Personal Data Protection Act 2010

What PDPA covers in a workplace setting

The Personal Data Protection Act 2010 (Act 709) regulates processing of personal data in commercial transactions. For employers, that includes candidate applications, employee records, payroll data, performance files, and many vendor-shared lists containing identifiable individuals.

The seven Personal Data Protection Principles

• General Principle — process with consent or another lawful basis; purpose must be lawful and related to your activity; data must be adequate but not excessive.
• Notice and Choice — inform individuals what you collect, why, who may receive it, and how they can limit processing.
• Disclosure Principle — do not disclose beyond the stated or directly related purpose without a valid ground.
• Security Principle — take practical steps to prevent loss, misuse, unauthorised access, alteration, or destruction.
• Retention Principle — do not retain personal data longer than necessary for the original purpose.
• Data Integrity Principle — keep data accurate, complete, not misleading, and up to date where needed.
• Access Principle — individuals must be able to access and correct their personal data.

Rights employees and candidates can exercise

• Right of access — request whether data is processed and obtain a copy in intelligible form.
• Right to correct — request correction of inaccurate, incomplete, misleading, or outdated data.
• Withdrawal of consent — where processing is consent-based.
• Right to prevent processing likely to cause damage or distress, in defined circumstances.
• Direct marketing controls — individuals can require you to stop processing their data for direct marketing.

Sensitive personal data and higher care

Sensitive personal data includes information on physical or mental health condition and other categories defined in the Act. Processing this data attracts stricter conditions. Health declarations, medical certificates linked to identity, and certain HR investigation files need tighter access control and clearer purpose limits.

Common employer gaps

• No clear privacy notice at recruitment or onboarding
• Shared drives with open access to employee folders
• Keeping unsuccessful candidate data indefinitely
• Sending employee lists to vendors without purpose and safeguards
• No process for access or correction requests
• Cross-border transfers of HR data without checking transfer conditions

Practical PDPA starter checklist

• Map what personal data HR actually holds
• Publish internal and external privacy notices
• Set retention periods for recruitment and employee files
• Restrict system access by role
• Train managers not to forward personal data casually on chat apps
• Document how you respond to access and correction requests

Make PDPA operational for HR teams

CXCons designs practical, HRDC-aligned sessions on workplace data handling, recruitment compliance, and PDPA responsibilities for people managers.