How to Evaluate Privacy Controls in Singapore Leave Management Software

Leave management software stores important employee information, including personal details, leave balances, absence records, medical certificates, approval histories, and employment information. Although these records help HR teams manage employee leave efficiently, they also create privacy and data security responsibilities for employers.

For Singapore businesses, evaluating privacy controls is an important part of selecting leave management software. A system may offer convenient leave applications, automated calculations, and payroll integration, but employers must also understand how it collects, stores, processes, accesses, and protects employee information.

The Personal Data Protection Act 2012 (PDPA) establishes obligations for organisations handling personal data in Singapore. These include protecting personal data, limiting its retention, managing overseas transfers appropriately, and ensuring accountability for data protection practices.

Employers should therefore assess both the software's technical security features and the vendor's data handling practices before implementation.

This article explains how Singapore employers can evaluate privacy controls in leave management software and what HR, IT, and compliance teams should examine.

1. Understand the Personal Data Collected by Leave Management Software

The first step is to identify the types of personal data that the software collects and processes.

A leave management platform may contain more information than just employee names and leave dates. Depending on its configuration, it may also store medical documents, family-related information, employment records, and payroll-related details.

Common data categories include:

Data category	Examples
Employee identification	Name, employee ID, contact details
Employment information	Joining date, department, designation, work location
Leave information	Leave category, dates, duration, balance
Medical information	Medical certificates and supporting documents
Family-related information	Information required to assess childcare or parental leave eligibility
Approval records	Manager decisions, comments, timestamps
Attendance information	Absence dates, work schedules, attendance records
Payroll information	Unpaid leave inputs and leave-related salary adjustments
System information	Login history, access logs, device and security information

Employers should determine whether every data field is genuinely necessary.

For example, a system may need an employee's medical certificate to administer sick leave. However, it may not need detailed medical history or unrelated medical information.

The objective should be to collect only the information required for legitimate HR and employment administration purposes.

2. Check Whether the Software Supports PDPA Requirements

Singapore's PDPA requires organisations to manage personal data responsibly.

The software should support the employer's ability to meet relevant data protection obligations, although purchasing a secure platform does not automatically make an organisation PDPA-compliant.

Important areas to evaluate include:

• Accountability: Does the organisation have policies, procedures, and responsible personnel for managing personal data?
• Notification and purpose limitation: Are employees informed about why their information is collected, used, and disclosed?
• Consent and applicable exceptions: Is personal data handled under an appropriate legal basis and in accordance with applicable PDPA requirements?
• Accuracy: Can employees and HR teams identify and correct inaccurate information?
• Protection: Are reasonable security arrangements in place to prevent unauthorised access, use, disclosure, or loss?
• Retention limitation: Can information be securely deleted or anonymised when it is no longer needed for legal or business purposes?
• Transfer limitation: Are appropriate safeguards in place when personal data is transferred outside Singapore?
• Access and correction: Can the organisation handle applicable employee requests to access or correct personal data?
• Data breach notification: Can the organisation investigate incidents and meet applicable notification obligations?

Employers should ask vendors to explain how their platform supports these requirements and what responsibilities remain with the employer.

3. Evaluate Role-Based Access Controls

Role-based access control is one of the most important privacy features in leave management software.

Not every employee or manager should be able to view all employee information. The system should restrict access according to job responsibilities.

For example:

User role	Appropriate access
Employee	Own leave balances, applications, and history
Reporting manager	Relevant team leave requests and availability
HR administrator	Employee leave records required for HR administration
Payroll team	Leave information required for salary processing
System administrator	Technical configuration and system management
Data protection or security personnel	Relevant audit and security information

Employers should check whether access can be configured by department, location, reporting relationship, and job role.

For example, a branch manager should generally be able to review leave requests and team availability without automatically receiving access to every employee's medical certificate.

The platform should also support permission reviews so that access can be changed when employees are transferred, promoted, or leave the organisation.

4. Check How Medical Certificates and Sensitive Documents Are Protected

Sick leave administration may involve medical certificates and other health-related documents.

These documents should receive appropriate protection because they may contain information that is not required by every person involved in the leave approval process.

Employers should examine whether the software provides:

• Secure document uploads.
• Encrypted document storage.
• Restricted access to medical certificates.
• Separate permissions for HR and line managers.
• Secure document downloads.
• Access logs.
• Defined document retention settings.
• Secure deletion procedures.

For example, a manager may need to know that an employee has submitted a valid sick leave application and will be absent on a particular date. The manager may not need access to additional medical information contained in the certificate.

Employers should also avoid collecting unnecessary diagnosis details or unrelated medical records.

A useful system allows HR to verify supporting documents while limiting access to other users.

5. Evaluate Login Security and Authentication

The software should prevent unauthorized users from accessing employee leave records.

Employers should review the available authentication controls before selecting a platform.

Important features include:

• Strong password requirements.
• Multi-factor authentication (MFA).
• Single sign-on (SSO), where appropriate.
• Secure password reset procedures.
• Automatic session timeouts.
• Account lockout or risk-based login protection.
• Controls for inactive accounts.
• Secure mobile authentication.

MFA is particularly useful for HR administrators and managers who can access large volumes of employee information.

Employers should also check whether the system supports secure authentication for employees using personal mobile devices.

For example, if an employee loses a phone that contains an active leave management session, the organisation should have a process to revoke access and protect the account.

6. Confirm That Employee Data Is Encrypted

Encryption helps protect personal data from unauthorized access.

Employers should ask vendors how employee information is protected when it is transmitted and stored.

Two important areas are:

Encryption in transit

Data transmitted between employees' devices, the application, and the server should be protected using appropriate secure communication protocols.

Encryption at rest

Employee information stored in databases, document storage systems, and backups should be protected using suitable encryption controls.

Employers should ask:

• Which encryption standards are used?
• Is encryption applied to medical documents?
• Are backups encrypted?
• How are encryption keys managed?
• Who can access or manage encryption keys?
• Are encryption controls reviewed regularly?

Vendors should provide clear technical information rather than simply stating that their software is secure.

7. Understand Where Employee Data Is Stored

Employers should understand where the leave management platform stores employee information and whether data is processed in other countries.

Cloud-based HR software may use data centres, backup facilities, and service providers located in different jurisdictions.

Singapore's PDPA does not impose a blanket requirement that all employee data must be stored physically in Singapore. However, the Transfer Limitation Obligation requires organisations to ensure that personal data transferred outside Singapore receives a standard of protection comparable to that under the PDPA.

Before selecting a vendor, employers should ask:

• In which countries is employee data stored?
• Where are backup copies maintained?
• Which countries can vendor support personnel access?
• Are overseas subprocessors involved?
• What safeguards apply to overseas data transfers?
• Can the vendor explain its international data handling arrangements?

A vendor should provide a clear description of its hosting arrangements and applicable transfer safeguards.

Employers should not assume that a Singapore-based vendor necessarily stores all data in Singapore.

8. Review Vendor and Data Intermediary Responsibilities

Many organisations use external software providers to host and process employee information.

Where a vendor processes personal data on behalf of an organisation for the organisation's purposes under a written contract, it may be considered a data intermediary under the PDPA.

The employer remains responsible for its applicable PDPA obligations concerning personal data in its possession or under its control.

A written agreement should clearly explain:

• What personal data the vendor processes.
• Why the data is processed.
• The vendor's permitted uses of the data.
• Security responsibilities.
• Confidentiality requirements.
• Subprocessor arrangements.
• Data breach reporting procedures.
• Data retention and deletion requirements.
• Assistance with applicable access and correction requests.
• Data return or deletion when the contract ends.

Employers should also ask whether the vendor uses employee information for product analytics, advertising, artificial intelligence training, or other secondary purposes.

Any additional collection, use, or disclosure should be assessed against the employer's PDPA obligations and the purposes communicated to employees.

9. Check Audit Logs and Activity Monitoring

Audit logs help employers understand who accessed or changed employee information.

They are particularly important when several HR administrators, managers, and payroll personnel use the same leave management platform.

A useful system should record activities such as:

• Employee login events.
• Failed login attempts.
• Access to sensitive documents.
• Leave balance changes.
• Leave application approvals.
• Manual entitlement adjustments.
• Employee profile modifications.
• Permission changes.
• Data exports.
• Administrative actions.

For example, if an employee's annual leave balance changes unexpectedly, HR should be able to identify whether the change resulted from an approved leave request, an administrator adjustment, or a system process.

Employers should check whether logs include timestamps, user identities, relevant activity details, and protection against unauthorised modification.

They should also establish who reviews these logs and how frequently suspicious activity is investigated.

10. Evaluate Data Retention and Secure Deletion

Employee information should not be retained indefinitely simply because the software can store it.

Under the PDPA's Retention Limitation Obligation, organisations must cease retaining personal data or remove the means of identifying individuals when the original purpose is no longer being served and retention is no longer necessary for legal or business purposes.

Employers should review whether the software supports:

• Configurable retention periods.
• Separate retention settings for different document types.
• Secure deletion.
• Anonymisation where appropriate.
• Deletion of inactive employee records.
• Backup retention policies.
• Documented deletion processes.
• Records of deletion activities.

However, employers must also consider statutory employment recordkeeping requirements.

For example, MOM generally requires employers covered by the Employment Act to retain the latest two years of employment records for current employees. For former employees, the last two years of records must be retained for one year after the employee leaves.

The retention policy should therefore distinguish between records that must be retained for legal or business reasons and information that is no longer necessary.

11. Review Data Breach Detection and Response Capabilities

A data breach involving leave management software may expose employee names, medical certificates, absence details, or other personal information.

Employers should understand how the vendor detects, investigates, and reports security incidents.

Important capabilities include:

• Security monitoring.
• Suspicious login detection.
• Unusual data download alerts.
• Incident reporting channels.
• Incident response procedures.
• Access suspension.
• Investigation support.
• Evidence preservation.
• Recovery and restoration procedures.

The contract should require the vendor to notify the employer promptly when it becomes aware of a breach affecting the organisation's data, allowing sufficient time for investigation and any required notifications.

Under Singapore's PDPA, organisations must assess whether a data breach is notifiable. Where a breach is notifiable, the organisation must notify the PDPC as soon as practicable and, in any case, no later than three calendar days after determining that it is notifiable. Affected individuals must also be notified where required.

Employers should confirm that the vendor can provide the information and assistance needed to meet these obligations.

12. Check Employee Access and Correction Features

Employees should be able to review their own leave information and report errors.

A useful platform should make it easy for employees to:

• View personal leave records.
• Check leave application history.
• Review available balances.
• Identify incorrect leave dates.
• Request corrections.
• Contact HR about disputed records.

The employer should also have a process for handling applicable PDPA access and correction requests.

For example, if an employee notices that a previously approved annual leave application is missing from the system, they should be able to raise the issue and receive an appropriate response.

Employers should verify whether the software can export employee records in a readable format to support applicable access requests and internal investigations.

13. Examine Data Export and Integration Security

Leave management software often connects with payroll, attendance, accounting, and HR management systems.

These integrations can improve administration but may also increase the number of systems that receive employee information.

Employers should examine:

• Which employee fields are transferred.
• Whether data is encrypted during transfer.
• How system connections are authenticated.
• Whether API access is restricted.
• Whether integration credentials can be rotated.
• Whether failed transfers are logged.
• Whether duplicate or unnecessary data is transmitted.
• Whether exports are restricted to authorised users.

For example, payroll may need approved unpaid leave dates and relevant working-day information. It may not need access to an employee's medical certificate.

Employers should configure integrations to transfer only the information required for the receiving system's purpose.

14. Test Mobile Application Privacy Controls

Employees may access leave management software through mobile applications or mobile browsers.

This introduces additional privacy considerations, particularly when employees use personal devices.

Employers should test whether the app provides:

• Secure login.
• Automatic session expiry.
• Device and session management.
• Secure document uploads.
• Protection against unauthorised local storage of sensitive information.
• Appropriate controls for lost or stolen devices.
• Secure logout.
• Supported operating system updates.

Employers should also ask whether medical certificates or other documents are downloaded and stored locally on employees' devices.

A secure mobile app should avoid unnecessary storage of sensitive documents outside the protected application environment.

15. Review Vendor Security Certifications and Independent Assessments

Certifications and independent assessments can help employers evaluate a vendor's security management practices.

However, employers should not select a system based only on a certification logo.

Useful evidence may include:

Security evidence	What employers should review
ISO/IEC 27001	Information security management practices and certification scope
SOC 2 report	Independent assessment of relevant service controls, where available
Penetration testing	Evidence of security testing and remediation
Vulnerability management	How weaknesses are identified and corrected
Business continuity plan	How the service continues during disruptions
Disaster recovery testing	Whether backup restoration procedures are tested
Security policies	Documented access, incident, and data handling procedures

Employers should request relevant reports, check their dates and scope, and understand whether they cover the specific service being purchased.

A certification does not guarantee that every part of a leave management platform is free from security risks.

16. Evaluate Privacy Controls Through a Vendor Demonstration

A vendor demonstration should include practical tests rather than a general presentation of security features.

Employers can use the following scenarios:

Scenario 1: Manager access

Ask the vendor to demonstrate how a branch manager can view team leave requests without accessing unrelated employee records.

Scenario 2: Medical certificate protection

Upload a sample medical certificate and check which user roles can view, download, or modify it.

Scenario 3: Employee account security

Demonstrate MFA, password reset, session expiry, and account deactivation.

Scenario 4: Audit history

Change an employee's leave balance and verify whether the system records the administrator, date, and reason.

Scenario 5: Employee data export

Export an employee's leave history and check whether the file is protected and access is restricted.

Scenario 6: Employee termination

Deactivate a sample employee and demonstrate how the vendor handles access, retention, and deletion.

Scenario 7: Overseas hosting

Ask the vendor to explain its hosting locations, subprocessors, and overseas transfer safeguards.

Scenario 8: Security incident

Ask the vendor to explain its breach detection, escalation, notification, and recovery process.

These tests help employers distinguish between security features that genuinely work and features that exist only in marketing materials.

17. Use a Privacy Evaluation Scorecard

A structured scorecard can help HR, IT, procurement, and compliance teams compare vendors objectively.

The following example uses a weighted evaluation model.

Evaluation area	Suggested weight
Role-based access controls	15%
Encryption and authentication	15%
Medical document protection	10%
Data hosting and overseas transfers	10%
Audit logs and monitoring	10%
Data retention and secure deletion	10%
Data breach response	10%
Vendor and subprocessor controls	10%
Employee access and correction support	5%
Security testing and independent assurance	5%
Total	100%

Employers can rate each vendor from one to five:

• 1 – Very weak or unavailable.
• 2 – Limited controls.
• 3 – Adequate controls with some gaps.
• 4 – Strong controls with supporting evidence.
• 5 – Comprehensive controls with clear evidence and testing.

The weighted score can be calculated by multiplying each category's rating by its assigned weight and adding the results.

Employers should also identify critical weaknesses separately. A high overall score should not compensate for a serious issue such as unrestricted medical document access or unclear overseas data handling.

Conclusion

Evaluating privacy controls is an essential part of selecting leave management software in Singapore. The platform may process employee identification details, absence records, medical certificates, family-related information, and payroll inputs. Each category requires appropriate handling and protection.

Employers should examine access controls, authentication, encryption, medical document security, audit logs, data retention, overseas transfers, vendor responsibilities, and breach response procedures before making a purchasing decision.

A secure platform should also allow employees to access their own leave information while restricting unnecessary access by managers and other users.

Ultimately, leave management software should support efficient HR administration without creating avoidable privacy risks. By combining technical security reviews, vendor due diligence, clear internal policies, and regular monitoring, Singapore employers can make better-informed software decisions and strengthen their employee data protection practices.

Assess who can see leave reasons, documents and team calendars and how long data is retained. Request InnBuilt's controls for Singapore employee records.