Every employer in Singapore holds a surprising amount of personal information about its staff: NRIC and FIN numbers, home addresses, bank account details, salary history, medical certificates and CPF records. Employee data protection under the Personal Data Protection Act 2012 (PDPA) is therefore an everyday concern for HR and payroll teams, not just for marketing or IT departments. This article explains what the PDPA expects of employers, where payroll data creates particular risk, and how to build practical habits that stand up to scrutiny.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
Understanding employee data protection in Singapore matters because the Personal Data Protection Commission (PDPC) can impose financial penalties of up to 10% of an organisation’s annual turnover in Singapore or SGD 1 million, whichever is higher, for serious breaches. Smaller employers are not exempt simply because they have a handful of staff.
Who this applies to
The PDPA applies to private-sector organisations that collect, use or disclose personal data in Singapore. That includes Singapore-incorporated companies, branches of foreign companies, sole proprietors, partnerships and non-profit organisations. Public agencies are governed by separate rules.
Employees are protected in the same way as customers, but the Act treats employment data a little differently. Organisations may collect, use and disclose personal data for the purpose of managing or terminating an employment relationship without obtaining consent each time, provided they notify employees of the purposes. Job applicants and former employees are also covered, so recruitment files and leaver records need the same care as current staff records.
- HR managers, finance teams and directors who approve access to staff records.
- Companies that outsource payroll or HR administration. The employer remains responsible, even though the service provider acts as a data intermediary.
Key rules and requirements in Singapore
The PDPA sets out several data protection obligations. Those most relevant to HR and payroll are summarised below.
Notification and purpose
Employees should be told why their data is collected and how it will be used. This is usually done through an employment contract clause, a staff handbook or a separate employee privacy notice. Data may only be used for purposes a reasonable person would consider appropriate in the circumstances.
Protection obligation
Organisations must make reasonable security arrangements to prevent unauthorised access, copying, modification or loss of personal data. For payroll, this covers spreadsheets sent by email, payslips, GIRO files uploaded to a bank portal and the data passed to IRAS during annual filing.
Retention limitation
Personal data should not be kept longer than needed for a legal or business purpose. There is no single retention period under the PDPA. Instead, employers should look to other laws. For example, the Employment Act requires employment records to be kept for at least two years after an employee leaves, and the Income Tax Act requires records supporting tax filings to be retained for five years. Keeping everything indefinitely is difficult to justify.
NRIC and national identification numbers
PDPC advisory guidelines restrict the collection, use and disclosure of NRIC numbers unless required by law or necessary to establish identity to a high degree of accuracy. Payroll and CPF submissions legitimately require them, but photocopying NRICs for routine attendance or access purposes does not.
Data breach notification
Since 1 February 2021, organisations must notify the PDPC within three calendar days of assessing that a data breach is notifiable, which generally means significant harm to individuals or a breach of significant scale. Affected individuals must also be informed where significant harm is likely. A payroll file sent to the wrong recipient can easily meet that threshold.
Data Protection Officer
Every organisation must appoint at least one individual as its Data Protection Officer (DPO) and make the business contact information publicly available. The DPO does not need to be a lawyer or IT specialist, but should have enough seniority to influence how HR handles data.
Step-by-step process
A workable employee data protection programme does not need to be elaborate. The following sequence suits most small and medium-sized companies.
- Map the data. List every place employee data sits: HR files, payroll software, email, shared drives, cloud storage, recruitment portals and third-party providers.
- Appoint a DPO. Record the appointment in writing and publish a contact email address on your website or staff intranet.
- Issue an employee privacy notice. State the purposes for collection, who the data is shared with (for example CPF Board, IRAS, MOM, insurers and payroll providers) and how long it is retained.
- Restrict access. Limit payroll and salary information to those who need it, using role-based permissions and password-protected files.
- Secure transmission. Encrypt or password-protect payroll reports and never send passwords in the same email as the file.
- Review service providers. Confirm in the contract that outsourced payroll or HR vendors protect the data and will report any incident promptly.
- Set retention and disposal rules. Review old files at least annually and dispose of data securely once the legal retention period has passed.
- Prepare a breach response plan. Decide in advance who assesses an incident, who contacts the PDPC and how affected employees are informed.
Common mistakes to avoid
- Emailing payroll summaries to the entire management team when only finance and the director need them.
- Leaving salary spreadsheets on a shared drive that every employee can open.
- Assuming that outsourcing payroll transfers all PDPA responsibility to the provider. It does not.
- Failing to respond to access or correction requests from employees. Organisations generally have 30 days to respond to an access request.
- Treating the DPO appointment as a formality, with no training or authority behind it.
Practical examples
Example 1: A misdirected payslip email
An HR executive sends the monthly payroll report to a former employee whose email address was still in an autocomplete list. The report contains names, bank details and salaries for 40 staff. The company should assess whether the breach is notifiable, which is likely given the number of individuals and the financial data involved, and notify the PDPC within three calendar days if so. It should also contain the incident by asking the recipient to delete the file, and review how mailing lists are maintained.
Example 2: Outsourced payroll
A company with 25 employees uses an external payroll provider. Before sharing employee files, it checks that the service agreement contains data protection clauses, confirms where the data is stored and limits the information supplied to what payroll genuinely needs. The employee privacy notice is updated to mention that data is shared with the provider.
How a corporate secretary can help
A corporate secretary in Singapore usually sits close to the governance side of a company, which makes the role useful for data protection compliance. Raffles Corporate Services can help directors understand their oversight responsibilities, document DPO appointments in board resolutions, and keep statutory and HR-related records organised. Our team can also support payroll processing, CPF submissions, accounting and tax filings with IRAS, so that sensitive staff information is handled through controlled and consistent channels. As this article is general in nature, you should seek tailored advice for your own circumstances.
Frequently Asked Questions
Do I need employee consent to process payroll data?
Not in every case. The PDPA allows personal data to be collected, used and disclosed for managing an employment relationship, provided employees are notified of the purposes. Data needed to comply with the law, such as CPF and IRAS submissions, is also permitted. Using the same data for unrelated purposes may require consent.
Is a small company required to appoint a DPO?
Yes. The requirement applies regardless of company size. In a small business the director or a senior employee often takes on the role, and an external adviser may support them.
How long should we keep employee records?
The PDPA does not set a fixed period. Retention should follow legal requirements such as the Employment Act and Income Tax Act, along with genuine business needs. Once those no longer apply, the data should be deleted or anonymised.
Key takeaways
- The PDPA covers employee, job applicant and former employee data, and payroll files carry particularly sensitive information.
- Notify staff of the purposes for which their data is used, and keep access limited to those who need it.
- Appoint a DPO, publish their contact details and prepare a breach response plan, including the three-day PDPC notification window.
- Outsourcing payroll does not remove the employer’s responsibility under the PDPA.
- Follow legal retention periods, then dispose of data securely rather than keeping it indefinitely.
- Seek professional support if you are unsure how the rules apply to your company.
Requirements may change, so always check the latest guidance from ACRA, IRAS or MOM, or consult a professional adviser.
If you would like to find out more about how Raffles Corporate Services can assist with your company’s compliance and corporate secretarial requirements, please get in touch with the team at [email protected].
Yours sincerely,
The editorial team at Raffles Corporate Services
Disclaimer: This does not constitute legal advice. If you require legal advice, please contact a lawyer.