How Long to Keep Customer and CV Data: The PDPA Retention Rule Singapore SMEs Get Wrong

Singapore's Personal Data Protection Act does not give you a number of days. It gives you a test: stop keeping personal data once the purpose you collected it for has passed, and once no law or live business need still requires it. Translated for a small company, that usually means customer and supplier records held five years for tax and accounting, employee records kept at least two years after the person leaves, and CVs from candidates you did not hire kept six to twelve months and then deleted. Three lines, written down once, applied before 31 December. That is the whole obligation.

What does the PDPA actually require?

Section 25 of the PDPA is the Retention Limitation Obligation. It says an organisation must cease to retain personal data, or remove the means by which it can be linked to a named individual, as soon as it is reasonable to assume the purpose for collecting it is no longer served and retention is no longer necessary for legal or business purposes.

Notice what is absent: a period. The regulator did not set one because a payroll record, a warranty record and a rejected job application have nothing in common. What the regulator does expect is that you decided, and can show the decision. An SME with a one-page retention schedule is in a far better position than one with eleven years of everything and a sincere explanation.

The cost of getting this wrong is not theoretical. Financial penalties under the PDPA can reach 10 per cent of annual turnover in Singapore for larger organisations, or one million dollars, whichever is higher. The more common consequence for a ten-person company is simpler and nastier: data you had no reason to still hold is in the folder the attacker reached, so a small incident becomes a notifiable one.

Which records does the law require you to keep, and for how long?

The retention limit never overrides a statutory keeping period. Work out the floor first, because you cannot delete below it:

• Tax and GST records: five years from the end of the relevant year of assessment or accounting period. Invoices, receipts, bank statements, anything supporting a figure you filed.
• Accounting records under the Companies Act: five years.
• CPF contribution records: five years.
• Employee records: for a current employee, the most recent two years. For someone who has left, two years from the date they left. Salary and key employment terms records sit here too.
• Work pass records: keep the documentation supporting a pass application or renewal for as long as the pass runs, plus a sensible tail for audit.

So a customer invoice is a five-year record, not a forever record. The customer's name and address inside it are protected personal data, but the invoice is also tax evidence, and tax wins until year six. After that there is no reason to keep the line item, and no reason to keep the contact row attached to a customer who stopped buying in 2019.

How long should you keep a CV from someone you did not hire?

This is where most small companies are quietly exposed, because nobody ever decided. Unsuccessful applications sit in a shared inbox, a Drive folder and three people's laptops, often for years, carrying dates of birth, NRIC numbers, salary history and sometimes photographs.

No statute sets a period for a rejected application. The purpose ended when you filled the role, so the default should be short: six months. Keep it for twelve only if you told the candidate you would consider them for future openings and they agreed. If you want a talent pool, ask at the point of application and record the answer.

One argument does run the other way, and it is worth taking seriously. The Workplace Fairness Act is expected to take effect in 2027, and a complaint about a hiring decision can arrive months after the interview. Your defence is the note explaining why the stronger candidate was chosen. Keep the assessment notes for a defined window, twelve months is reasonable, and delete the raw documents the candidate sent you. Notes about a decision are a much smaller liability than the candidate's identity documents.

Where is the data you have forgotten you hold?

A retention policy that only covers the main system is a policy that covers perhaps half the data. In a company of ten, the copies live in predictable places:

• The shared mailbox, where attachments are never deleted because deleting mail feels destructive.
• WhatsApp chats and exports, carrying customer addresses and order photos.
• Spreadsheet extracts pulled for a report in 2023 and still sitting in a Downloads folder.
• Old backups, which is the one to think hardest about. If you restore a four-year-old backup, you restore the data you deleted. Your retention schedule should state how long backups are kept, and that period should be months, not years.
• Laptops belonging to people who have left, which ties this directly to your offboarding checklist.

What does a workable retention policy look like for a ten-person company?

One page. For each category of data, three columns: what it is, how long you keep it, and who clears it out. Categories worth listing separately are customers, suppliers, employees, former employees, job candidates, marketing contacts and website enquiries. Add one line on backups and one on anonymisation, because deletion is not your only option. Sales figures stripped of customer identity are no longer personal data, so you can keep the trend forever and still meet the obligation.

Then diarise it. A retention policy that is not scheduled is a document, not a control. Once a year, after the books close, is enough for an SME.

What should you do before 31 December?

Give it an afternoon. List every place personal data sits, including the mailbox and the chat app. Write the one-page schedule with real dates. Delete the candidate files older than your new window, which is usually the largest and easiest win. Check that your backup retention is not silently undoing the deletions. Set the annual review date. Tell the team what the rules now are, in one short message, because the person who creates the stray copy is usually the one who never heard a rule.

The payoff is not only compliance. Less data means a smaller blast radius when something goes wrong, faster searches, and a straight answer if a customer ever asks what you hold about them.

Frequently asked questions

Does the PDPA specify a retention period in years?

No. The PDPA sets a purpose-based test rather than a fixed period. You stop retaining personal data once the purpose has passed and no legal or business need remains. Fixed periods come from other laws, mainly five years for tax, accounting and CPF records and two years for employee records after someone leaves.

Can we keep customer data indefinitely for marketing?

Only while the consent and the purpose remain live, and a dormant contact from six years ago is hard to defend as either. Separate the transaction record, which tax rules govern, from the marketing contact list, which consent governs. Marketing consent also carries its own Do Not Call obligations, so the list needs reviewing on its own terms.

Is anonymising data as good as deleting it?

Yes, if it is done properly. The PDPA accepts removing the means by which data can be associated with an individual. The test is whether re-identification is realistically possible, so stripping a name but leaving an NRIC number or a unique customer code does not qualify.