Employee Data Privacy in Singapore: HR Compliance Guide for SMEs

When a new client asked me to review her HR processes last year, I found a shared Google Drive folder labeled "Staff Files." Inside: unencrypted payroll spreadsheets with NRIC numbers, salary details, and bank account information for every current and former employee going back five years. The folder was accessible to the entire 25-person team — including the intern who started last week.

That single folder represented at least three PDPA violations. And this company was not unusual.

TL;DR: A practical PDPA compliance guide for Singapore SME HR teams — covering employee data consent, retention policies, breach obligations, and PDPC penalties.

Most Singapore SME owners think the PDPA is mainly about customer data. It is not. Your HR processes sit at the heart of your compliance obligations. From the moment you post a job ad to the day you archive a former employee's records, you are collecting and processing personal data — and some of the most sensitive data your business holds.

Payroll details, medical certificates, performance reviews, bank account numbers, NRIC copies — the PDPC has made clear through enforcement decisions that employee data deserves the same rigour as customer data.

What Counts as Employee Personal Data?

The PDPA defines personal data broadly: anything that can identify an individual, alone or in combination with other information. In HR, this covers:

• Identity documents: NRIC, passport, FIN for foreign employees
• Contact information: Home addresses, personal phone numbers, personal email
• Financial data: Bank account details, CPF records, salary history
• Medical and health data: Medical certificates, screening results, disability disclosures
• Employment records: Performance reviews, disciplinary records, termination letters
• Biometric data: Fingerprints from time-attendance systems
• Photos and video: Employee profile photos, CCTV footage of workspaces

One important nuance: business contact information — work email, job title — is generally excluded under Section 4(5). But personal contact details are fully covered. The line matters, especially with remote work blurring the personal-professional boundary.

Key PDPA Obligations for HR

1. Get Proper Consent

Include a Personal Data Collection Notice in job application forms. Get written consent for sensitive data collection (medical records, background checks). Make sure employees understand what their data will be used for before signing employment contracts.

The PDPC's Advisory Guidelines allow deemed consent in limited circumstances — like when an employee voluntarily provides bank details for payroll. But relying on deemed consent without documentation is risky. Written consent is always safer.

2. Tell People Why

Even with deemed consent, the Notification Obligation requires you to inform employees of the purposes. Provide a written Employee Data Protection Notice at onboarding. Update it whenever processing changes — like when you introduce new HR software. Ensure job candidates get a privacy notice at or before the point of first data collection.

3. Collect Only What You Need

Do not collect NRIC numbers at initial screening when a name and phone number suffice. Do not gather next-of-kin data without a clear purpose. Do not keep complete files for every rejected applicant indefinitely. The PDPC has specifically flagged unnecessary NRIC collection as a compliance concern.

4. Protect Data in Storage and Transit

Store HR files in access-controlled systems, not open shared drives. Password-protect and encrypt files containing sensitive data when emailing. Restrict access to people who actually need it. Revoke access promptly when someone leaves. Train anyone handling HR data on basic protection practices.

The PDPC has fined organisations for sending unencrypted payroll files by email and for leaving HR records on unsecured shared servers. These are avoidable mistakes.

5. Retention and Disposal

Employment Act and CPF Act require keeping payroll records for at least 5 years. After that period expires, you need a documented disposal process: shred physical records, securely delete digital files. Maintain a written Data Retention Schedule specifying how long each HR data category is kept and why.

Employee Rights Under PDPA

Access (Section 21): Employees can request their personal data and information about how it has been used or disclosed in the past year. You must respond within 30 calendar days.

Correction (Section 22): If data is inaccurate, employees can request correction. You must act as soon as practicable.

Withdrawal of Consent (Section 16): Employees can withdraw consent at any time. This does not apply to data you must retain by law (CPF records, MOM documentation).

Have a documented process for handling these requests — who receives them, how identity is verified, and how responses are logged.

Common HR Compliance Mistakes

No employee privacy notice at onboarding. Standard employment contracts that say nothing about data protection leave you exposed.

Photocopying NRIC cards for every applicant. The PDPC's 2018 advisory set clear limits. Routine NRIC collection in recruitment files without specific legal basis is a breach.

No vendor agreements. If you use a third-party payroll provider or HR software, you need a data processing agreement. The PDPA holds you responsible for ensuring vendors protect data adequately.

No breach response plan. The mandatory notification obligation requires notifying PDPC within 3 calendar days of assessing a notifiable breach. Most SMEs have no documented protocol.

Keeping ex-employee data forever. Once legal retention periods pass, holding full HR files without justification is exposure. Regular audits and a documented schedule are not optional.

What Non-Compliance Costs

Under the amended PDPA, fines reach up to S$1 million or 10% of annual Singapore turnover — whichever is higher.

Published enforcement examples:

• S$10,000 for emailing an unencrypted Excel file with 120 employees' payroll data to the wrong recipient
• S$5,000 for failing to revoke system access for resigned employees
• Multiple organisations directed to engage external auditors at significant cost

Beyond fines, PDPC decisions are publicly searchable. For a small business, the reputational damage from a published enforcement decision — visible to current and prospective employees — can outweigh the financial penalty.

Building a Compliant HR Process

Immediate:

• Draft and implement an Employee Data Protection Notice
• Review your job application form — remove unnecessary fields
• Map what employee data you hold and where
• Check vendor agreements for data processing terms

Within 30 days:

• Create a Data Retention Schedule for all HR records
• Establish a process for access and correction requests
• Audit HR system access — revoke unnecessary permissions
• Run basic PDPA training for anyone handling HR data

Ongoing:

• Review your employee data inventory annually
• Test your breach notification process at least once a year
• Monitor PDPC guidance and enforcement trends

For Singapore SMEs managing compliance alongside every other business demand, platforms like ComplyHQ handle the complexity — AI-powered compliance with policy templates, data mapping, and breach workflows built for Singapore's regulatory environment.

The Bottom Line

Employee data privacy is not a secondary compliance concern — it applies from your first job application. The PDPA and the PDPC's enforcement record make the expectations clear.

Getting it right does not require enterprise resources. A clear privacy notice at onboarding, a retention schedule, proper access controls, and a documented breach plan will put you ahead of most organisations the PDPC has taken action against.

Start with the fundamentals, document your decisions, and review annually. The investment protects your business from regulatory risk and signals to your employees that their most sensitive information is in responsible hands.

Sources

1. MOM — Ministry of Manpower
2. PDPC — Personal Data Protection Commission
3. Personal Data Protection Act 2012

Looking for more? Check out Adaptels.