PDPA for HR: Minimum Data Habits

Collect less, share less, store shorter

PDPA-minded HR practice is operational: minimum necessary data, need-to-know access, and retention limits. Most incidents are ordinary — IC numbers in WhatsApp, offer letters forwarded widely, exit files kept forever “just in case.”

Everyday controls that matter

• Do not broadcast IC numbers, bank details, or medical notes in group chats
• Lock HR folders to role-based access — not “anyone in management”
• Define retention for applications, disciplinary files, and exit packs
• Train line managers not to forward sensitive attachments casually

A simple test before you share

• Does this person need this field to do their job today?
• Can we mask or partial-display the identifier?
• Is there a system path better than email or chat?

Raise privacy awareness across people managers

Browse related learning and compliance reading with CXCons.