In this guide · 9 sections
- 01How the PDPA applies to recruitment agencies
- 02Consent before sending a CV to a client
- 03How long to keep old CVs
- 04When candidates ask what data you hold
- 05What to check in your ATS vendor contract
- 06AI screening, fairness and job ads
- 07Emailing candidates about new roles
- 08Do it yourself or get help?
- 09Frequently asked questions
Short answer
Under the PDPA, recruitment agencies must tell candidates why they collect their data and get consent before sharing CVs with clients, delete CVs once no longer needed, answer access requests and check their ATS vendor contract covers security, retention and overseas storage.
How the PDPA applies to recruitment agencies
PDPC's Advisory Guidelines on the PDPA for Selected Topics has an employment chapter that speaks directly to agencies. Its main points:
| Situation | What PDPC says | What it means in practice |
|---|---|---|
| Candidate applies to your job ad | Consent may be deemed for assessing the application | Using the CV to assess them for that role is fine |
| Agency collects candidate data | Must inform of purposes and obtain consent, unless an exception applies | Tell candidates you will share their CV with client employers, and get consent |
| Profiles on job portals or public sites | Publicly available data needs no consent; portal profiles posted to be contacted may give deemed consent | Contacting someone about roles is usually fine; reusing data for other purposes is not |
| Business cards | Business contact information is outside the main PDPA obligations | A work email on a card is not covered; a personal mobile on a CV is |
| Agency processing for a client under a written contract | May act as a data intermediary with fewer obligations | Protection, retention and breach notification still apply |
If you also hold an MOM employment agency licence, the licence conditions add their own rules on documents and advertising. Our employment agency website guide covers those.
Consent before sending a CV to a client
The most common agency risk is sending a candidate's CV to a client without asking. Even where consent might be deemed for one role, sending the CV to several employers, or months later for a different role, goes beyond what the candidate expected.
Explain your purposes at registration
In your registration form and privacy notice, state that you will assess candidates, share CVs with client employers for suitable roles and contact them about future opportunities.
Confirm before each submission
Before sending a CV, confirm the role and client with the candidate by email or WhatsApp, and record their yes in your ATS.
Send only what the client needs
Remove NRIC, home address, date of birth and other identifiers the client does not need at shortlisting stage.
Record where each CV went
Log every client a CV was sent to. You need this for access requests and if a candidate withdraws consent.
Honour withdrawals
If a candidate withdraws consent, stop sending their CV and tell them the likely consequences, as the PDPA requires.
How long to keep old CVs
PDPC's guidelines say that once a hiring decision is made, data collected from other applicants should be kept only as long as necessary for business or legal purposes. Its chapter on the Retention Limitation Obligation says organisations must stop keeping personal data, or anonymise it, once the purpose is no longer served and retention is no longer needed for legal or business purposes.
Agencies do have a business reason to keep active candidates for future roles, but not forever. A practical approach:
Candidate data retention
When candidates ask what data you hold
Candidates sometimes ask why they were not shortlisted or what an agency holds about them. PDPC's guidance says job applicants can ask for the personal data an organisation holds and how it was used in the past year. However, opinion data kept solely for an evaluative purpose, such as interview assessments of suitability, does not have to be disclosed.
You must respond as soon as reasonably possible, and if you need more than 30 days, tell the candidate in writing within 30 days when you will reply. Our guide to responding to PDPA access requests walks through the process and fees.
What to check in your ATS vendor contract
Your ATS holds the whole database, so it is effectively your data intermediary. Under the PDPA you remain responsible for personal data a data intermediary processes on your behalf.
- Security: encryption, MFA for all users, role-based access, audit logs and how quickly the vendor reports breaches to you.
- Data location and transfers: where data is stored, and the vendor's commitments if it is outside Singapore, so you can meet the PDPA's transfer limitation obligation.
- Retention and deletion: can you set automatic deletion rules, and does deletion include backups within a stated time?
- Exit: export of all candidate data in a usable format, and confirmed deletion when you leave.
- Sub-processors and AI features: which third parties process data, and whether candidate data is used to train the vendor's AI models.
If you notice a breach, assess it quickly. Notifiable breaches must be reported to PDPC no later than 3 calendar days after you assess that they are notifiable.
AI screening, fairness and job ads
Many ATS tools now rank or summarise CVs with AI. PDPC's Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, issued 1 March 2024, encourage organisations to tell people in plain language how their data is used by such systems, proportionate to the risk.
Responsible AI screening
- Candidates told that AI helps sort applications
- A consultant reviews every rejection decision
- Criteria based on skills and job requirements
- Regular spot checks for unfair patterns
Risky AI screening
- Automatic rejections nobody reviews
- Ranking on age, nationality or gender signals
- No record of why a candidate was filtered out
- Pasting CVs into free consumer chatbots
Fair hiring rules apply whether a person or a tool makes the shortlist. TAFEP's recruitment guidance covers job ads, application forms and interviews. The Workplace Fairness Act 2025 had not commenced as of 19 October 2026. Our careers page and TAFEP guide lists the wording to avoid.
Emailing candidates about new roles
PDPC's guidelines note that a message sent solely to promote an employment opportunity is not a specified message under the Do Not Call provisions. Job alerts to candidates are therefore outside the DNC rules, though the PDPA's consent and purpose rules still apply. Promoting other products, such as paid courses or CV-writing services, is marketing and the DNC rules can apply to phone numbers.
Give every job alert an easy unsubscribe, keep alert preferences in the ATS, and do not add candidates to client marketing lists.
Do it yourself or get help?
Most of this is process: a clear privacy notice, consent before each submission, a retention rule and an ATS that logs everything. The technical side is making sure CVs do not leak through personal inboxes and shared folders.
Our PDPA Compliance Pack (S$690) covers your privacy policy, data inventory, staff data protection policy, DPO notes and breach response plan. Microsoft 365 / Google Security Lockdown (S$590) enforces MFA and file-sharing rules for consultants, and Workflow Automation (S$390 per workflow) can automate consent reminders or retention clean-ups.
Frequently asked questions
Generally yes. PDPC's guidance says recruitment agencies must inform job applicants of the purposes for collecting, using and disclosing their personal data and obtain consent, unless an exception applies. Good practice is to confirm each role and client with the candidate before the CV is sent, and to keep a record of that confirmation.
Only as long as it is needed for business or legal purposes. PDPC says data from applicants who are not hired should be kept only as long as necessary for business or legal purposes, and then deleted or anonymised. Many agencies set a fixed period after last contact and ask candidates whether they want to stay on file.
You can ask for the personal data the agency holds about you and how it was used or disclosed in the past year. PDPC's guidance says opinion data kept solely for evaluative purposes, such as assessments of your suitability, does not have to be provided, so the agency may not share its reasons.
The agency remains responsible under the PDPA for personal data processed on its behalf by a data intermediary such as an ATS provider. Choose vendors with strong security, written data protection terms and prompt breach notification, and be ready to assess and, where required, notify PDPC within 3 calendar days of assessing a breach as notifiable.
PDPC says a message sent solely to promote an employment opportunity is not a specified message under the Do Not Call provisions. Messages promoting other products or services, such as paid training, can be. The PDPA's consent rules still apply to job alerts, so offer an easy way to unsubscribe.