TRW & Co · PDPA and data protection
Employee Personal Data in Singapore: What Employers Can Collect Under the PDPA
Employers can handle employee personal data in Singapore without consent where it is reasonable for managing or ending the employment relationship, or for evaluative purposes such as hiring and promotion. They must still notify purposes, protect the data and stop keeping it when the purpose ends. This guide covers the exceptions, NRIC rules, monitoring, retention and HR breaches.
Key pointThe employment exceptions remove the need for consent, not the need for notice: for managing the relationship, employees must still be told the purposes, and a blanket consent clause does not do that job.
At a glance
Two employment exceptions
The PDPA allows processing without consent for evaluative purposes and for managing or terminating the employment relationship, subject to reasonableness.
Notice still required
For managing or terminating employment, section 20 requires employers to inform employees of the purposes and provide a contact person on request.
NRIC limits since 2019
PDPC's NRIC guidelines, in effect from 1 September 2019, allow NRIC collection only where required by law or needed to verify identity to high fidelity.
Three-day breach notice
Notifiable breaches must be reported to the PDPC no later than three calendar days after the organisation determines that the breach is notifiable.
Penalties up to 10%
Financial penalties can reach 10% of Singapore turnover for organisations with local turnover above S$10 million, or S$1 million otherwise.
Swipe or scroll →
The short answer: what can employers collect?
Employers can collect, use and disclose employee personal data in Singapore without consent where it is reasonable for managing or terminating the employment relationship, or where it is needed for evaluative purposes such as deciding whether to hire, promote or retain someone. They must still tell employees the purposes, protect the data, keep it accurate and delete or anonymise it once there is no longer a business or legal reason to keep it.
That framework, under the Personal Data Protection Act 2012 (PDPA), gives HR teams a lot of room but not unlimited room. Payroll details, attendance records, appraisals, IT monitoring logs and disciplinary files are normally fine. Collecting data that has nothing to do with the job, over-collecting NRIC numbers, monitoring without notice, or keeping former employees' files indefinitely are where most problems arise.
Employers also face mandatory obligations from other laws. MOM requires employee and salary records, CPF and tax rules require identity and income data, and work pass rules require passport and pass details. Where a law requires the data, collection is authorised; the PDPA then governs how it is protected and retained.
The legal framework
The PDPA obligations
The Personal Data Protection Act 2012 applies to private-sector organisations, including employers, and covers employee personal data in Singapore throughout the employment lifecycle. The main obligations are consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, data breach notification and accountability, which includes appointing a data protection officer and having policies in place.
The employment exceptions
The PDPA recognises that employment cannot run on consent alone. Two exceptions matter most:
- Evaluative purposes. Collecting, using or disclosing data to assess suitability, eligibility or qualifications for employment, promotion or continued employment. This covers references, interview notes and appraisal opinions. Notification is not required for this purpose.
- Managing or terminating the employment relationship. Collection that is reasonable for this purpose, such as bank details for salary, benefits administration and monitoring use of company IT. Here the employer must inform the employee of the purposes, and on request provide contact details for someone who can answer questions, under section 20 of the PDPA.
The PDPC's advisory guidelines on employment explain that the notice can be general and given through contracts, handbooks or intranet notices. Purposes outside managing the relationship, such as using staff photos in marketing, generally need consent.
Other laws that require HR data
The PDPA does not override other written laws. Where the Employment Act, the CPF Act, the Income Tax Act or work pass rules require an employer to collect or keep particular information, that requirement provides the authority to do so. The PDPA then governs how employee personal data in Singapore collected for those reasons is secured, who can see it and when it must be deleted. In practice, the legal requirement explains why data is held; the PDPA explains how it must be looked after.
Enforcement and penalties
The PDPC can direct organisations to stop collecting data, destroy data or take remedial steps, and can impose financial penalties. Since October 2022 the maximum penalty is 10% of annual turnover in Singapore for organisations whose local turnover exceeds S$10 million, or S$1 million otherwise. Employees can also bring private actions for loss caused by certain contraventions; see our guide to suing for a data breach.
Employee personal data in Singapore across the employment lifecycle
The legal basis for handling employee personal data in Singapore shifts as the relationship moves from application to exit. Mapping it stage by stage is the most reliable way to find gaps.
| Stage | Typical data | Usual basis | Watch-outs |
|---|---|---|---|
| Recruitment | CV, interview notes, assessments, references | Deemed consent for volunteered data; evaluative purpose | Do not ask for data irrelevant to the role; delay full NRIC collection until an offer |
| Onboarding | NRIC or passport, address, bank details, emergency contacts, work pass data | Legal requirement; managing the relationship | Notify purposes in the contract or privacy notice; emergency contacts are third parties |
| During employment | Attendance, leave, payroll, appraisals, training, medical certificates | Managing the relationship; evaluative purpose | Restrict access to medical and disciplinary data |
| Monitoring | Email, network logs, device data, CCTV, access cards | Managing the relationship, with notice | Proportionality and clear policy; covert monitoring needs strong justification |
| Investigations | Interview records, documents, device images | Managing or terminating the relationship; investigation exceptions | Confidentiality and need-to-know access |
| Exit | Termination records, final pay, references given | Managing or terminating the relationship | Accuracy of references; revoke system access promptly |
| After exit | Personnel file, payroll history | Legal or business purpose only | Set a retention period and delete when it ends |
Our employment policies team often uses this map to rewrite the employee privacy notice and the HR retention schedule together, so they say the same thing.
Recruitment, NRIC numbers and background checks
NRIC numbers
The PDPC's NRIC advisory guidelines, which took effect on 1 September 2019, restrict the collection of NRIC numbers and the retention of physical NRIC cards. Organisations may collect NRIC numbers where required by law or where it is necessary to establish identity to a high degree of fidelity. Employment is a clear case once a candidate is hired, because MOM, CPF and tax obligations require identification. Before an offer, there is rarely a reason to collect a full NRIC number, so application forms should not ask for one. The PDPC's NRIC guidance announcement links the guidelines and resources.
Do not use NRIC numbers as staff passwords, default login credentials or publicly visible staff identifiers. Use an internal employee number instead.
References and background checks
Under the evaluative purpose exception, a prospective employer can obtain a reference from a former employer, and the former employer can provide it, without the candidate's consent. In practice most employers still tell candidates that references and checks will be carried out, which avoids surprises and manages expectations.
Broader screening, such as credit or media checks, should be proportionate to the role. A screening vendor will usually act as a data intermediary or a separate organisation; the contract should set out its protection and retention duties. Where artificial intelligence tools are used to screen candidates, see our guide to AI in hiring.
Monitoring, CCTV and bring-your-own-device
Monitoring use of company computer networks is a recognised example of managing the employment relationship, so consent is not normally needed, but employees must be told. A clear acceptable use policy that explains what is monitored, why, and who can see the results is the foundation.
- Email and network monitoring. Explain the categories of monitoring, such as security logging, data loss prevention and investigations, and limit access to the results.
- CCTV. Place notices where cameras operate. For security reasons, an employer need not disclose exact camera locations, but cameras should not cover private areas such as toilets.
- Personal devices. Where staff use their own phones or laptops for work, the employer can control company data on the device but should avoid accessing personal content. Mobile device management settings and the BYOD policy should make that separation clear.
- Location and productivity tools. Keystroke logging, screenshot tools and location tracking are more intrusive. Consider whether the business need justifies them and assess the risks before deployment.
Before introducing any new monitoring tool, run a short data protection impact assessment. Ask what problem the tool solves, whether a less intrusive option would work, who will see the output, how long it will be kept and how employees will be told. PDPC treats impact assessments as good practice rather than a universal legal requirement, but a written assessment is the best evidence that monitoring of employee personal data in Singapore was proportionate if it is later questioned by an employee, a union or the regulator.
Employees can request access to their personal data, including CCTV footage in which they appear, subject to exceptions such as opinion data kept solely for evaluative purposes. Plan how you would extract and redact footage before a request arrives.
Retention after exit and access requests
The retention limitation obligation requires an organisation to stop retaining personal data, or anonymise it, once the purpose has ended and there is no legal or business reason to keep it. For employee personal data in Singapore, that means a written retention schedule rather than an indefinite archive.
Some periods are set by other laws. MOM's employment records rules require employers to keep employee and salary records for current employees covering the latest two years, and for former employees covering the last two years of employment for one year after they leave. Tax, CPF and limitation periods for potential claims may justify longer retention for some categories. The schedule should state each period and the reason.
Former employees often make access requests in the run-up to a dispute. Respond within the PDPA timelines, apply the exceptions carefully and do not withhold data simply because a claim is expected. If a claim is already in prospect, coordinate the response with your dispute advisers, because the same documents may later be disclosed in proceedings. Our performance improvement plan guide explains why appraisal notes should be written with that possibility in mind.
Responding to an HR data breach
HR breaches are common: a payroll file emailed to the wrong person, a misconfigured shared drive or a compromised HR system account. The PDPA's breach rules apply in full.
- Contain. Recall emails, revoke access, change credentials and secure systems. Record what was done and when.
- Assess promptly. PDPC guidance expects the assessment of whether a breach is notifiable to be completed within 30 days of becoming aware of it, and documented.
- Apply the thresholds. A breach is notifiable if it is likely to cause significant harm to affected individuals, or if it affects 500 or more individuals. Salary, bank, NRIC and medical data often meet the significant harm test.
- Notify the PDPC. Notify as soon as practicable, and no later than three calendar days after determining the breach is notifiable.
- Notify employees. Where significant harm is likely, tell affected employees, with practical guidance such as watching for phishing or changing passwords.
- Review and remediate. Identify the root cause, update training and controls, and record lessons learned.
HR teams should not investigate an HR breach alone. Bring in IT security and the data protection officer immediately, and keep a single incident log. The three-day clock for PDPC notification starts when you determine the breach is notifiable, so delay in assessing it is itself a risk. Our data breach response team supports incident handling.
Illustrative scenario: a misdirected bonus file
This scenario is illustrative only and does not describe any real client or matter.
An HR executive at a Singapore company with 300 staff emails a spreadsheet of names, NRIC numbers, salaries and bonus amounts to an internal distribution list instead of the finance director. About 120 employees receive it before the error is noticed.
The company recalls the email, asks recipients to delete it and confirm in writing, and disables forwarding. Fewer than 500 people are affected, but the data includes NRIC numbers and salaries, which the company concludes is likely to cause significant harm. It notifies the PDPC within three calendar days of that determination and tells the affected employees what happened and what it has done. It then introduces data loss prevention rules for spreadsheets containing NRIC numbers and restricts bonus files to a secure folder.
The key decisions were made quickly and recorded. That record is what the PDPC will examine in deciding whether the company met its protection and notification obligations.
Risks and common mistakes
Relying on a one-line consent clause
Many contracts say the employee "consents to the collection, use and disclosure of personal data for all purposes". This adds little. Most HR processing relies on the employment exceptions anyway, and a blanket clause does not satisfy notification for specific purposes. Replace it with a short employee privacy notice that lists the actual purposes, and seek specific consent only for purposes outside employment management.
Keeping everything forever
Archived personnel files of employees who left years ago are a breach waiting to happen. They add no value and expand the impact of any incident. Set retention periods by record type, automate deletion where possible and document any decision to keep data longer for a legal hold.
Monitoring without a policy
Reviewing an employee's email during an investigation is normally permissible, but doing so without a policy that told staff monitoring could occur creates argument and undermines trust. Publish a clear IT and monitoring policy, and make sure investigators follow it. Our workplace investigations page covers evidence handling.
Sharing data with group companies without a framework
Regional HR platforms often store Singapore staff data overseas or give regional managers access. Transfers outside Singapore must be protected to a standard comparable to the PDPA, usually through intra-group agreements or binding corporate rules. Check where the HR system stores data and who has access.
Cross-border transfers and next steps
Groups with staff across Singapore, Bangladesh, the UK, the UAE and China often centralise HR data in one platform. The PDPA's transfer limitation obligation requires that employee personal data in Singapore sent overseas receives a comparable standard of protection. Other jurisdictions may impose their own rules on the same data, such as UK GDPR for UK staff or China's personal information rules for mainland employees, so a group framework needs to reconcile them. TRW & Co advises on cross-border HR data arrangements and works with local counsel where needed.
A short checklist for employee personal data in Singapore:
- Map HR data by lifecycle stage and identify the basis for each category.
- Issue a clear employee privacy notice and a candidate notice.
- Stop collecting full NRIC numbers before an offer and remove NRIC-based logins.
- Publish an IT, monitoring and BYOD policy.
- Adopt a retention schedule aligned with MOM, tax and CPF requirements.
- Rehearse an HR breach response, including the 30-day assessment and three-day notification steps.
- Review overseas transfers and vendor contracts.
For a wider view of PDPA compliance see our data protection and PDPA practice. To review your HR data practices, contact our team.
Frequently asked questions
01Do employers need employee consent under the PDPA?
Usually not for core HR processing. The PDPA allows employers to collect, use and disclose personal data without consent where it is reasonable for managing or terminating the employment relationship, or for evaluative purposes. However, for managing the relationship the employer must notify employees of the purposes. Consent is still needed for purposes outside employment management, such as using employee photos in external marketing or sharing data with third parties for their own purposes.
02Can my employer read my work email?
Generally yes, if the employer has told staff that company systems may be monitored. Monitoring use of company computer networks is recognised in PDPC guidance as part of managing the employment relationship. The employer should have a clear IT or monitoring policy explaining what is monitored and why, and access to the results should be limited. Personal accounts and personal content on your own device are a different matter and need stronger justification.
03Can a former employer give a reference without my consent?
Yes. The evaluative purpose exception allows a former employer to disclose, and a prospective employer to collect, personal data to assess your suitability for employment without consent. The reference should still be accurate, and a reference that is deliberately false and damaging can raise separate legal issues. Many employers have a policy of confirming only dates and job title, which limits disputes.
04How long can employers keep ex-employee records?
Only as long as there is a legal or business purpose. MOM requires certain employee and salary records to be kept for former employees for one year after they leave, covering their last two years of employment. Tax, CPF and potential claim periods may justify longer retention for some records. Employers should set a written retention schedule and delete or anonymise data once each period ends.
05Can I ask my employer for a copy of my personal data?
Yes. Employees and former employees can make an access request for their personal data and information about how it has been used or disclosed in the past year, subject to exceptions. One important exception covers opinion data kept solely for evaluative purposes. The employer may charge a reasonable fee and should respond as soon as reasonably possible. Requests made in the run-up to a dispute must still be handled properly.
06Who is responsible for HR data protection in a company?
The organisation is responsible, and it must appoint at least one data protection officer and make the officer's business contact information available. In practice HR, IT and the DPO share the work: HR owns the processes, IT owns the security controls, and the DPO oversees policies, training, access requests and breach response.
Sources and official materials
- Personal Data Protection Act 2012 — Obligations, exceptions, breach notification and penalties
- PDPC Advisory Guidelines on Selected Topics: Employment — Employment exceptions, notification, monitoring and references
- PDPC: Updated NRIC advisory guidelines — Limits on NRIC collection and retention
- PDPC: Sample clauses and templates for employees and job applicants — Template notification clauses for HR
- Ministry of Manpower: Employment records — Mandatory HR records and retention periods
General information only, current as at 5 November 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
