk commercial messages sent electronically:
Spam e-mails must be labelled with ''<ADV>'' and cannot use misleading headers or subject fields.
Spam e-mails must contain an accurate and functional electronic mail address or telephone number by which the sender can be readily contacted.
Spam e-mails must contain an ''unsubscribe facility'' or ''opt-out'' function.
A business in Singapore is required to register for GST when its taxable turnover for the past 12 months ending March, June, September or December (the quarter) is more than US$1 million or if the business can reasonably expect its taxable turnover in the next 12 months to be more than US$1 million.
However, even if the business does not exceed US$1 million in taxable turnover, it can still voluntarily register for GST. The advantage of voluntary registration is that the business can enjoy the benefits of claiming input tax incurred in the course of business. This is especially advantageous for businesses that are dealing in purely zero-rated supplies (exports or international services).
Protecting an online business
Liability for content online
The key areas of liability for website content are:
If the website does not comply with certain regulatory requirements (for example, personal data requirements under the Personal Data Protection Act), a regulatory authority can require the website operator to comply with the applicable provisions. The authority can also impose fines and imprisonment if the requirements are breached.
If the website operator uses third party content online without obtaining the relevant rights, it could be exposed to claims of intellectual property infringement. There are various intellectual property-specific statutes in Singapore, which set out the scope of rights for intellectual property rights owners.
Under the common law and the Defamation Act (Cap. 75), where content published on a website is defamatory, the victim can obtain damages and/or an injunction requiring removal of the offending content from the website.
Under the Undesirable Publications Act (Cap. 338), there are statutory offences that could potentially be committed through the online publication of obscene material. The penalty for publishing obscene material can result in both imprisonment and a fine.
Generally, the website operator is responsible for the content on its website. However, in certain circumstances website operators can rely on several exceptions. For example, section 26 of the Electronic Transactions Act provides immunity to network service providers (NSPs) in respect of certain civil or criminal liabilities for third party content to which the NSP merely provides access.
In addition, under the ''safe harbour" provisions of the Copyright Act (Cap. 63), NSPs can enjoy immunity from copyright infringement for activities that are integral to its functions such as transmission, routing and provision of connections, system caching and storage and information location.
In general, an online business would not be liable for posts or content uploaded by third-parties/users.
An online retailer can limit its liability to consumers and businesses through:
The implementation of take-down actions.
An internet service provider's ability to shut down a website or remove infringing content is dependent on the agreement between the ISP and the website operator. In practice, in order to benefit from the ''safe harbour'' provisions under the Copyright Act, ISPs typically reserve rights to take down infringing websites, content or links.
Additionally, the owner or exclusive licensee of copyright in a material can apply for a court order to compel a network service provider to take reasonable steps to disable access to the flagrantly infringing online location (section 193DDA(1), Copyright Act). In February 2016, the Singapore High Court issued a court blocking order in favour of a trade association representing major US film studios against piracy website "solarmovie.ph" for flagrantly infringing copyright.
Liability for products / services supplied online
There are no rules that apply specifically to products or services supplied online.
There are various factors to consider when assessing, for example, an auction site's liability for selling counterfeit goods. These include:
Operation of any warranties or indemnities.
Whether there was negligence involved.
Specific terms of the contract that the auction site has with its suppliers.
Any laws relevant to the sold goods.
These factors are general in nature and are not specific to an online auction.
Singapore Statutes Online
Description. Official Singapore Government website for online publication of legislation, provided and maintained by the Legislation Division of the Attorney-General's Chambers.
Accounting and Corporate Regulatory Authority
Description. Official website of the Accounting and Corporate Regulatory Authority of Singapore.
Personal Data Protection Commission
Description. Official website of the Personal Data Protection Commission of Singapore.
Intellectual Property Office
Description. Official website of the Intellectual Property Office of Singapore.
Inland Revenue Authority of Singapore
Description. Official website of the Inland Revenue Authority of Singapore.
Infocomm Media Development Authority of Singapore
Description. Official website of the Infocomm Media Development Authority of Singapore
Alban Kang, Partner
Bird & Bird ATMD
Professional qualifications.Singapore, Advocate and Solicitor
Areas of practice. Technology, media and telecommunications; intellectual property; commercial law.
Just Wang, Associate
Bird & Bird ATMD
Professional qualifications. Singapore, Advocate and Solicitor
Areas of practice. Technology, media and telecommunications; intellectual property.