You are the organisation
The PDPA places obligations on the organisation that collects, uses and discloses personal data. When you run OTG HRMS on your own infrastructure, that organisation is you. There is no vendor standing between you and the obligation, because there is no vendor.
This is the trade. You gain complete control over your employees' data and freedom from anyone else's pricing and terms. You take on obligations that a SaaS contract would otherwise have partly absorbed.
The obligations, and what the software does about each
| Obligation | What it means | What OTG HRMS provides |
|---|---|---|
| Consent / notification | Tell people what you collect and why. Employment data is largely collected under the employment exception, but you still notify. | Nothing. Write a privacy notice. |
| Purpose limitation | Use the data only for the purposes you stated. | Nothing. This is a policy discipline. |
| Accuracy | Keep it correct and current. | Employees maintain their own contact and emergency details. |
| Protection | Reasonable security arrangements. | Encryption of identifiers, role-based access, audit logging, session revocation, security headers. |
| Retention limitation | Stop keeping data once its purpose has ended. | A scheduled purge job. You set the periods. |
| Transfer limitation | Comparable protection when data goes overseas. | Nothing. Choose your hosting region and get processing agreements. |
| Access and correction | Respond to individuals' requests for their data. | Self-service JSON export, plus admin correction tools. |
| Accountability | Appoint a DPO, have policies, be able to demonstrate compliance. | The audit log is evidence. The rest is organisational. |
Read that table's third column carefully. Four of the eight obligations get no help from software at all. Anyone selling you an HRMS as "PDPA compliance" is overstating what software can do.
The five things to do before you go live
- 1Appoint a Data Protection Officer. Required by law for every organisation. It can be an existing employee and their business contact details must be published. Register the details with ACRA.
- 2Write an employee privacy notice. What you collect, why, who it is shared with, how long you keep it, and how to make an access request. One page is enough. Give it to every employee and to every new joiner.
- 3Do a data inventory. List what OTG HRMS holds — identity, contact, NRIC, salary, leave and medical certificates, claims and receipts, emergency contacts, children's dates of birth, performance documents — plus where each lives and who can reach it.
- 4Set retention periods. The Employment Act requires employment records to be kept for a period after an employee leaves; your tax and audit obligations may require longer. Decide, write it down, configure the purge to match.
- 5Write a breach response plan. Notifiable breaches must be reported to the PDPC within three calendar days of your assessment, and affected individuals must be told. Decide now who assesses, who notifies, and who talks to staff.
The sensitive fields, specifically
- NRIC. The PDPC's guidance restricts collecting NRIC numbers to where it is required by law or necessary to verify identity to a high degree of fidelity. Employment records qualify. Do not use NRIC as a login identifier or an employee reference number. In OTG HRMS it is encrypted at rest, masked in the interface, and every decryption is logged.
- Medical certificates. Health data. Restrict who can view MC uploads and apply a defined retention period.
- Salary. Masked by default in the interface. Consider who genuinely needs admin access — the smaller that group, the smaller your exposure.
- Children's dates of birth. Collected only to compute childcare leave. Do not collect more about family members than that purpose needs.
Handling an access request
An employee is entitled to ask what personal data you hold about them and how it has been used. Point them at the export on their profile page — it covers most of what they are asking for and needs no involvement from you. Where a request goes beyond it, the response deadline is 30 days, and if you cannot meet that you must tell them when you will.
Limiting your exposure
Practical measures, roughly in order of return on effort:
- Collect less. Every optional field you leave empty is data that cannot leak. Payroll and bank details were removed from this system partly for that reason.
- Grant fewer admin roles. Most people who "need admin" need approver.
- Delete on schedule. Data you no longer hold cannot be breached, and retention limitation requires it anyway.
- Turn off the third-party integrations you do not need. No OCR key means receipts never leave your deployment.
- Keep the audit log. When something goes wrong, being able to show exactly who accessed what is the difference between a contained incident and an unbounded one.
- Test your restore. Availability failures are the most likely incident you will actually have.
The software's own position
OTG HRMS is provided as-is, with no warranty, under an open-source licence. Nobody operates it on your behalf, nobody has access to your database, and nobody can be your DPO. If you want a party that carries contractual responsibility for operating it, that is a service arrangement — see Hosting and support.