In this guide · 8 sections
- 01Job applicants: CVs, social media and unsuccessful candidates
- 02The employment exception: consent not needed, notification is
- 03Monitoring work devices, email and CCTV
- 04Appraisals, references and the evaluative purpose exception
- 05When employees leave: records, access and retention
- 06HR systems, access and staff responsibilities
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Employers may use employee data without consent where reasonable for entering into, managing or ending employment, but must notify staff of the purposes, for example in the handbook. References and appraisals fall under a separate evaluative purpose exception. Unrelated uses need consent.
The employment exception: consent not needed, notification is
Paragraph 10 of Part 3 of the PDPA's First Schedule lets organisations collect, use and disclose employees' personal data without consent where it is reasonable for entering into, managing or terminating the employment relationship. The PDPC is clear that employers must still notify employees of those purposes.
The PDPA does not prescribe how. The guidelines suggest employment contracts, employee handbooks or intranet notices, and say employers should keep staff updated about new purposes. A general notice covering, say, performance appraisals is enough; you do not need to notify again before each appraisal.
| Purpose (examples from the PDPC) | Consent needed? | Notify staff? |
|---|---|---|
| Pre-employment health screening, background or reference checks | No (employment exception) | Yes |
| Paying salary into the employee's bank account | No | Yes |
| Allocating computers and monitoring use of company network resources | No | Yes |
| Rosters, deployment, conduct and disciplinary checks | No | Yes |
| Staff photos in the intranet directory | No | Yes |
| Audits of claims and records; health and safety at work | No | Yes |
| Disclosing an employee's NRIC to a client for building access | Yes | Yes |
| Using staff photos in public marketing | Yes, unless another exception applies | Yes |
The last two rows show the boundary: purposes for the business or its clients that are not about managing the employment itself need consent. The PDPC's own example is a courier company that should get an employee's consent before passing their name and NRIC number to a client for building access.
Monitoring work devices, email and CCTV
Monitoring how employees use company computer network resources is one of the PDPC's listed examples of the employment exception. That covers things like security logging, email filtering and device management on company laptops, provided staff have been told.
Monitoring checklist
The guidelines add a general caution: even when an exception applies, organisations should act based on what a reasonable person would consider appropriate. Reading staff's personal messages on a company laptop is a very different thing from security logging. For cameras, see our CCTV and PDPA guide.
Appraisals, references and the evaluative purpose exception
A separate exception covers 'evaluative purposes', defined in section 2(1) of the PDPA to include deciding someone's suitability, eligibility or qualifications for employment, promotion or continued employment. Under it, you may collect, use and disclose personal data without consent, for example:
- obtaining a reference from a candidate's former employer;
- collecting performance records or opinions to evaluate an employee;
- giving a reference about a former employee to a prospective employer who is evaluating them.
Where the same data serves both purposes, the PDPC says employers need only notify staff of the employment-management purpose, not of the evaluation. Its example: collecting details of an employee's projects both to consider promotion and to audit their claims; the employer only needs to tell the employee about the audit.
When employees leave: records, access and retention
Section 25 of the PDPA (the Retention Limitation Obligation) requires you to stop keeping personal data once it no longer serves its purpose and is not needed for legal or business reasons. The PDPC says there is no fixed retention period. You may keep former employees' data for as long as there is a valid business or legal purpose, such as a policy of considering them for future roles, but not without a defined purpose.
Remove system access on the last day
Email, HR system, payroll, shared drives, SaaS apps and building access. Our employee offboarding IT checklist covers each step.
Decide what HR keeps and for how long
Separate records you must keep under other laws from those kept for business reasons, and set a period for each.
Write it into a retention schedule
Our data retention policy template gives a starting structure.
Delete or anonymise on schedule
Including copies in email attachments, spreadsheets and old laptops.
NRIC numbers deserve particular care throughout. Our NRIC collection rules guide explains when collecting them is allowed.
HR systems, access and staff responsibilities
The organisation is responsible for breaches caused by employees acting in the course of their employment, whether or not the employer knew. For offences, the guidelines note an organisation is not liable if it took practicable steps to prevent the employee's conduct, which is why written policies and training matter. 'Employee' under the PDPA also includes volunteers.
A common weak point is access that was never reviewed: a former manager still in the payroll system, salary spreadsheets on a shared drive, or HR folders open to the whole company. A quarterly review of who can see HR data is the simplest control.
Do it yourself or get help?
A small employer can cover most of this with a clear employee data notice in the handbook, a monitoring policy, a retention schedule and a habit of removing access promptly. Where it gets harder is untangling years of HR files across email, drives and apps.
IT Sorted's PDPA Compliance Pack (S$690) includes a personal data inventory, a staff data protection policy and a breach response plan. For larger teams, the Access Review & Leaver Tool (from S$1,200) lists who has access to what, sends quarterly review emails to managers, and runs a one-click leaver checklist with an audit trail.
Frequently asked questions
Not for purposes reasonable for entering into, managing or terminating the employment relationship, such as payroll, rosters, performance management or monitoring use of company IT. You must still notify employees of those purposes, for example in the contract or handbook. Purposes unrelated to managing employment need consent unless another exception applies.
The PDPC lists monitoring how employees use company computer network resources as a purpose that can fall under the employment exception, so consent is not required, but employees must be told. Monitoring should be reasonable, limited to company systems, and set out in a written policy.
The PDPA's evaluative purpose exception allows personal data to be collected, used and disclosed without consent where necessary to determine someone's suitability for employment, which covers references. Other obligations, such as confidentiality or the employment contract, still apply, so keep references factual.
There is no fixed period under the PDPA. You may keep data while there is a valid business or legal purpose, and must stop once there is none. Set retention periods for each type of HR record in a written schedule and delete or anonymise on time.
Only as long as necessary for business or legal purposes, according to the PDPC. If you want to keep CVs to consider applicants for future roles, tell them so and set a defined period. Applicants can request access to the data you hold about them.