TRW & Co · Technology, IP & Data
Technology Transactions in Singapore
Technology transactions in Singapore cover how businesses build, buy, license and invest in technology, from development agreements and SaaS subscriptions to systems integration and technology M&A. The value lies in code, data and continuity, so ownership, security, liability and exit terms matter as much as price. This guide explains the framework and the clauses that decide outcomes in 2026.
Key pointUnder the Copyright Act 2021 the author of commissioned code generally owns it unless the parties agree otherwise in writing, so a customer that pays for development without a written assignment may not own what it paid for.
At a glance
Commissioned code ownership
Under the Copyright Act 2021, the author of a commissioned work generally owns copyright unless the parties agree in writing that someone else will own it.
Electronic contracts work
The Electronic Transactions Act 2010 recognises electronic contracts and signatures, so click-through terms can bind if they are properly brought to the user’s attention.
Caps face a reasonableness test
Exclusion and limitation clauses in standard terms are subject to the reasonableness requirement in the Unfair Contract Terms Act 1977.
Security stays with owners
The 2024 Cybersecurity Act amendments keep CII owners responsible for cybersecurity even when they rely on cloud or third-party providers.
Diligence on open source
Software composition analysis is now routine in technology M&A because copyleft licences can impose source code disclosure duties on distributed products.
Swipe or scroll →
What technology transactions in Singapore cover
Technology transactions in Singapore are the contracts and deals through which businesses build, buy, license, integrate and invest in technology. They range from a start-up's first development agreement to a bank's multi-year platform replacement, and from a software asset purchase to the acquisition of a regional technology group.
What sets these deals apart is that the value sits in intangibles: code, data, know-how, people and the right to keep using systems after the relationship ends. A conventional commercial contract focuses on delivery and payment. A technology contract must also answer who owns what is created, what happens to data, how security is assured, and how the customer exits without losing a business-critical system.
The legal question usually arises earlier than parties expect. By the time a statement of work is signed, the architecture, the vendor's standard terms and the commercial model have often fixed most of the risk allocation. The best results come from involving counsel when the deal is shaped, not when it is ready to sign.
The legal and regulatory framework
Singapore has no single technology contracts statute. The law is a combination of English-derived common law of contract, intellectual property statutes and sector regulation. That gives parties wide freedom of contract, which is one reason Singapore law is often chosen to govern regional technology deals.
Contract law and electronic transactions
The Electronic Transactions Act 2010 confirms that contracts may be formed and signed electronically, subject to limited exclusions. Click-through and browse-wrap terms are enforceable if properly presented, though courts look at whether the terms were reasonably brought to the other party's attention. Exclusion and limitation clauses in standard terms are subject to a reasonableness test under the Unfair Contract Terms Act 1977, which matters when a vendor's form contract caps liability at a nominal amount.
Intellectual property
Software is protected as a literary work under the Copyright Act 2021, without registration. A key change from the old law concerns commissioned works: as IPOS explains, the author generally owns copyright even when paid to create the work, unless the parties agree otherwise in writing. Employers own works their employees create in the course of employment. Patents, registered designs, trade marks and confidential information complete the picture.
Regulatory overlays
Several regimes shape technology transactions in Singapore even though they are not contract laws. The Personal Data Protection Act 2012 governs any personal data the technology handles. The Cybersecurity Act 2018, as amended in 2024, makes owners of critical information infrastructure responsible for its security even when they use third-party or cloud providers. MAS expects financial institutions to manage third-party and outsourcing risk, which flows into vendor contracts. The Competition Act 2004 can apply to exclusive and restrictive licensing terms.
Deal types and how they differ
Each category of transaction has its own risk profile. Using the wrong template, such as a goods supply contract for a software build, is one of the most common sources of later disputes.
| Transaction | Typical structure | Main pressure points |
|---|---|---|
| Bespoke development | Master services agreement plus statements of work | IP ownership, acceptance testing, change control, delay remedies |
| Software licence (on-premise) | Perpetual or term licence plus support | Scope of use, audit, source code escrow, end of support |
| SaaS subscription | Online terms or negotiated subscription agreement | Service levels, data location and return, security, unilateral changes |
| Systems integration | Multi-phase project with third-party products | Responsibility gaps between vendors, milestone payments, key personnel |
| Managed services and outsourcing | Long-term services agreement | Transition, service credits, regulator access, exit assistance |
| Technology M&A | Share or asset purchase | Title to code, open source, key employee retention, data assets |
| Strategic collaboration | Joint development or JV | Background and foreground IP, exploitation rights, deadlock and exit |
Licensing and SaaS models are covered in more depth on our software licensing page, and managed services on the cloud and outsourcing page.
Key negotiation points
The same handful of clauses determine most outcomes. Treat them as commercial decisions, made by people who understand the business, rather than boilerplate.
Ownership of deliverables
Because commissioned works now default to the author, a customer who wants to own bespoke code needs an express written assignment. Vendors usually keep pre-existing tools and grant a licence to them, so define background IP carefully.
Acceptance and milestones
Objective acceptance criteria, defined test periods and deemed acceptance rules decide when payment is earned and when warranty periods start. Vague acceptance is the root of many software disputes.
Liability caps and exclusions
Caps are often set as a multiple of annual fees, with carve-outs for data breaches, confidentiality and IP infringement. Test whether the cap is meaningful against realistic losses, including regulatory costs.
Data and security
Specify security standards, certifications, breach notification within hours, data location, sub-processor approval, and the return or deletion of data at exit, consistent with PDPA obligations.
Change control
Agile projects still need a mechanism for pricing and approving scope changes. Without one, cost overruns become arguments over whether work was in scope.
Exit and continuity
Exit assistance, transition periods, escrow, and the right to keep using licensed components protect the customer if the vendor fails or the relationship ends.
In a technology deal, the clause you will need most is the one that tells you how to leave.
Pricing models and their legal consequences
Fixed-price contracts shift delivery risk to the vendor but need tight specifications and change control, or the vendor will price the uncertainty in. Time-and-materials contracts are flexible but leave the customer carrying overrun risk, so governance and reporting rights matter more. Outcome-based pricing aligns incentives but requires measurable outcomes the vendor can actually influence. Each model needs different remedies for delay and defects.
The transaction process step by step
For a significant procurement or licensing deal, a disciplined process saves time overall. The sequence below reflects how we run technology transactions in Singapore for customers; vendors can use it in reverse to anticipate what customers will ask.
- Define requirements and risk. Agree the business outcome, criticality, data involved and regulatory overlays, such as MAS outsourcing rules or CII designation, before approaching the market.
- Run selection and due diligence. Assess vendors' financial strength, security certifications, references, subcontractors and the location of data and support teams.
- Agree a term sheet. Settle the commercial model, ownership of deliverables, liability approach, service levels and exit principles before lawyers draft long-form documents.
- Negotiate the contract suite. Master agreement, statements of work, service level schedule, data processing terms, security schedule and any escrow agreement, with consistent definitions.
- Complete approvals. Obtain internal approvals and any regulatory notifications, and confirm tax treatment of cross-border payments.
- Govern delivery. Set up steering committees, reporting and change control, and track milestones and acceptance against the contract.
- Review and renew. Before renewal, benchmark price and performance, update security and data terms, and decide whether to re-tender.
Technology M&A and investment diligence
When a business is acquired for its technology, legal due diligence focuses on whether the target really owns, or is entitled to use, what it sells. That means checking assignments from founders, employees and contractors, particularly freelance developers engaged without written IP terms, and confirming that commissioned code was assigned in writing.
Open source is the second focus. Most products incorporate open source components, which is not a problem in itself. The risk lies in copyleft licences that may require disclosure of proprietary source code if the software is distributed in certain ways, and in missing attribution notices. A software composition analysis scan, reviewed by counsel, is now standard for meaningful deals.
Diligence should also cover data: the legal basis for the target's personal data, its breach history, cross-border transfer arrangements and any PDPC proceedings. Our M&A support team integrates these workstreams, and our article on software copyright explains ownership issues in more depth.
Investments in entities that the government designates under the Significant Investments Review Act 2024 may also need approval. Designation is specific and published, so check whether the target is on the list early in the timetable.
Documents and records to assemble
Well-run technology transactions in Singapore rest on a complete and consistent document set. Gaps between documents, such as a statement of work that contradicts the master agreement, are where disputes start. Before signing, and again before renewal, assemble the following.
- Requirements and specifications: the functional and non-functional requirements the vendor is contracting to meet, version-controlled and attached to the contract rather than referred to loosely.
- Vendor due diligence file: financial statements, security certifications, penetration test summaries, insurance certificates and a list of subcontractors and data locations.
- IP chain of title: employment and contractor agreements, assignments and licences showing that the vendor, or the target in a deal, holds the rights it purports to license or sell.
- Third-party and open source register: components, their licences and any obligations those licences impose on distribution.
- Data map: the personal and confidential data the system will handle, where it will be stored and processed, and which transfer mechanism applies.
- Service level and security schedules: measurable service levels, credits, reporting, security controls and incident notification deadlines.
- Exit plan: transition steps, data formats for return, knowledge transfer and the duration and price of exit assistance.
- Governance records: steering committee minutes, change requests and acceptance certificates, kept throughout delivery.
The governance records are often neglected, yet they are what a tribunal reads first if the project fails. A signed acceptance certificate or an approved change request can settle an argument that would otherwise turn on recollections. For long-running programmes, assign one person to keep the contract file current and reconcile it with what is actually happening on the project.
Regulated customers should also keep evidence of their risk assessment and of any notification made to their regulator. These records show that technology transactions in Singapore were approached with the diligence regulators expect, and they shorten audits considerably.
Risks and common mistakes
Assuming you own code you paid for
Under the Copyright Act 2021, the author of a commissioned work generally owns the copyright unless the parties agree in writing that someone else will. Many companies discover during fundraising or a sale that key modules were written by contractors under purchase orders with no IP clause. Fixing this later means tracking down developers and negotiating assignments when they know the code is valuable. Make written assignments, with waivers of the right to be identified as author where appropriate, a condition of every development engagement.
Signing the vendor's online terms for a critical system
Online terms are designed for scale, not for a customer whose operations depend on the service. They often allow the vendor to change terms unilaterally, suspend service, cap liability at a month's fees and delete data shortly after termination. For critical systems, negotiate an order form or addendum that overrides those points, or at least document the residual risk and approve it at the right level. Regulated entities may have no choice, because MAS and sector regulators expect specific contractual protections.
Leaving acceptance criteria vague
If the contract says the system must work "in accordance with the specification" and the specification is a sales presentation, every defect becomes an argument. Define acceptance tests, who runs them, how long they take, what counts as a pass, and what happens on failure, including re-testing and the right to reject. Avoid deemed acceptance through live use unless the customer genuinely intends that outcome. Clear acceptance terms are also the foundation of any later claim, as our technology disputes team sees regularly.
Ignoring open source and third-party components
A vendor's warranty that its software does not infringe third-party rights is only as good as its ability to pay. Ask for a list of third-party and open source components, confirm that their licences permit the intended use and distribution, and require the vendor to keep the list current. For products you distribute to customers, understand whether any copyleft obligations are triggered. These questions are cheap during negotiation and expensive in diligence.
Overlooking tax on cross-border payments
Payments from Singapore to overseas vendors may be subject to withholding tax if they are characterised as royalties or certain service fees, and imported digital services may attract GST through the overseas vendor registration or reverse charge regimes. IRAS distinguishes between payments for the use of copyright and payments for a copy of software for end use. Clarify gross-up clauses and the characterisation of each payment stream before signing, and coordinate with our tax structuring team on larger deals.
Cross-border technology deals: Bangladesh, the UK, UAE, China and ASEAN
Many technology transactions in Singapore involve development teams or customers elsewhere. Singapore law is a common choice of governing law, with arbitration at SIAC as the forum, because awards are enforceable in most jurisdictions under the New York Convention.
Offshore development in Bangladesh is a frequent model for Singapore businesses. The contract must deal with how IP created in Dhaka or Chattogram is assigned to the Singapore entity, with local formalities checked so the assignment is effective there too, and with employment and contractor rules under Bangladeshi law. Data transfers back to Singapore need to satisfy both legal systems.
China's export control and technology import and export rules can apply when technology is transferred out of China, and its data laws restrict outbound transfers of certain data. In the UK and the UAE, deals involving sensitive sectors may require investment screening. Within ASEAN, data localisation and local content rules vary by country and can affect delivery models. We coordinate local counsel in each jurisdiction through TRW's network so that one deal runs on one timetable.
Where development happens outside Singapore, require the vendor to procure written IP assignments from every individual developer under the local law, and to deliver copies on request. A head-contract assignment from a company that never acquired the rights from its staff assigns nothing.
How TRW & Co helps with technology transactions in Singapore
We advise customers, vendors and investors, working alongside in-house technology, procurement and security teams. Where Singapore court or tribunal representation is required, we work alongside Singapore-qualified counsel.
Procurement and contracting
We structure and negotiate development, integration, licensing, SaaS and managed services agreements, including service level, security and exit schedules aligned with your regulatory obligations.
Vendor-side templates
For technology companies, we build contract suites and playbooks that sell efficiently in Singapore and the region, with fallback positions approved in advance.
Deal diligence
We run IP, open source, data and contract diligence for acquisitions and investments, and draft the warranties and remedies that address what we find.
Collaborations and IP
We structure joint development, IP licensing and technology partnerships, including ownership of improvements and commercialisation rights.
Explore our practices for related areas, read our guide to SaaS agreements, or contact us to discuss a transaction.
Checklist for decision-makers
- Have we decided whether we need to own bespoke deliverables, and is there a written assignment covering every developer?
- Are acceptance criteria objective, with clear consequences for failure?
- Is the liability cap meaningful against realistic losses, including data breach and regulatory costs?
- Do the security and data terms meet our PDPA, MAS or Cybersecurity Act obligations?
- Do we have a tested exit plan, with transition assistance and data return?
- Have open source and third-party components been identified and checked?
- Is the tax treatment of cross-border payments settled, including withholding and GST?
- Are governing law and dispute resolution suited to where enforcement may be needed?
Decision-makers who settle these points before signature avoid most of the disputes that later arise in technology transactions in Singapore, and keep the leverage that disappears once the contract is signed.
Frequently asked questions
01If we pay a developer to build software, do we own it?
Not automatically. Under the Copyright Act 2021, the author of a commissioned work generally owns the copyright, even when paid, unless there is a written agreement that someone else will own it. Employees are different: employers own works created in the course of employment. If you commission software from a contractor or agency, include an express assignment of present and future IP, cover the agency’s own developers, and obtain waivers or consents relating to moral rights where appropriate. Retrospective assignments are possible but harder to negotiate.
02Should a technology contract be governed by Singapore law?
Singapore law is a strong choice for regional technology deals. It is predictable, based on English common law, respects freedom of contract and is widely understood by international counterparties. Paired with arbitration seated in Singapore, it gives awards that are enforceable in most countries under the New York Convention. Where the main assets or counterparties are in one country, local law may still govern specific issues such as IP assignments, employment or data transfers, so the governing law clause should be checked against where enforcement would actually be needed.
03What is a reasonable liability cap in an IT contract?
There is no fixed market rule. Caps are commonly expressed as a multiple of the fees paid or payable over a twelve-month period, with separate, higher caps or exclusions for data protection breaches, confidentiality and IP infringement. The right answer depends on the realistic loss the customer could suffer and the vendor’s insurance. Exclusion and limitation clauses in standard terms must also satisfy the reasonableness test under the Unfair Contract Terms Act 1977, so very low caps on critical services are vulnerable.
04Do we need source code escrow?
Escrow is worth considering where you depend on licensed software that is critical to operations and the vendor is small, newly established or in financial difficulty. The escrow agent holds the source code and releases it on defined events, such as insolvency or failure to support. Its value depends on verification: unverified deposits are often incomplete or out of date. For SaaS, traditional escrow is less useful, and parties increasingly negotiate continuity arrangements covering environments, data and transition support instead.
05Can a vendor change its online terms during our subscription?
Many standard terms allow it, often by posting updated terms online. Whether a change binds you depends on the contract wording and how the change was notified. For important services, negotiate a clause that prevents material adverse changes during the term, or allows you to terminate without penalty if they occur. Regulated customers, such as financial institutions, may need specific protections that cannot be varied unilaterally. Keep a copy of the terms accepted at signature, because online versions change.
06Does the Competition Act affect technology licensing?
It can. The Competition Act 2004 prohibits agreements that prevent, restrict or distort competition in Singapore and abuse of a dominant position. Most technology licences raise no issue, but exclusivity, non-compete terms, tying of products, territorial restrictions or restrictions on licensees’ own development may be scrutinised, particularly where a party has significant market power. CCS has published guidance on the treatment of IP rights. Review restrictive terms in significant licences and distribution arrangements against that guidance.
Sources and official materials
- Copyright Act 2021 — Copyright in software and commissioned works
- IPOS: Ownership and commercialisation of copyright — Default ownership, assignment and licensing
- Electronic Transactions Act 2010 — Electronic contracts and signatures
- Personal Data Protection Act 2012 — Data obligations in technology contracts
- CSA: Cybersecurity Act — CII owners’ responsibilities and 2024 amendments
- MAS: Third-party risk management — Expectations for financial institutions’ vendors
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
Talk it through
before you decide.
Share the decision, the jurisdictions and the timetable. A partner will tell you what matters, what can wait and what it will take.