Before adding a background check to recruitment, a Singapore company should identify what information will be collected, why it is relevant to the role, what the applicant has been told and who will receive the results. Updating a recruitment form is only part of the work. The hiring team and the screening provider also need consistent instructions about scope, access and record handling.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The PDPC’s notification obligation concerns explaining the purposes of personal-data handling. A new check should therefore prompt a review of the existing notice and process, not an assumption that an old broad sentence covers every possible investigation.
Define the check before drafting the notice
Describe the proposed information and the decision it is intended to inform. A qualification verification is not the same exercise as collecting a wide range of personal history. Ask why the information is appropriate for the particular role and whether a less intrusive way could address the genuine concern.
Check applicable employment, privacy and sector requirements where relevant. Do not assume that a check is lawful or useful merely because a provider offers it. Sensitive, disputed or unusual checks should receive advice before the company collects the information.
Map the applicant journey
Follow the process from application to shortlist, screening, hiring decision and record retention. Identify the points at which the company, an agency or a vendor handles the data. A notice provided only after the information has been collected may not address what happened earlier.
| Stage | Question to resolve |
|---|---|
| Application | What information is collected directly from the applicant? |
| Shortlist | Who decides that the proposed check is relevant? |
| Vendor instruction | What data and sources may the vendor use? |
| Result review | Who receives the report and handles uncertainty? |
| File closure | What is retained, restricted or deleted? |
Make the notice understandable
Describe the purpose in ordinary language and distinguish the screening activity from unrelated uses such as future marketing. Explain the relevant parties or categories of recipient and the company’s contact route. Review the applicable basis for collection, use and disclosure, including consent where required and any relevant exception.
A notice should not make the applicant responsible for guessing which checks “may be conducted from time to time”. It should be accurate enough to reflect the actual process. Avoid copying a provider’s generic wording without checking whether it describes your company’s instructions.
Align the vendor’s work with the company’s decision
- Specify the scope, permitted sources and intended output.
- Identify who may receive the report and how it will be delivered.
- Agree how the vendor will raise incomplete or conflicting information.
- Check subcontracting, overseas handling and incident escalation.
- Review the return, retention and deletion arrangements for the data.
These instructions should be reviewed with the service agreement and any relevant data-protection clauses. A confidentiality promise alone does not answer every question about personal-data processing.
Example: an overseas qualification needs clarification
A vendor cannot confirm an applicant’s qualification because the awarding institution has changed its name. The hiring team should distinguish an unresolved verification from a finding that the qualification is false. Preserve the result, seek appropriate clarification and check the accuracy of any information used in a hiring decision. Do not convert an uncertain report into a categorical accusation.
Control the recruitment file after the decision
Limit access to those with a relevant role. Record the reason for retaining information and the planned review rather than keeping a complete screening archive indefinitely by default. If the applicant becomes an employee, decide which information belongs in the employment file and which working material should remain restricted.
Can one notice cover every job?
Review whether the actual purposes and checks differ. A company may use a common framework, but role-specific activities still need an accurate explanation.
Should all interviewers receive the complete report?
Decide what each person needs for their task. Routine circulation can expose personal information unrelated to the interviewer’s role.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.