PDPA Data Retention Clean-Up: Purge Your Customer Database Before Year End

Yes, your customer database needs a clean-up before 31 December, and the PDPA already requires it. Singapore's Personal Data Protection Act carries a retention limitation obligation: once the purpose you collected personal data for is finished, and no law requires you to keep it, you must stop retaining it or remove whatever identifies a person. Most Singapore SMEs have never run that purge. The practical window is the next ten weeks, before Black Friday and 12.12 pour another few thousand records into the same unmanaged system.

What does the PDPA actually require you to delete before year end?

The obligation is not that you delete everything, and it is not triggered by a customer complaint. It applies the moment retention stops being necessary for a business or legal purpose. A quote request from 2023 that never converted, a lucky draw entry form from a 2024 roadshow, a CV from a role you filled two years ago: none of those still serve a purpose, so holding them is a breach of the Act even if nothing bad ever happens to the data.

Two other pieces of the PDPA make this urgent rather than theoretical. First, breach notification is mandatory. If a breach is likely to cause significant harm, or affects a large number of individuals, you must notify the PDPC within three calendar days of deciding it is notifiable, and notify the affected people too. Second, the financial penalty ceiling now reaches up to 10 percent of annual turnover in Singapore for larger organisations, or one million dollars, whichever is higher. The size of your breach is decided by the size of your database. Every stale record is extra exposure you are not using.

You also need a named Data Protection Officer with contact details published somewhere a customer can find them. If yours is an ex-employee, that is a separate and very visible gap.

Which records should a Singapore SME purge first?

Work in order of risk, not order of convenience. The high-risk items in a typical SME here are:

• NRIC numbers and photographs or scans of NRIC and passports, including the ones sitting in WhatsApp chats and delivery records. Collection of NRIC has been restricted since September 2019 unless the law requires it or you must verify identity to a high degree of fidelity. Most SMEs holding them cannot justify either.
• Full card numbers typed into order notes, invoice remarks, or forwarded email threads.
• Leads and enquiries with no activity for two years or more, including abandoned carts and expired quotations.
• Job applicant files for closed roles, plus the shared inbox they arrived in.
• Ex-employee records held beyond the statutory period, and old payroll spreadsheets on a shared drive.
• Purchased, scraped or inherited marketing lists you cannot show consent for.
• CCTV footage held past the retention period your own notice promises.

What must you keep even when you want it gone?

A purge that deletes the wrong thing creates a different problem, so set the floor before you start. Tax and accounting records generally need five years of retention under IRAS and Companies Act requirements, CPF records five years, and employment records follow MOM rules on employee records and itemised payslips, which run in the order of two years for current staff and a further period after someone leaves. Treat those as minimums and confirm the current figures against IRAS and MOM guidance for your own situation, because the penalty for destroying a record you were required to keep lands on the same director.

The resolution is simple: a transaction record and a marketing profile are not the same asset. Keep the invoice, delete the browsing history, the abandoned cart, the chat transcript and the preference tags built around it.

Where do the forgotten copies hide?

This is where most clean-ups quietly fail. Deleting a contact in your CRM does nothing to the eight other places the same person lives. Check your email marketing platform, your e-commerce back end, exported spreadsheets in Google Drive or Dropbox, staff mailboxes, WhatsApp media folders, your accounting software, backups, and any test or staging database a developer loaded with real production data. Then check outside your walls: your agency, your fulfilment partner, your old web developer. Under the PDPA you remain responsible for personal data processed on your behalf, so the contract with each of those vendors needs a deletion clause and, ideally, written confirmation.

How do you run the purge in one working week?

Five short sessions are enough for a business with one or two systems.

1. Inventory. List every system and file store that holds personal data, who owns it, and roughly how many records. One page, no tooling required.
2. Retention schedule. For each category, write the keep period and the legal or business reason. Transactions five years. Unconverted leads two years. Applicant CVs six months. CCTV thirty days.
3. Approve. The business owner signs the schedule. This is the document that proves accountability if the PDPC ever asks, and it is worth more than the deletion itself.
4. Execute. Back up first, run the deletion, then keep a log of what was removed, when, and by whom. Never run an untested bulk delete against a live database on a Friday.
5. Automate and publish. Schedule the purge to repeat quarterly, update your privacy notice to match the schedule, confirm the DPO contact is current, and make sure Do Not Call register checks are part of your campaign process.

What does it cost you if you skip this?

Three costs, all of them real. The regulatory exposure is the obvious one, and it scales with how much you are holding. The second is quieter: stale addresses drive bounces and spam complaints, which damages email deliverability right when your festive campaigns need it, and wastes per-contact fees on platforms that bill by list size. The third is deal friction. Any client, insurer or acquirer running due diligence will ask for your retention policy, and cyber insurance renewals increasingly ask what personal data you hold and for how long. Having the answer written down takes a day. Not having it can hold up a renewal or a tender.

The sequencing argument is simple. Clean before the festive inflow, not after, so the records arriving in November and December land in a system that already knows when to let them go.

Frequently asked questions

Do we have to delete data if no customer has asked us to?

Yes. The retention limitation obligation is not request-driven. It applies as soon as the original purpose is served and no legal or business reason to keep the data remains. A customer request is a separate right, and you should be able to act on one, but waiting for requests is not compliance.

Can we keep a customer list forever for marketing if nobody unsubscribed?

No. Silence is not an ongoing purpose. If a contact has had no interaction with you for years, you need a documented reason to keep marketing to them, and separately you must honour the Do Not Call registry for Singapore numbers. An old list with no consent trail is a liability, not an asset.

Does anonymising count as deleting under the PDPA?

It can, provided the data genuinely cannot be re-associated with an individual. Replacing a name with a customer number is not anonymisation if the lookup table still exists. Aggregating sales by month and postal district, with identifiers removed, is. This route is useful when you want to retain trend data without retaining people.