Handling Job Applicant Data Under PDPA: HR Compliance Guide

Every recruitment cycle, your HR team collects CVs, identity documents, salary expectations and referee details — some of the most sensitive personal data your organisation will ever hold. Getting PDPA compliance right when handling job applicant data is a legal obligation under Singapore's Personal Data Protection Act 2012, and a frequent source of complaints to the Personal Data Protection Commission (PDPC). This guide breaks down exactly what Singapore SMEs must do to collect, use, retain and dispose of applicant data lawfully — in plain, actionable terms.

TL;DR — Key Takeaways

• Job applicants are covered by the full PDPA; "deemed consent" applies when they voluntarily apply, but you must still notify them of your purposes.
• You can only collect data that a reasonable person would consider appropriate for assessing a candidate (PDPA Section 18).
• Set a documented retention period — the PDPC considers 6–12 months reasonable for unsuccessful applicants (Section 25).
• Get fresh, specific consent for background checks, talent pools, or sharing data with third parties.
• Breaches can attract financial penalties of up to S$1 million, or 10% of annual turnover in Singapore for organisations with turnover above S$10 million.

Does the PDPA apply to job applicant data?

Yes. Job applicants are individuals whose personal data is fully protected under the PDPA. The moment a candidate submits a CV, your organisation becomes responsible for that data under all of the Act's obligations — from consent and notification to protection and disposal. There is no "recruitment exemption."

A common misconception among Singapore SMEs is that PDPA obligations only begin once someone is hired. That is incorrect. The Act applies to any identifiable personal data your business collects, regardless of whether a hiring decision is ever made. This means the data of the 95 unsuccessful applicants is protected to the same standard as the one person you hire.

Note the distinction between applicants and current employees. Once a person becomes your employee, the PDPA's employment provisions (such as "deemed consent" for managing the employment relationship under the Third and Fourth Schedules) come into play. For broader rules on monitoring staff once hired, see our guide to employee monitoring and the PDPA. Until then, you are dealing with a member of the public, and the standard consent and notification rules apply in full.

Definitive statement: Under the PDPA, an unsuccessful job applicant has the same data protection rights as a paying customer — including the right to withdraw consent and to request access to the data you hold about them.

What applicant data can you lawfully collect?

The PDPA's Purpose Limitation Obligation (Section 18) allows you to collect only the personal data a reasonable person would consider appropriate for the recruitment purpose. In practice, this means role-relevant information — not everything a candidate might be willing to share.

The "reasonable person" test is the anchor. Ask: would a reasonable person consider it appropriate to collect this data to assess suitability for this specific role? Name, contact details, employment history, qualifications and references clearly pass. Data such as marital status, religion, or a photograph usually does not — and over-collection is one of the most common findings in PDPC recruitment matters.

Collect this (role-relevant)

• Full name and contact details
• Education, certifications and professional qualifications
• Employment history and referees
• Right-to-work status (work pass / citizenship, where required by MOM)
• Salary expectations and notice period

Avoid collecting this unless genuinely necessary

• NRIC number or a full copy of the NRIC. The PDPC's Advisory Guidelines on the NRIC and other National Identification Numbers state that organisations generally may not collect, use or disclose NRIC numbers except where required by law or necessary to accurately establish identity. You do not need an applicant's NRIC to shortlist or interview them — collect it only after a conditional offer, when required for the employment relationship.
• Marital status, religion, race (unless a bona fide occupational requirement)
• Health or medical information (collect only post-offer, where relevant to the role)
• Full bank or CPF details (only needed once employment begins)

Key figure: Illegally collecting or displaying NRIC numbers is one of the most penalised PDPA breaches in Singapore — several organisations have faced five-figure financial penalties for retaining or exposing NRIC data without a lawful basis.

Consent and notification: getting the basics right

When an applicant voluntarily submits an application for a role, the PDPA treats consent to process that data for recruitment as "deemed consent" — but you must still notify them of your purposes at or before collection, under Section 20. Deemed consent does not remove the notification duty; it only covers purposes an applicant would reasonably expect.

The cleanest way to meet this obligation is a short recruitment privacy notice on your careers page, application form, or job advertisement. It should state, in plain language:

1. What personal data you collect.
2. Why — e.g. to assess suitability, verify qualifications, and contact referees.
3. Who it may be shared with — e.g. hiring managers, a recruitment agency, or a background-check provider.
4. How long you will keep it.
5. Who to contact — the details of your Data Protection Officer (DPO), which every organisation is legally required to appoint under Section 11(3) of the PDPA.

Where you want to go beyond ordinary expectations — running a background or credit check, contacting a current employer, or adding a candidate to a talent pool for future roles — deemed consent does not stretch that far. You must obtain fresh, specific and express consent for each additional purpose. Never bundle these into a single mandatory tick-box; the PDPA prohibits making consent for an unrelated purpose a condition of applying.

Definitive statement: A recruitment privacy notice is the single most effective, low-cost control an SME can put in place to meet its PDPA notification obligations for job applicant data.

How long should you keep job applicant data?

The PDPA's Retention Limitation Obligation (Section 25) requires you to cease retaining personal data once it no longer serves any legal or business purpose. The PDPC generally regards a retention period of 6 to 12 months for unsuccessful applicants as reasonable. Indefinite retention is a breach.

There is no single statutory number, because "reasonable" depends on context. A practical, defensible retention schedule for most Singapore SMEs looks like this:

The key is to document your retention schedule and apply it consistently. "We'll keep CVs just in case" is precisely the reasoning the PDPC flags as non-compliant. When the period lapses, dispose of data securely — shred physical copies and permanently delete electronic files, including backups and any copies sitting in HR inboxes or shared drives.

For a full obligation-by-obligation walkthrough beyond recruitment, our PDPA compliance checklist for Singapore SMEs maps every requirement to a concrete action.

Protecting applicant data: security and third parties

The PDPA Protection Obligation (Section 24) requires you to make reasonable security arrangements to protect applicant data against unauthorised access, modification, disposal or loss. For HR data, this means both technical and organisational controls.

Practical safeguards every SME should have in place:

• Access control — restrict applicant files to hiring managers and HR on a need-to-know basis.
• Secure channels — avoid collecting CVs through unsecured personal email or messaging apps; use an applicant tracking system or a protected inbox.
• Encryption and strong passwords for devices and systems holding candidate data.
• Vendor due diligence — if you use a recruitment agency, job portal or background-check provider, they are your data intermediary under the PDPA. You remain accountable, so put a written data protection clause in the contract requiring them to protect and dispose of data appropriately.

Human error — not hacking — causes most Singapore HR data incidents: a CV emailed to the wrong candidate, an applicant spreadsheet with a public share link, or an old laptop disposed of without wiping. Under the mandatory Data Breach Notification regime (Part 6A, in force since 1 February 2021), a breach that results in significant harm or affects 500 or more individuals must be notified to the PDPC within 3 calendar days of assessment. If the worst happens, follow our step-by-step data breach response guide for Singapore businesses.

Because so many incidents trace back to staff behaviour, regular training is essential — see PDPA staff training requirements for building a data protection culture in your HR team.

What happens if you get it wrong? PDPA compliance penalties

Non-compliance with the PDPA can result in financial penalties of up to S$1 million, or up to 10% of an organisation's annual turnover in Singapore (whichever is higher) for businesses with annual turnover exceeding S$10 million. These enhanced caps took effect on 1 October 2022.

Beyond the financial penalty, enforcement carries reputational damage, loss of candidate trust, and the operational cost of remediation directives. The PDPC regularly publishes enforcement decisions, and recruitment- and HR-related breaches — over-collection of NRIC data, unsecured candidate databases, and excessive retention — appear frequently. Reviewing real outcomes is one of the fastest ways to understand your risk; our analysis of PDPA penalties and enforcement cases walks through what Singapore businesses can learn from them.

Definitive statement: The cost of PDPA compliance in recruitment is a fraction of the cost of a single enforcement action — most required controls are process changes, not expensive technology.

A practical PDPA compliance checklist for HR

Use this as a starting operating procedure for your recruitment pipeline:

1. Appoint a DPO and publish their contact details (mandatory under Section 11(3)).
2. Publish a recruitment privacy notice on your careers page and application forms.
3. Collect only role-relevant data — remove NRIC and sensitive fields from application forms.
4. Get express consent separately for background checks and talent pools.
5. Set a documented retention schedule (6–12 months for unsuccessful applicants).
6. Restrict access to candidate files and use secure collection channels.
7. Contract your data intermediaries (job portals, agencies) with PDPA clauses.
8. Securely dispose of data when the retention period lapses, including backups.
9. Train your HR team regularly on handling applicant data.
10. Log and respond to access and withdrawal requests within a reasonable time.

Keeping all of this consistent across every hire is where many SMEs struggle — policies drift, forms get outdated, and retention schedules go unenforced. This is exactly where ComplyHQ helps: AI-powered compliance that handles your PDPA obligations in minutes, not weeks — generating your recruitment privacy notices, retention schedules and DPO documentation tailored to your business. If you need custom HR or applicant-tracking systems built around these controls, Adaptels designs digital solutions for Singapore SMEs with compliance built in from the start.

Conclusion

Handling job applicant data under the PDPA comes down to four disciplines: collect only what is reasonable, notify applicants clearly, retain for a defensible period, and protect the data throughout. None of these require a large budget — they require consistent process. Put a recruitment privacy notice, a documented retention schedule, and basic access controls in place, and your organisation will be ahead of the majority of Singapore SMEs on recruitment PDPA compliance. Treat every CV as data you are accountable for, because under Singapore law, you are.

Sources & References

1. Personal Data Protection Act 2012 — Singapore Statutes Online
2. PDPC — Personal Data Protection Commission Singapore (Advisory Guidelines & Enforcement Decisions)
3. PDPC Advisory Guidelines on the NRIC and Other National Identification Numbers
4. PDPC — Data Breach Notification Obligation
5. Ministry of Manpower (MOM) — Employment Practices