Key takeaways
  • An applicant who sends you their resume is treated as consenting to you using it to assess that application.
  • Using it for anything else, like future openings, needs you to tell them and get their consent.
  • Keep unsuccessful applicants' data only for as long as you have a business or legal need, then dispose of it.

What the PDPA allows when someone applies

Every time you hire, you collect personal data from people who are not your employees yet: resumes, contact details, employment history and sometimes salary expectations. Job applicants’ personal data is protected under the PDPA, even if you never hire them.

The good news is that the rules for the application itself are simple. PDPC’s guidance is that a person who voluntarily provides personal data in a job application may be deemed to consent to you collecting, using and disclosing it for the purpose of assessing that application.

If you hire them, you can reasonably continue using that data to manage the employment.

When you need to ask

Deemed consent only covers the application they actually made. For any other purpose, PDPC says you must tell the applicant what the purpose is and obtain their consent, unless an exception applies.

Common examples where SMEs get caught out:

  • Keeping resumes for future openings without telling the applicant
  • Sharing resumes with related companies or other branches
  • Adding applicants to a mailing list for company news

Reference and background checks

You don’t need the applicant’s consent to check references. PDPC’s guidance treats collecting personal data to determine a person’s suitability for employment as an evaluative purpose, and gives a reference from a former employer as an example.

How long to keep resumes

The PDPA doesn’t set a fixed number of months. PDPC’s guidance is that data collected from applicants who weren’t hired should only be kept for as long as it is necessary for business or legal purposes.

In practice:

  • Decide a retention period that fits your hiring, and write it down
  • Dispose of resumes securely when it passes, including copies in email and WhatsApp
  • Limit access to the people involved in the hiring decision
  • Collect only what you need at the application stage. Details like family background or religion rarely are.

A sample applicant notice

A short notice on your application form, job ad or careers page tells applicants how their data will be used, and gives you a clear record if anyone asks. Adapt the wording below to your business:

Personal data notice: By submitting this application, you agree that [Company Name] may collect, use and disclose your personal data to assess your suitability for employment. If you tick the box below, we will keep your details for up to [X] months to consider you for future openings, after which they will be securely disposed of. For questions, contact our Data Protection Officer at [email].

☐ Keep my details for future openings

The tick box matters. It’s what turns “future openings” from a grey area into consent.

Quick checklist

  • Application form or job ad tells applicants how their data will be used
  • Separate opt-in if you keep resumes for future openings
  • A written retention period for unsuccessful applicants
  • Resumes deleted on schedule, including copies in email and chat
  • Only the hiring team can access applications
Sources

General guidance only, not legal advice.

Written by
Eugene Ng

Eugene is the founder of Core Vault and acts as the appointed Data Protection Officer for Singapore businesses.