PDPA Data Protection Officer: What Singapore SMEs Must Fix Before 2027
The PDPA has no headcount exemption: if your company handles personal data in Singapore, you need a named data protection officer with published contact details. Most SMEs have nobody appointed, no registered contact, and no written answer to who owns customer data. Here is the minimum defensible setup, and how to close it before 2027.
MFA and Passkey Rollout for a Small Team: A 30-Day Plan for Google Workspace and Microsoft 365
A sub-20-person company can finish an MFA and passkey rollout in about a month, but only in the right order: admins first, passkeys as the primary factor, SMS retired, then the quiet backdoors closed. Here is the sequence, what breaks, and what it costs.
Business Email Compromise: Protecting Singapore SME Year-End Payments
Scammers do not break into your systems at year-end; they wait for a busy approver covering for someone on leave. This post sets out the three payment controls, the email account settings and the first-hour response plan that stop a fake supplier invoice from being paid between now and January.
Is the Cyber Essentials Mark Worth It for Singapore SMEs Bidding on Tenders?
Government and enterprise buyers are starting to ask for CSA's Cyber Essentials mark in procurement documents, which turns a security question into a commercial one. Here is what the mark actually requires, how long a sub-20-person company needs to get ready, and when it is cheaper to adopt the checklist without certifying.
Backup Restore Testing for Singapore SMEs: The 3-2-1 Rule and the Restore Nobody Has Tried
Your backup job says "completed" every night. That tells you a file was written somewhere — not that your data is recoverable. This is the 90-minute restore test a 15-person Singapore company can run twice a year, the five reasons healthy-looking backups fail at the moment of truth, and the one-page record that answers both PDPA accountability questions and enterprise tender security questionnaires.
Employee Offboarding Checklist for Singapore SMEs: Revoking Access on the Last Day, Not the Last Quarter
Most small companies suspend the email account and consider offboarding done. Meanwhile the ex-staff member is still in the customer WhatsApp group, still owns a Drive folder of invoices, and still holds the phone number receiving your 2FA codes. Here is the revocation sequence to run on the last working day, and the record that proves you ran it.
InvoiceNow for Non-GST Registered Businesses: What to Do Before 2027
The InvoiceNow mandate only covers newly GST-registered businesses, so most small Singapore firms have filed it under 'not my problem'. That is a mistake of sequence, not of fact. The requirement will arrive through your largest customers' accounts payable teams long before it arrives from IRAS, and the firms that can receive a structured e-invoice in 2027 will be paid faster than the ones still attaching PDFs to email. This post sets out what non-GST and voluntary adopters should do in the next 90 days, what it costs, and the three ways SMEs usually get it wrong.
How to Choose an InvoiceNow Access Point in Singapore Before the GST Mandate Reaches You
Choosing an InvoiceNow access point takes an afternoon. Cleaning your customer master data, mapping your UEN-based Peppol ID and getting suppliers off PDF invoices takes three months. Here is the order of work for a Singapore SME that wants to be connected and tested well before the GST InvoiceNow requirement reaches its segment.
IRAS Record Keeping Requirements: The Document Trail a Singapore SME With No Finance Team Can Actually Produce
Most Singapore SMEs have the records IRAS requires. What they don't have is the ability to find them. A practical filing structure an owner-run company can build in October, using documents already on the desk for the Q3 close and the 30 November Form C-S deadline.
ACRA AGM and Annual Return Deadlines 2026: The June and December Year-End Timetable
A 30 June financial year-end means an AGM by 31 December 2026 and an annual return by 31 January 2027. A 31 December year-end runs six months behind it. Here is the full ACRA timetable, the no-AGM shortcut most private companies qualify for, the late lodgement penalties, and the document trail an SME without a finance department needs to assemble in October.
Form C-S (Lite) Filing Without an Accountant: The 30 November 2026 Corporate Tax Deadline
If your financial year ended in 2025, your YA 2026 corporate income tax return is due on 30 November 2026. For companies under $200,000 revenue, Form C-S (Lite) is six essential fields — but the two months of document work behind it is what actually decides whether you file on time. Here is the October-to-November sequence for an SME with no finance department.
GST F5 Filing for the Quarter Ending 30 September 2026: Deadlines and InvoiceNow Readiness
Your GST F5 for the quarter ending 30 September 2026 is due by 31 October, with GIRO deduction on 15 November. Here is what has to be true before you file, how to close a quarter in days instead of weeks without a finance department, and how to tell whether the InvoiceNow e-invoicing requirement applies to your company yet.