Software Vendor Lock-In: Can a Singapore SME Get Its Own Data Out?

You own your business data in law, but in practice you only own the part you can export, open and read without your vendor's permission. Everything else is on loan. Before you sign anything for 2027, spend 90 minutes trying to pull your own records out of the five systems you depend on most. The results are usually uncomfortable: a payroll system that exports summaries but not payslips, an accounting subscription that shows 12 months of history on your plan tier, a marketplace dashboard with no export button at all. Finding that out in October is an inconvenience. Finding it out while migrating in January is a stalled rebuild.

What does software vendor lock-in look like in a 10-person company?

It rarely looks like a dramatic hostage situation. It looks like friction that makes leaving irrational:

• Export exists, but it is thin. You get a CSV of invoice totals without the line items, or customers without their contact history.
• Attachments stay behind. Supplier invoices, signed delivery orders and contract PDFs live in the vendor's file store, and the export gives you filenames pointing at nothing.
• History is tied to your plan. Downgrade or cancel, and the older years go read-only or disappear.
• The export is a support ticket. Technically possible, but only if someone at the vendor runs it, within their timeline, sometimes for a fee.
• Relationships are lost. You receive three flat files with internal IDs that no longer join up, so the data is present but not usable.

None of these show up in a demo. All of them show up on the day you want to move.

Which records do you still owe the authorities after you cancel?

This is the part owners underestimate. Cancelling a subscription does not cancel your record-keeping obligations, and the obligation sits with you, not the software company.

• Accounting and tax records: IRAS requires business records to be kept for at least five years, and GST-registered businesses must keep supporting records for their returns for the same period. If your cloud accounting is gone, you still have to produce them.
• Employment records: under the Employment Act, employers must keep employee records and itemised payslip records, including for staff who have already left. A payroll platform you stopped paying for is not a defence.
• CPF and statutory contribution records: you need to be able to reconstruct what was paid, for whom, and when.
• Customer personal data: under the PDPA you remain accountable for personal data you collected, including data sitting with a vendor acting as your data intermediary.

A note on data portability: the 2020 PDPA amendments introduced a data portability obligation, but it has not come into force. Do not plan your exit on a right that is not yet switched on. Plan it on your contract and your own exports.

How do you run a 90-minute data exit test?

Do this yourself, or with the one staff member who actually uses each system. Timebox it hard.

1. List the five systems that would hurt most if they vanished tonight. For most Singapore SMEs: accounting, payroll/HR, CRM or quotation system, the sales channel (POS, webstore or marketplace), and file storage plus email.
2. Give each one 15 minutes. Log in and export everything you can, using only the buttons available to you. No support tickets, no asking your IT vendor.
3. Open what you downloaded. In Excel, Sheets or a text editor. Not in the vendor's own viewer.
4. Check for the four usual gaps: how far back the history goes, whether attachments and document PDFs came along, whether line-level detail survived, and whether records still link to each other.
5. Score each system green, amber or red. Green: self-serve export, full history, attachments included. Amber: export exists but incomplete, or requires the vendor to run it. Red: no usable export, or the data only exists on screen.
6. Save the exports somewhere you control, in a dated folder, and diarise a repeat every quarter. A six-month-old export is a fallback. A two-year-old one is a souvenir.

Expect one red. Most businesses have a system nobody has ever tried to leave, and that is exactly the one holding something irreplaceable.

What should you change in the contract before you sign for 2027?

If you are renewing or buying new software in the next few months, these clauses cost nothing to ask for at the point of sale and are nearly impossible to get afterwards:

• A defined export right: named formats, full history, line-level detail and attachments, available to you without charge.
• Data return and deletion on termination: what you get, in how many days, and confirmation that their copy is deleted.
• Post-cancellation read access: even 30 to 60 days of read-only access removes most of the panic from a migration.
• No data withholding during a billing dispute. Say it explicitly.
• Where the data lives and which sub-processors touch it, plus a named contact for data protection matters, so your PDPA paperwork has a real counterpart.
• API or export availability on your actual plan tier, not the enterprise tier in the brochure.

Who owns the data inside your own business?

Vendor lock-in has an internal twin. The marketplace seller account registered to a staff member's personal email, the WhatsApp Business number on someone's own phone, the quotation spreadsheet with formulas only one person understands — all of these are lock-in too, just closer to home. When you finish the vendor test, write down which accounts are registered to a person rather than to the company. That list is usually shorter than owners fear and more urgent than they expect.

What does this mean for a 2027 rebuild?

If you are weighing one ERP against several specialist tools, portability should carry as much weight as features. A best-of-breed stack with clean exports at every edge is genuinely reversible. A single integrated platform with weak exports is a ten-year decision dressed up as a monthly subscription. Run the test first, then choose — the exercise takes one Sunday afternoon and changes which options are safe to put on the table.

FAQ

Is my vendor legally required to give me my data?

Not in the broad way most owners assume. Your contract is the operative document, and Singapore's PDPA data portability obligation is not yet in force. Treat an export right as something you negotiate, not something you inherit.

Do I need to keep the old system running after migrating?

Usually no, provided you have exported the records you are required to keep in a readable form and verified a sample against the original. Budget for a short overlap period anyway — one or two months of parallel access is cheap insurance against a reconciliation surprise.

What is the single highest-value thing to do this week?

Export your accounting data, including line-level detail and attached documents, open it to confirm it is complete, and store it somewhere you control. That one file covers your largest statutory exposure and takes under 30 minutes.