Singapore’s Personal Data Protection Act (PDPA) does not impose a universal seven-year deletion rule. Section 25 requires organisations to stop retaining personal data, or remove the means of linking it to individuals, when the original purpose no longer needs it and no further legal or business reason justifies keeping it. The gold standard is to manage that decision responsibly across databases, backups, vendors, paper records and genuine legal holds.
A useful retention programme answers five everyday questions: What data are we keeping? For which real purpose? Who decides when that purpose ends? Which separate duty requires continued preservation? And how will we verify the right copy was securely deleted or anonymised? A policy file alone is not enough if expired data still appears in active systems.
This article owns the policy and verification of retention decisions. The Gold Standard of Personal Data Access Request Handling addresses individual access and correction, The Gold Standard of Personal Data Breach Notification Governance data-breach notification, The Gold Standard of Legal Hold Management litigation holds, The Gold Standard of Records Management Services broader recordkeeping and The Gold Standard of Document Shredding Services the specialised shredding service.
Find the information you need
Chapters 1–6 identify lawful purpose, ownership and triggers; 7–15 deal with real storage and disposal; 16–19 cover change, verification and continuous accountability.
Open the 19-chapter index
- Start with the purpose, not a universal number of years
- Distinguish purpose limitation from retention limitation
- Create a data inventory that reflects real systems
- Name the owner of each retention decision
- Identify other laws and genuine business needs carefully
- Give each record category a usable end trigger
- Separate active records from archives and backups
- Build secure physical disposal instead of ordinary rubbish clearance
- Understand electronic deletion as a verified technical outcome
- Recognise that anonymisation must actually break identification
- Create lawful exceptions for evidence and legal holds
- Handle access and correction requests without premature deletion
- Control retention duties imposed on suppliers
- Limit unnecessary access while data awaits deletion
- Check what a destruction certificate actually certifies
- Review retention when a service or purpose changes
- Protect records that belong to children and vulnerable people
- Make accidental retention discoverable
- Close the full lifecycle with documented accountability
1. Start with the purpose, not a universal number of years
A personal-data retention policy cannot begin with the assumption that every record should be kept for seven years or that everything must disappear after twelve months. Different categories of information serve different purposes and may be subject to different legitimate legal or business requirements. In Singapore, section 25 of the Personal Data Protection Act (PDPA) creates a retention-limitation obligation based on whether the original purpose still requires retention and whether other legal or business reasons remain. It does not prescribe one fixed number of years for all data.
The practical first step is to name each important category of personal data, the reason it was collected and the activity it supports. Ask what will show that the purpose has ended, who is authorised to decide that and which separate duties may require preservation. The gold standard is a defensible life cycle from collection to final disposal rather than a spreadsheet copied from another organisation’s retention calendar.
2. Distinguish purpose limitation from retention limitation
Collecting information for a particular service and keeping that information after the service ends are connected but not identical decisions. A business might legitimately ask for a delivery address to fulfil an order, then continue holding some transaction data for accounting or other genuine obligations. It should not silently retain every location detail forever because it might be commercially useful one day. PDPA sections 18, 20 and 25 address purpose, notification and retention in different ways.
Record the notified purpose and any other lawful basis or continuing reason for storage. Where a new use is proposed, assess that separately rather than disguising it as the original purpose. The retention register should identify the event at which the main purpose has been fulfilled. This helps staff explain why one transaction record remains while an outdated delivery instruction can be safely removed. Responsible purpose management avoids both unjustified hoarding and premature destruction.
3. Create a data inventory that reflects real systems
Personal information may be stored in a customer-management application, invoices, chat messages, email attachments, project folders, downloaded spreadsheets, paper files and outsourced systems. A deletion policy covering only the main database can leave identical material available through uncontrolled exports. Conversely, trying to enumerate every temporary technical artifact before understanding the real data flows can stall a project for months.
Map the important categories, custodians, systems, suppliers, storage locations and people who legitimately use them. Identify whether the organisation holds the data or controls it through a service provider. Note common duplicate and export routes. Use proportionate sampling to find stores that ordinary diagrams miss. A credible inventory is maintained when systems change, not produced once for an external audit. Its purpose is to make effective decisions possible without creating another sensitive master file accessible to everyone.
4. Name the owner of each retention decision
If every employee is told to delete data when no longer needed, nobody may know who determines that a case has actually ended. A helpdesk worker could erase evidence required for a complaint; a department head could keep private files indefinitely because they are occasionally interesting. Both are governance failures, not simply technical mistakes.
Assign a responsible business owner for the purpose, a data-protection adviser for applicable safeguards, a records or IT executor and an escalation route for legal uncertainties. These functions can overlap in small organisations, but decisions and execution should still be traceable. The PDPC’s key-concepts guidance emphasises reviewing personal data regularly and developing a retention policy appropriate to an organisation’s operations. The gold standard makes authority visible before someone can press a destructive button.
5. Identify other laws and genuine business needs carefully
Some records are needed for tax, company governance, employment, ongoing contractual administration or legal proceedings. The reason may be legitimate even after a customer has stopped using the original service. But an untested statement that every file might be needed in future litigation can justify indefinite storage of nearly anything. Retention should be tied to a real duty or reasonable business need.
For each extension beyond the original purpose, record the source, affected data class, responsible professional and anticipated end condition. Check the applicable law rather than inventing a global period. The PDPC guidance describes legal proceedings and statutory recordkeeping among relevant considerations and expressly rejects ‘just in case’ retention without a proper reason. A quality review should be able to identify which particular information a continuing obligation covers and which unrelated copies can be removed.
6. Give each record category a usable end trigger
A calendar may be convenient, but some retention clocks start at account closure, final payment, contract termination or completion of a defined service. A policy saying ‘delete after two years’ is ambiguous when nobody knows which event starts counting. Event-driven retention also needs an owner to confirm that the event occurred and the related information is no longer needed.
Write triggers in operational language: the relevant event, any minimum lawful period and the conditions that would pause disposal. Test difficult examples, such as a reopened complaint or replacement product issued after the original order. Avoid embedding an unverified calculation into automated deletion jobs. A reliable register links the record category to its real business and legal context, so staff can apply the policy consistently without improvising the date.
7. Separate active records from archives and backups
A record may be removed from a customer-facing account while remaining in internal archives or backup copies. The technology and obligations differ across these systems. A backup used for resilience is not necessarily an appropriate everyday archive, and restoring an old backup can unintentionally bring expired personal data back into active use.
Map normal storage, authorised archives, backup retention and recovery workflows separately. Establish how expiry is applied to each according to the actual platform capabilities and lawful requirements. Where immediate item-level deletion is technically unavailable from immutable backups, seek competent security and legal advice about a proportionate retention, access and expiry plan. Test restoration procedures to prevent reactivating records that should no longer be available. Do not falsely certify that all copies are gone because one visible profile has disappeared.
8. Build secure physical disposal instead of ordinary rubbish clearance
Paper records can contain names, identity numbers, medical details or payments. Tearing a page into two pieces or placing it in an office waste bin may allow someone to reconstruct sensitive information. The PDPC’s Guide to Disposal of Personal Data on Physical Medium discusses shredding, secure handling and appropriate protection for physical records.
Assess sensitivity and the risks during collection, storage, transport and destruction. Use controlled bins or secure custody where necessary and verify the disposal arrangement. Do not leave identifiable documents in common areas awaiting a scheduled collection. A destruction contractor’s receipt is helpful evidence of a service, but the organisation still needs reasonable assurance about scope and handling. The separate Document Shredding Services article owns the industrial service; this governance article decides what should be disposed of and how that is authorised.
9. Understand electronic deletion as a verified technical outcome
Moving files to a recycle bin or deleting the visible shortcut may not remove data from the underlying storage. Old devices, exported databases and synchronised folders can retain sensitive information. A staff member might believe that clicking Delete completed a legal obligation while another user can still retrieve the record through an ordinary system function.
Set technology-specific controls and use competent personnel for secure erasure or media destruction. The PDPC’s guide to securing personal data in electronic media recommends secure deletion, erasure or destruction before storage media are redeployed or disposed of. Choose measures appropriate to the system, the information and the applicable duty rather than copying a generic list of commands. Verify the outcome on representative authorised samples and document known technical limits. This guide is about accountable governance, not a do-it-yourself forensic erasure procedure.
10. Recognise that anonymisation must actually break identification
Section 25 allows an organisation to cease retaining documents containing personal data or remove the means by which the information can be associated with individuals. Removing names alone may not achieve the latter outcome when other fields can identify a person. A rare combination of dates, roles and locations might reveal identity even after obvious labels are deleted.
Assess re-identification risks with appropriate expertise, taking account of related datasets and reasonable available information. The PDPC provides separate practical anonymisation guidance. Distinguish genuine anonymisation from pseudonymisation, where a key or linked dataset still permits re-identification. Explain the resulting permitted uses and controls accurately. A company should not advertise a dataset as fully anonymous merely because it replaced customer names with sequential codes.
11. Create lawful exceptions for evidence and legal holds
A deletion schedule may collide with an ongoing investigation, threatened dispute, court proceeding or another legitimate preservation need. Automatic destruction can cause harm if it removes records that must remain available. Yet placing every employee record on a permanent legal hold simply to avoid making retention decisions creates a different privacy and security problem.
Require an authorised legal evaluation of when targeted preservation is necessary, which sources it covers and how it will be reviewed. Record the hold identifier, scope, responsible owner and conditions for release. The existing Legal Hold Management Gold Standard owns this specialist lifecycle. Ordinary retention should resume appropriately when the legal basis ends, after checking overlapping obligations. The gold standard keeps genuine evidence intact without converting a lawful exception into indefinite storage of unrelated data.
12. Handle access and correction requests without premature deletion
An individual may request personal-data access or correction while a records team is planning ordinary disposal. The applicable statutory rights and preservation duties must be assessed before any potentially consequential deletion. A company’s wish to reduce records does not authorise erasing disputed information to make an access request easier to answer.
Coordinate with the Data Protection Officer and the request owner, preserving relevant information when the law requires it. The PDPA includes specific requirements concerning some data refused under the access provisions. Keep the decisions separate: a request does not create a universal indefinite hold, but a normal deletion job should not quietly frustrate a pending lawful review. Consult the Personal Data Access Request Handling article for that separate process. Accurate timelines and documented reasoning protect both individual rights and lawful disposal.
13. Control retention duties imposed on suppliers
A software provider may host customer information or make backups in a different environment. Cancelling a service contract does not necessarily prove the vendor has disposed of every personal-data copy. The organisation’s responsibilities depend on the PDPA, actual control and contractual arrangements, while data intermediaries have their own relevant obligations.
Build appropriate return, deletion, subprocessor and retention terms into procurement and exit planning. Ask the vendor what data are held, how requests are verified and what documentation can reasonably be supplied. Avoid claiming a universal right to remotely inspect every proprietary system. The organisation should know which data remain with a supplier for a genuine legal reason and when ordinary copies are due to expire. A vendor certificate should be tested against the agreed scope rather than treated as magic proof.
14. Limit unnecessary access while data awaits deletion
A record may still need to be retained but no longer require routine access by a large sales or administrative team. Waiting for the final disposal date with unchanged permissions exposes people to avoidable access and disclosure risks. Retention and access are distinct but complementary controls.
Restrict archived or legally preserved data to appropriate roles and legitimate uses. Remove stale permissions, monitor necessary access and prevent accidental reactivation through analytics or marketing systems. Under PDPA section 24, organisations must make reasonable security arrangements for data they hold or control. A dated retention reason does not remove that protection obligation. The gold standard reduces exposure throughout the waiting period, not only during final destruction.
15. Check what a destruction certificate actually certifies
A contractor may issue a certificate showing collection of paper or erasure of selected devices. It cannot automatically certify that the customer organisation has no duplicate records in other systems or that the legal retention decision was correct. The evidence needs a precise relationship to the service performed.
Record the data category, authorised batch or media identifiers, custody and disposal method, service provider, date and any exception or rejected item. Compare completed work with the approved scope and reconcile differences. Avoid unnecessary disclosure of individual identities in broadly circulated certificates. If the evidence does not cover backup copies or another store, say so explicitly. A truthful partial verification is more useful than an unsupported statement that all personal data has been permanently eliminated.
16. Review retention when a service or purpose changes
A business may move to a new software platform, redesign a product or stop offering an old service. Its prior retention rules may no longer describe where personal information lives or why it is retained. A decommissioned system can become a forgotten archive containing data that nobody owns.
Require a retention review for material migrations, acquisitions, vendor changes and retired services. Identify which information must transfer for legitimate needs, which remains subject to a hold and which can be disposed of. Avoid using system migration as a pretext for copying every historical customer record indefinitely. Test archived data access after migration and update the data inventory. A strong programme makes change control part of ordinary project governance rather than a last-minute compliance sign-off.
17. Protect records that belong to children and vulnerable people
Some information can be especially sensitive because it concerns a child, health-related needs or a vulnerable individual. A school or welfare organisation may have legitimate reasons to maintain certain records, but that does not justify releasing or indefinitely retaining every informal note. Errors in disposal and inappropriate access can have substantial personal consequences.
Identify applicable statutory, professional and protective duties with qualified staff. Design proportionate access, retention and secure disposal controls that account for the affected population without promising one universal rule for every child-related record. Where safeguarding records must be preserved, the right competent authority should direct the decision. Do not assume that an ordinary personal data deletion request overrides every child-protection or legal duty. The goal is protection, dignity and accountable care.
18. Make accidental retention discoverable
Auditors sometimes focus only on records deleted too early. Data retained too long creates its own risks, particularly when old personal details remain indexed and easily accessible through new tools. A business may repeatedly import expired records into marketing lists because nobody tests what the retention controls actually do.
Conduct representative checks of old cohorts, retired accounts, data exports and restored backups. Compare findings to the approved purpose and actual legal obligations. A detected issue should lead to a documented correction, not merely removal of the offending sample. If exposure constitutes a notifiable data breach under the applicable law, the separate Data Breach Notification Governance process may be triggered. The gold standard can identify over-retention without waiting for a public complaint or security incident.
19. Close the full lifecycle with documented accountability
The objective is not to delete as much as possible or to keep everything under a reassuring legal label. Records can be valuable, but individuals should not be exposed to avoidable risk from information kept without legitimate reason. Organisations need decisions that are both operationally feasible and legally justified.
Measure whether each material category has a current purpose, clear retention trigger, named owner, proper hold mechanism, effective access controls and verified disposal route. Escalate uncertain duties before destruction. Maintain sufficient records of decisions without recreating a giant file of the underlying personal data. A mature system can explain what it kept, why, when it stopped needing it and how secure disposition was demonstrated. That is the gold standard of lawful personal-data retention and disposal.
Original worked example: the closed account that keeps reappearing
A fictional Singapore service provider closes a customer account after the contract ends. The profile disappears from its main app, and the support manager tells the customer that all data have been erased. Several months later, an old email address appears in a promotional export generated from a reporting server. IT also finds archived spreadsheets and a backup copy held by a hosting supplier. The original closure step was genuine, but the blanket erasure claim was not supported by the systems inventory.
The organisation maps the customer information by purpose and system. Relevant statutory or contractual records are separately assessed for continuing legitimate retention, while expired operational exports are removed through authorised and verified procedures. The team restricts archive access, asks the vendor to confirm contractual disposal coverage and checks how old snapshots could be restored. No one deletes a record under a genuine legal hold merely to make a dashboard green. A privacy specialist reviews whether the unexpected use or disclosure has any separate data-breach implications.
After technical verification, the business corrects its customer communication to describe what has been removed, what remains for specific lawful reasons and any known limitations. It updates the account-closure workflow so a single deletion request reaches relevant active systems, scheduled exports and supplier processes. The gold-standard outcome is not a theatrical ‘100% deleted’ badge. It is a truthful, purpose-limited and independently testable end of the information’s life cycle.
What a useful retention record contains
| Field | What to verify | Weak shortcut |
|---|---|---|
| Purpose | Specific legitimate collection and use | “Keep everything for business” |
| Trigger | Confirmed event starting review | Universal number copied from another firm |
| Continuing need | Legal or genuine business basis | “Might be useful one day” |
| Scope | Live systems, archives, copies and vendors | Main database only |
| Action | Approved deletion, anonymisation or legal hold | Unreviewed Delete command |
| Proof | Tested, recorded result and exceptions | Inaccurate erasure certificate |
Retention and disposal quality checklist
- Identify every material personal-data category and legitimate purpose.
- Separate purpose limitation from the later retention decision.
- Assign accountable owners for law, business needs and disposal.
- Define the actual event that starts each retention clock.
- Record genuine statutory, contractual and legal-preservation exceptions.
- Include relevant suppliers, exports, archives and backups.
- Keep retained archives under appropriate access controls.
- Use secure physical shredding or authorised destruction where appropriate.
- Apply tested electronic erasure or media disposal methods.
- Distinguish true anonymisation from simple name removal.
- Protect access and correction rights during disposal decisions.
- Release legal holds through documented, qualified review.
- Verify vendor certificates against the actual scope.
- Test restored systems for reactivated expired personal data.
- Record uncertainty honestly and use findings to improve controls.
Frequently asked questions
Does the PDPA require all companies to delete data after seven years?
No. Section 25 does not set a universal period. The retention decision depends on the purpose and any continuing legal or business reasons.
Can we keep every customer’s information forever just in case?
An indefinite generic justification is not enough. The PDPC says data must not be kept merely for speculative purposes that were not properly established.
Does deleting a customer profile prove all copies are gone?
No. Archives, exports, backups and vendor systems may retain copies. A verified lifecycle plan must account for the actual systems.
Can we anonymise information instead of retaining identifiable data?
Section 25 permits removing the means by which data can be linked to individuals, but anonymisation must genuinely address re-identification risk.
May a legal hold override the normal disposal schedule?
A genuine legal preservation requirement can justify targeted retention. The hold should be authorised, scoped and eventually reviewed for release.
Is placing a sensitive page in an ordinary recycling bin secure disposal?
Not generally. The PDPC advises methods such as suitable shredding and controlled custody for sensitive physical records.
Can we trust a vendor’s deletion certificate without checking scope?
A certificate is useful only for what it actually covers. Verify the records, systems and media included and document exclusions.
Is over-retention also a data protection risk?
Yes. Information held unnecessarily creates continuing access and breach exposure as well as potential non-compliance with the retention limitation obligation.
The gold standard is a justified and provable end of retention
Good data stewardship does not equate professionalism with either maximum storage or maximum deletion. The organisation should keep what legitimate law and business require, protect it while it is held, and stop retaining identifiable information when the reasons end. No single timer can safely make every decision.
The most trustworthy evidence is a linked record of purposes, triggers, lawful exceptions, controlled execution and independent checks. When those elements work together, the organisation can answer a customer’s question truthfully and reduce unnecessary exposure without destroying valuable evidence. That is responsible privacy governance in practice.
Singapore law and PDPC references
Singapore Statutes Online — PDPA section 25: Retention of Personal Data
Singapore Statutes Online — PDPA Part 6: Protection, Retention and Transfers
PDPC — Advisory Guidelines on Key Concepts, Chapter 18 (Retention Limitation)
PDPC — Guide to Disposal of Personal Data on Physical Medium
PDPC — Guide to Securing Personal Data in Electronic Medium
PDPC — Basic Anonymisation and Its Limits
Connected eduKate Gold Standard guides
The Gold Standard of Personal Data Access Request Handling
The Gold Standard of Personal Data Breach Notification Governance
The Gold Standard of Legal Hold Management
The Gold Standard of Records Management Services
The Gold Standard of Document Shredding Services
Featured photograph shows a public search computer in Singapore’s National Library Building as an editorial illustration of digital records, not a live personal-data system or a deletion operation.
Editorial review: 20 October 2026. Educational governance guidance only, not a ruling on a particular record’s retention period or permission to destroy material under legal duty. Confirm current legislation and seek competent privacy, records and legal advice.