Employer record-keeping obligations: a comparison

Employers across the Asia-Pacific region are required to maintain employment records, but the requirements vary across jurisdictions. Necessarily, the records will contain employee personal data and employees may also have the right to access that data.

To give you a better idea of the requirements across Asia, we compare employers’ record-keeping obligations and employees’ data access rights across Singapore, Hong Kong and Thailand below.

What record-keeping duties do employers have with respect to employee information?

Singapore
The Employment Act 1968 (EA) and the Employment (Employment Records, Key Employment Terms and Pay Slips) Regulations (Regulations) require employers to keep records of employee data as set out in First Schedule of the Regulations.

There are different retention periods applying to different data. For instance:

• Personal particulars, along with first day and last day of period of continuous employment, must be kept for the duration of employment and for one year after the last day of employment.
• Each entry to an employee record relating to particulars such as leave records, salary period, salary and allowances, overtime, and deductions must be kept for two years after the entry is made and, if the employment terminates, for one year after the last day of employment.

There are also various record-keeping obligations under other laws and regulations. For instance:

• Rule 11 of the Central Provident Fund Rules requires employers to retain record of payments given by the Central Provident Fund Board for a period of not less than two years from the date on which it was issued.
• The Workplace Safety and Health (Incident Reporting) Regulations require occupiers of a workplace to keep records of notification or reports for at least three years from the date of the notification or report.
• Employers are required to retain proper records on all employee incomes and deductions submitted to the Inland Revenue Authority of Singapore (IRAS) for five years.

Employers should also take note of the relevant limitation periods for bringing claims (eg. the actions founded on a contract must be brought within six years). The Advisory Guidelines on Key Concepts in the Personal Data Protection Act recommends retaining records relating to contracts for seven years from the date of termination of contract, and possibly longer, if an investigation or legal proceeding commences within that period.

Real estate firm OrangeTee & Tie had to pay $37,000 following a data breach that compromised the information of 250,000 employees and customers.

Hong Kong
Pursuant to the Employment Ordinance, employers are required to keep wage and employment records of each employee covering the preceding 12 months of the employment period. These records should include the following employeeparticulars:

• name and identity card number
• date of commencement of employment
• job title
• wages and wage period
• periods of leave (including annual leave, sick leave, maternity leave, paternity leave and holiday)
• amount of end-of-year payment and the payment period
• notice required for termination of contract
• the date of termination of employment.

After the termination of employment, the wage records must be kept for another six months. In respect of other records relating to the employee's personal data, the Code of Practice on Human Resources Management, a non-binding guidance issued by the Privacy Commissioner for Personal Data, specifies that they may be retained by the employer for a period of up to seven years from the date of termination, and may be retained for a longer period if necessary or if express consent is given by the former employee.

There are also various record-keeping obligations under other laws and regulations. For instance:

• Under the Immigration Ordinance, employers are required to keep a record of the type of identification document held by an employee, by virtue of which the employee is lawfully employable, and the number of that identification document.
• Under the Mandatory Provident Fund Schemes (General) Regulation, employers are required to keep record of the remittance statement for at least seven years after the date of the relevant statement.

Thailand
The Thai Labour Protection Act B.E. 2541 (1998) (the Thai LPA) requires an employer with 10 or more employees to have in place an employee register in Thai, that is readily available for labour officer's inspection during the employer's working hours.

The employee register must contain the following particulars:

• name and surname
• gender
• nationality
• date of birth or age
• current address
• starting date of employment
• current position
• salary, wage and other benefits offered to employees
• termination date of employment.

The information of each employee must be recorded and updated within 15 days upon the commencement of the employment or each change of relevant information (as applicable).

The retention period of records in the employee register under the Thai LPA is at least two years after termination of employment.

Other than the Thai LPA, there are also record-keeping obligations under other laws, among others, the Thai PDPA which requires the data controller to have in place a duly kept record of data processing activity. For employers, this includes data processing activities in respect of employees.

Half of Singaporean workers are unhappy at work, according to a survey.

Do employees have the right to access records kept about them by the employer?

Singapore
Yes, in respect of their personal data in accordance with the Personal Data Protection Act 2012 (PDPA).

Where requested by an individual, an organisation (including an employer) must provide that individual with the following as soon as reasonably possible:

• personal data about the individual that is in the possession or control of the organisation
• information about the ways in which that personal data has been or may have been used or disclosed by the organisation within the past year.

However, there are exceptions to the information that need to be provided. An organisation is not required to provide access to, amongst others:

• Opinion data kept solely for an evaluative purpose.
• Personal data which, if disclosed, would reveal confidential commercial information that could, in the opinion of a reasonable person, harm the competitive position of the organization.
• Personal data collected, used or disclosed without consent, under paragraph 3 of Part 3 of the First Schedule of the PDPA, for the purposes of an investigation if the investigation and associated proceedings and appeals have not been completed.
• Any request that would unreasonably interfere with the operations of the organisation because of the repetitious or systematic nature of the requests; if the burden or expense of providing access would be unreasonable to the organisation or disproportionate to the individual’s interests; for information that is trivial, or that is otherwise frivolous or vexatious.

For completeness, note that an employee may have other data subject rights under the PDPA, including the right to rectification, right to data portability and right to withdraw consent.

Hong Kong
Yes, in respect of their personal data in accordance with the Personal Data Privacy Ordinance (PDPO).

An employee has a right to make a data access or correction request within a reasonable time concerning their personal data held by the employer. The employer should provide the name or job title and address of the person to which the employee's request may be made.

For completeness, note that an employee may have other data subject rights under the PDPO, including the right to rectification.

Nearly half of former employees are still accessing the accounts of their former employers, a report revealed.

Thailand
Yes, in respect of their personal data in accordance with the Thai Personal Data Protection Act B.E. 2562 (2019) (Thai PDPA).

Where requested by an employee (as the data subject under the Thai PDPA), the employer (as the data controller) must provide access to such employee's personal data in its possession or control, and provide a copy of the same, except where such access is prohibited by relevant laws or court order or is likely to cause damage to rights and liberties of other persons.

For completeness, note that an employee may have other data subject rights under the Thai PDPA, including the right to rectification, right to erasure, right to restrict processing and right to data portability.

Fatim Jumabhoy is the Asia Head of Employment, Pensions, and Incentives and a managing partner at Herbert Smith Freehills in Singapore. Nurul Ayu Fajarani is an associate in the Employment, Pensions, and Incentives practice at Herbert Smith Freehills in Singapore. Herbert Smith Freehills LLP provides access to Singapore law advice through its Formal Law Alliance with Prolegis LLC.