Secure Client Portals for Accounting Firms: Stop Emailing NRICs

Why emailing NRICs and bank statements is the problem

The PDPA's Protection Obligation (section 24 of the Personal Data Protection Act 2012) requires reasonable security arrangements for personal data you hold. The PDPC treats NRIC numbers, bank details and financial data as higher-risk because they can be used for fraud and identity theft, and expects stronger protection for them.

Email fails that test in three ways. Files go to the wrong person when an address autocompletes. Copies multiply in sent items, inboxes and downloads folders, so you cannot dispose of them when the retention period ends. And one compromised mailbox exposes years of client documents in a single search.

Client file exchange options compared

There are three realistic levels for a small firm. Most start at the first and move up as client numbers grow.

Google Workspace has no direct equivalent of Microsoft's file request. A Google Forms file upload question works, but Google's help page says responders must sign in to a Google account, and the question is not available when the form is in a shared drive or when Data Loss Prevention is on. Our comparison of Google Drive, OneDrive and Dropbox for business covers the wider differences.

Set up a Microsoft 365 file request for clients

Microsoft's file request guide explains the feature: anyone with the link can upload, but cannot see the folder's contents, edit, delete, download or see who else uploaded. Your admin must enable file requests, and SharePoint needs 'Anyone' links allowed for that site.

1. 1

   Create a client library on a SharePoint site

   Use a site for client files rather than personal OneDrive, so files belong to the firm and survive staff changes.

2. 2

   Make one upload folder per client

   Name it by client code. Restrict access to the staff who handle that client.

3. 3

   Select the folder and choose Request files

   Add a short description of what you need, such as 'Director NRIC (front and back) and latest bank statement'.

4. 4

   Set an expiry on the link

   In Manage access, open the link settings and set an end date. Remove the link once the documents are in.

5. 5

   Send the link by a different channel than the request

   If you email the request, confirm by phone or WhatsApp that the client expects it, so they are not trained to trust random upload links.

Microsoft notes that names typed by clients who are not signed in are not verified. Check each upload against the client before filing it.

Settings that matter on any client portal

Whichever tool you use, these are the controls to look for. The PDPC's Guide to Data Protection Practices for ICT Systems lists access control, encryption, logging and secure disposal among its baseline practices.

If you buy a portal, ask the vendor where data is stored, whether they sign a data processing agreement, and how you export everything if you leave. Those answers matter more than the feature list.

How long to keep client documents

Retention is where portals earn their keep, because email makes deletion almost impossible. Two sets of rules usually apply to an accounting or CSP firm's files.

Write the end date on the folder when a client leaves, and review folders once a year. Our guide to CSP Act record-keeping covers the CDD side in more detail.

Collect NRIC only when you need it

The PDPC's advisory guidelines on NRIC numbers limit collecting NRIC numbers and copies to cases where the law requires it or it is necessary to verify identity to a high degree of fidelity. Customer due diligence for corporate services and ACRA filings fall within that, but a general enquiry or a quote request does not.

So keep NRIC fields off your website forms and ask for identity documents only once the engagement starts, through the secure channel. Our guide to NRIC collection rules explains the limits, and our accounting firm cybersecurity guide covers protecting the mailboxes and devices around the portal.

Do it yourself or get help?

A firm on Microsoft 365 can set up file requests for a pilot group of clients in an afternoon. The harder parts are tidying permissions on existing folders, moving years of email attachments out of mailboxes, and setting retention.

Our Microsoft 365 / Google Security Lockdown (S$590) sets up the client library, sharing limits, MFA and audit logs. If you want a branded portal with client logins, document checklists and reminders tied to your workflow, our Custom Tool or Dashboard work starts from S$1,990, scoped in writing. The PDPA Compliance Pack (S$690) adds the retention and breach policies to go with it.