Executive summary
6 months
after deactivation, an account and its face record are purged automatically
5 years
the period for which fuel transaction reports are retained
30 days
the period for which CCTV footage is held before it is overwritten
Key conclusions
- Retention involves three separate clocks for three kinds of data, and each needs a different period. A single policy sentence cannot cover all three.
- The Retention Limitation Obligation in Singapore's Personal Data Protection Act (PDPA) is met when the system deletes data as soon as the purpose for keeping it ends.
- When retention is built into the data layer, an auditor can check it with a database query instead of an interview.
Most retention policies are accurate when they are written and inaccurate within a year. A policy depends on somebody running a procedure, and a procedure depends on the person who knows it staying in the job.
The biometric fuel management system at PSA Marine's Brani and West Coast bases has run continuously since 2019. It verifies a launch master's face before fuel flows. The system therefore holds biometric data about identifiable people, in a security application, for a critical-infrastructure operator. That is close to the most demanding retention case a Singapore integrator will meet. The way the system handles it is worth describing, because its retention rules are built into the design instead of written in a policy.
One system applies three retention periods to three kinds of data
- Identity: a deactivated account and its face record are purged automatically six months after deactivation. The biometric record exists only while the person it authenticates is still authorised.
- Transactions: fuel transaction reports are retained for five years. They form the operational and financial record, and they outlive the identity record that created them.
- Surveillance: CCTV footage is held for 30 days. That is long enough to investigate an incident once it is known, and short enough that the footage does not become an archive of everyone who walked past.
- Across all three: access follows the principle of least privilege, so a person's role decides who can see a record before any retention rule applies.
The PDPA requires deletion once keeping the data no longer serves its purpose
The PDPA's Retention Limitation Obligation is simple to state: cease to retain personal data as soon as it is reasonable to assume the purpose for collecting it is no longer served by keeping it. The difficulty is that 'as soon as' requires a timer, and that timer has to run somewhere in the system.
Biometric data raises the stakes. The Personal Data Protection Commission's guidance on the responsible use of biometric data in security applications treats it as data that warrants a higher standard of protection. The reason is that a face, unlike a password, cannot be reissued after it leaks. A six-month purge tied to deactivation meets that standard: the system holds as few faces as it can, for no longer than it needs to.
Retention built into the data layer runs and can be audited without relying on staff
| Retention as a policy | Retention in the data layer |
|---|---|
| A document says records are deleted after six months | A scheduled job deletes them, and logs that it did |
| Someone runs the purge, when they remember | The purge runs whether anyone remembers or not |
| An auditor interviews the administrator | An auditor runs a query for the oldest record and reads the date |
| A departing employee takes the procedure with them | The procedure is in the schema, and the schema stays |
Specify four retention details before the build starts
- Every class of personal data the system will hold, and the purpose that justifies holding each one.
- For each class, the event that ends the purpose (deactivation, delivery or incident closure) and the retention period after that event.
- Where the purge runs, what it logs and how a reviewer confirms that it ran.
- The one class that must be kept longer than the others, and why. This is usually the transaction record, which is kept for a financial or regulatory period that the identity record does not need.
Only a retention rule that the system enforces stays accurate after the people who wrote it have left.
