Personal Data Protection Act (PDPA) Policy

1. Status as a Data Intermediary

Under Section 4(2) of the PDPA, a "Data Intermediary" (DI) is an organization that processes personal data on behalf of and for the purposes of another organization pursuant to a contract evidenced or made in writing.

When Singapore employers subscribe to payroll.sg to compute salaries, generate payslips, file CPF, and submit IRAS AIS records, the employer acts as the primary data controller, and payroll.sg operates as the Data Intermediary. As a DI, payroll.sg is directly subject to the Protection Obligation and the Retention Limitation Obligation of the PDPA.

2. Protection Obligation (Section 24 PDPA)

payroll.sg makes reasonable security arrangements to protect personal data in its possession or under its control to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks.

Our security arrangements include:

1. Cryptographic Safeguards: High-grade AES-256 encryption for stored sensitive fields (including bank details and identification numbers) and end-to-end TLS 1.3 encryption for network data transit;
2. Infrastructure Security: Enterprise cloud infrastructure hosted exclusively within Singapore-based sovereign data center zones with SOC 2 Type II and ISO/IEC 27001 certifications;
3. Strict Identity & Access Governance: Principle of least privilege, two-factor authentication, granular role permissions, and session timeouts;
4. Continuous Vulnerability Monitoring: Regular automated penetration testing, vulnerability scanning, and third-party security audits.

3. Retention Limitation Obligation (Section 25 PDPA)

payroll.sg ceases retention of personal data, or removes the means by which the data can be associated with particular individuals, as soon as it is reasonable to assume that:

• The purpose for which that personal data was collected is no longer being served by retention of the personal data; and
• Retention is no longer necessary for legal, accounting, or Singapore statutory employment compliance purposes.

Clients are provided self-service tools to archive or expunge terminated employee records in compliance with their own internal corporate retention policies.

4. Mandatory Data Breach Notification Protocol

In accordance with the 2020 Amendments to the PDPA regarding mandatory data breach notifications:

1. If payroll.sg detects a potential security incident affecting Customer Data, our incident response team initiates containment and forensic assessment within 2 hours;
2. If the incident constitutes a data breach involving personal data processed on behalf of an Employer, payroll.sg will notify the affected Employer without undue delay;
3. We will provide the Employer with necessary technical particulars to facilitate prompt reporting to the PDPC and affected individuals within statutory timeframes where required by law.

5. Cross-Border Data Transfer (Transfer Limitation Obligation)

payroll.sg stores and processes all primary employee payroll databases within the territory of the Republic of Singapore. In the event that any secondary analytics or disaster recovery processing touches overseas systems, we ensure that the recipient organization is bound by legally enforceable obligations providing a standard of protection comparable to that under the PDPA.

6. Employer Responsibilities

As the primary data collector under the PDPA, the Employer is responsible for:

• Obtaining appropriate consent from employees (or relying on applicable statutory exemptions such as the employment relationship exception) to collect and process their personal data;
• Ensuring that personal data entered into payroll.sg is accurate and up to date;
• Safeguarding login credentials assigned to company payroll officers and human resource managers.