Most organisations have got better at controlling who can open a file inside their own systems. The harder question is what happens after that file is shared with a supplier, customer, external adviser or an AI tool. SealPath’s 2026 State of Data Protection report highlights a gap between access policies and the ability to keep control of information once it leaves the organisation.

The report is based on a survey of 1,052 security and technology professionals, with fieldwork carried out in July and August 2026. Its findings are useful for Singapore businesses reviewing data protection, secure collaboration and the controls they need as employees make wider use of generative AI.

Access control is only part of the job

According to the report, 85% of respondents say they apply least-privilege access. However, only 36% can change a document’s permissions after it has been sent, and just 21% say they have persistent protection in place. That difference matters because a file can move beyond the original repository very quickly: it may be downloaded, forwarded, copied into a project workspace or shared with an external party.

Revoking access to a folder or user account does not always solve the problem if a copy of the document is already outside the organisation’s control. Security teams need to consider the file itself, not just the location where it was first stored.

AI use adds another route for sensitive information to travel

The report found that 48% of participants confirmed that sensitive information had been entered into AI tools, while another 20% suspected this had happened. Although 78% said their organisation had an AI usage policy, only 26% reported technical measures to block sensitive information from being uploaded to those tools.

This is a practical challenge, not simply a policy issue. Staff may paste contract clauses into an assistant to prepare a summary, upload engineering drawings for analysis or use internal reports to draft a presentation. The intention may be harmless, but the organisation still needs to know what information is being shared and whether the destination is approved.

Why persistent document protection is worth evaluating

SealPath’s information rights management approach applies protection to the document, rather than relying only on the repository around it. Its platform combines encryption with usage permissions and traceability, helping organisations control who can access a protected file and what they are allowed to do with it. Depending on the configuration, administrators can also track access and revoke permissions after a document has been shared.

That model can be useful for contracts, financial records, customer information, product designs and other documents that regularly move between internal teams and external partners. SealPath describes SaaS and on-premises deployment options, alongside integrations with common business applications and storage environments.

What the findings mean for Singapore buyers

Singapore organisations should assess these controls against the way information actually moves through the business. The report found that 72% of respondents share sensitive information with third parties at least occasionally, but only 46% said they could revoke access to shared information and 32% could audit third-party access. Those gaps are relevant to businesses working with regional suppliers, outsourced service providers, legal advisers and overseas subsidiaries.

The report also found that 83% of respondents consider data sovereignty important or mandatory, and 72% apply that consideration to AI tools that process sensitive information. For local buyers, this is a reminder to ask where data is stored and processed, which administrators can access it, how keys and permissions are managed, and what happens when a document crosses a national boundary.

These questions should sit alongside the organisation’s obligations under Singapore’s PDPA and its own contractual and industry requirements. A technology platform can support governance, but it does not replace the need for clear policies, staff training, supplier due diligence and legal review.

A practical checklist before choosing a solution

• Identify high-value information. Start with documents that would create material risk if they were copied or shared without approval.
• Protect the file after sharing. Check whether permissions remain enforceable when a document is downloaded or sent outside the original repository.
• Test revocation and audit. Confirm that administrators can withdraw access and review who opened a document, including external users.
• Check application fit. Validate support for the file types and tools your teams already use, especially Office documents, PDFs and engineering or CAD files where relevant.
• Review deployment and data flows. Compare SaaS and on-premises options, hosting locations, integrations, identity controls and administrator access.
• Pilot real workflows. Test with a small group that regularly shares sensitive files with customers or partners, and measure both security outcomes and user friction.

Move from policy statements to controls that travel with the data

The main lesson from the 2026 report is that a policy can say who should access information, but it cannot by itself protect every copy once a document starts moving. Singapore IT and security teams should review whether their current controls can follow sensitive information through collaboration, external sharing and approved AI use.

Persistent document protection is one option to assess as part of that wider programme. The right starting point is a focused pilot using the documents and sharing scenarios that matter most to the business, with clear success measures for usability, access control, auditability and data governance.