Access requests
Any employee can download a complete JSON export of their own data — profile, leave applications and entitlements, claims, and policy acknowledgements — from their profile page, without going through HR. Under the PDPA an organisation must respond to an access request; handling the common case as self-service means most requests never become a ticket.
The export excludes stored secrets. Password hashes never appear. Encrypted identifiers are reported as a presence flag (nricOnFile: true) rather than decrypted into a file that will end up in someone's downloads folder. Each export writes an audit entry.
Retention
The PDPA requires you to stop retaining personal data once the purpose it was collected for has ended and there is no legal reason to keep it. A scheduled purge job removes aged records on that basis. The retention periods are yours to set — the system provides the mechanism, not the policy, because the right period depends on your obligations under the Employment Act and your own tax and audit requirements.
Deletion
Employee deletion runs through the two-step request-and-approve flow described under employee records, and cascades to that person's dependent data. The audit entry for the deletion survives it, because the record that a deletion happened is itself something you may need to produce.