In this guide · 8 sections
- 01What the PDPA retention rule actually says
- 02Legal reasons that require you to keep records
- 03Sample retention schedule for a small business
- 04How to write the policy in five steps
- 05Deleting data in Microsoft 365, Google Workspace and Shopify
- 06Retention checklist
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
The PDPA sets no fixed retention period. Keep personal data only while the purpose is still served or a legal or business reason needs it, then delete or anonymise it. Other laws set minimums, such as 5 years for tax and GST records. Write the periods down in a retention policy and follow them.
What the PDPA retention rule actually says
Section 25 of the Personal Data Protection Act is the Retention Limitation Obligation. An organisation must stop keeping documents containing personal data, or anonymise the data, as soon as it is reasonable to assume that the purpose for which it was collected is no longer being served, and that keeping it is no longer necessary for legal or business purposes.
The PDPC's advisory guidelines on retention add three points that matter in practice:
- there is no fixed duration; the period is judged on reasonableness, but you must still follow any legal or industry rules that apply;
- data must not be kept just in case it may be useful for some purpose you never told the person about;
- data in a locked cabinet, a warehouse or an electronic archive with limited access is still retained. Moving it to an archive folder does not count as deleting it.
Over-retention is not just a paperwork issue. Old data is still data that can leak. In a breach, records you should have deleted years ago still count, and they widen the harm. Our PDPA checklist shows where retention fits with the other obligations. This page is general information, not legal advice.
Legal reasons that require you to keep records
Some laws set minimum periods. These override any wish to delete early, and they count as a legal purpose under section 25.
| Record | Minimum period | Source |
|---|---|---|
| Business and tax records, invoices, receipts | At least 5 years from the end of the accounting period | IRAS record keeping |
| Employee and salary records (current staff) | Latest 2 years | MOM employment records |
| Employee and salary records (ex-staff) | Last 2 years, kept for 1 year after they leave | MOM employment records |
| Contracts | No fixed rule; PDPC example suggests about 7 years after a contract ends, given the 6-year limitation period for contract claims | PDPC retention guidelines |
If a dispute, claim or investigation is ongoing, keep the relevant records until it is closed, even past your normal period. That is a valid legal purpose.
Sample retention schedule for a small business
The PDPC says organisations should prepare a retention policy and, where data is kept for a long time, record the reason. A schedule like this is the core of that policy. The periods below are our suggested starting points where the law is silent, not legal requirements. Adjust them to your business and write down why.
| Data | Suggested period | Reason | Then |
|---|---|---|---|
| CVs of unsuccessful applicants | 6 months after the role is filled | Handle queries about the hiring decision | Delete, unless they agreed to be kept for future roles |
| Customer orders and invoices | 5 years after the accounting period | IRAS minimum | Delete or anonymise |
| Customer marketing list | Until they unsubscribe, or 2 years with no engagement | Consent for marketing | Remove from the list |
| Website enquiry form emails | 12 months if no business resulted | Follow-up and record of contact | Delete |
| CCTV footage | A rolling period long enough to notice incidents, such as 30 days | Security | Overwrite automatically |
| Ex-employee files | 1 year after leaving for MOM records; longer for tax or disputes | MOM and IRAS | Delete what is no longer needed |
| Copies of NRIC or passport | Only if a law requires it, and only as long as it does | Legal requirement | Delete as soon as possible |
CCTV and NRIC copies have their own pitfalls. See our guides on CCTV and the PDPA and NRIC collection rules.
How to write the policy in five steps
A retention policy for a small business fits on two pages. It does not need legal language. It needs to be followed.
List where personal data lives
Email, shared drives, accounting software, your online store, booking tools, WhatsApp, paper files and backups. Your personal data inventory is the starting point.
Group data into record types
Use the categories in the sample schedule: customers, marketing, recruitment, staff, CCTV, suppliers.
Set a period and a reason for each
Use the legal minimum where there is one. Where there is not, choose a period you can explain and write the reason next to it.
Decide how deletion happens and who does it
Automatic rules where the software allows, a named person and a calendar reminder where it does not.
Review once a year
Check the schedule against new tools, and confirm the deletions actually happened. Keep a short note as evidence.
Deleting data in Microsoft 365, Google Workspace and Shopify
Most deletion can be automated. The main tools:
- Microsoft 365: retention policies in Microsoft Purview can delete email, OneDrive and SharePoint content after a set period. Check which features your plan includes before relying on them.
- Google Workspace: Google Vault retention rules can delete Gmail and Drive data after a set period. Google lists Vault in Business Plus and higher editions.
- Shopify: from a customer profile, choose More actions, then Erase personal data. Shopify processes the request and you have 10 days to cancel it.
- Shared drives: give each record type its own folder so you can delete a whole year at once.
- Recruitment: if CVs arrive by email, move them to one folder and clear it on a schedule.
Emptying the recycle bin matters. The PDPC lists deleted data still sitting in an un-emptied recycle bin as an example of data that may still be within reach.
Retention checklist
Use this to check your current state.
Data retention checklist
If someone asks what data you hold about them, a clean retention set-up also makes the answer easier. Our PDPA access request guide covers that process.
Do it yourself or get help?
You can write a workable retention policy yourself in an afternoon using the sample schedule above. The harder part is mapping every place data sits and turning on the deletion rules.
Our PDPA Compliance Pack (S$690) includes a personal data inventory from an online questionnaire, a privacy policy, a staff data protection policy and a breach response plan. Retention periods are part of that inventory, so you end up with one consistent set of documents.
Frequently asked questions
The PDPA does not set a fixed period. You may keep customer data while the purpose you collected it for is still being served, or while a legal or business reason requires it. For example, IRAS requires business records for at least five years. Once those reasons end, delete the data or anonymise it so it no longer identifies anyone.
There is no fixed legal period for CVs. Keep them only as long as you need them for the hiring decision and any follow-up questions, often a few months after the role is filled. If you want to keep a CV for future openings, ask the applicant and record their agreement. Write your chosen period in your retention policy.
No. The PDPC guidelines say personal data in a locked cabinet, a warehouse or an electronic archive with limited access is still retained. To stop retaining it, you must destroy or delete it, return it, or anonymise it so it can no longer be linked to particular individuals.
The PDPA does not strictly require a separate document, but the PDPC says preparing a retention policy is good practice, and that long retention periods should have a written reason. A short schedule also helps you show reasonable compliance if there is a complaint or a breach investigation.
Yes. Section 25 allows you either to stop retaining the documents or to remove the means by which the data can be associated with particular individuals. Properly anonymised data, such as sales totals by month without names or contact details, can be kept for reporting. Make sure it cannot easily be re-identified.