What section 25 asks
There's no "keep it for seven years" rule in the PDPA. PDPC says the retention rule "does not specify a fixed duration of time" (Key Concepts guidelines, page 117).
Section 25 sets a test with two halves instead. You stop keeping the details, or strip out what ties them to a person, "as soon as it is reasonable to assume" both of these:
- the purpose you collected it for is no longer served by keeping it, and
- keeping it is no longer necessary for legal or business purposes.
Both have to be true before you must let go. A customer who bought last year and might buy again still serves a purpose. A parent who asked about P5 maths in 2019, whose child is now in secondary school, probably doesn't.
Three things PDPC adds
- Other rules still apply. The PDPA doesn't set a period, but you "would need to comply with any legal or specific industry-standard requirements that may apply" (page 117). Records a law tells you to keep stay kept.
- "Just in case" isn't a purpose. Personal data "must not be kept by an organisation 'just in case' it may be needed for other purposes that have not been notified to the individual concerned" (page 117).
- Write it down. PDPC recommends a written rule for how long you keep records, so the decision isn't remade every time (page 119).
When a customer asks what you hold
The other side of keeping records is showing them. When a customer asks, you give them, "as soon as reasonably possible", the personal data you hold about them and how it's been used or shared in the year before they asked (section 21(1)).
The fine print, from the Act and the 2021 regulations:
| Question | The rule |
|---|---|
| Does the request have to be in writing? | Yes (regulation 3) |
| Is there a deadline? | As soon as reasonably possible. If you can't manage it within 30 days, tell them in writing, within those 30 days, when you will (regulation 5). PDPC reads that as 30 calendar days |
| Can I charge? | A reasonable fee for an access request, after a written estimate (regulation 7). PDPC says the fee is to recover what it costs you to respond |
| Can I charge to correct their details? | No (regulation 7(4)) |
| What if they ask me to correct something? | Correct it as soon as practicable, unless you have reasonable grounds not to, and send the fix to anyone you shared it with in the past year (section 22) |
| What if I refuse an access request? | Keep a full copy of what you withheld for at least 30 calendar days after refusing (Key Concepts, page 105) |
And when a customer withdraws consent, you stop using their details for that purpose (section 16). Deleting them then follows the test above.
A yearly clear-out in an hour
- List everyone you haven't spoken to in more than two years.
- For each, ask the section 25 questions: does keeping them still serve the purpose, and does a law or a real business need require it?
- Keep the ones who pass, and note why in a line. "Bought a kitchen in 2024, warranty runs to 2027" is enough.
- Delete the rest, from your CRM and from the spreadsheets and phones they were copied to.
- Write down the rule you used, and put next year's clear-out in your calendar.
Do it from one list
In Palby CRM, every pipeline comes with an Inactive over 30 days view: everyone whose last touch was more than 30 days ago. That's the long list step 1 narrows down. Delete a customer and Palby asks before it goes. When a customer asks what you hold, their record has their details, notes and consent history together, and you can download a pipeline as a spreadsheet. There's no one-tap request form yet.
30 minutes. You choose the day and the time.
Book a walkthroughKeep reading
- Keep in touch with past customers
- Saved views in Palby CRM
Questions about keeping customer records
There isn't a fixed one. You stop keeping personal data once its purpose is no longer served and keeping it isn't needed for legal or business purposes.
No. PDPC says data must not be kept "just in case" it's needed for purposes the person wasn't told about.
As soon as reasonably possible. If it'll take more than 30 days, tell the person in writing within 30 days when you'll respond.
A reasonable fee, after giving them a written estimate. You can't charge to correct their details.
When they withdraw consent, you stop using their details for that purpose. Whether you then keep any record turns on the section 25 test, and on what other laws require you to hold.
Sources
- PDPA 2012 s16, s21, s22 and s25 (sso.agc.gov.sg/Act/PDPA2012, current version as at 2 Nov 2026), read 2 Nov 2026
- Personal Data Protection Regulations 2021, regs 3, 5 and 7 (sso.agc.gov.sg/SL/PDPA2012-S63-2021), read 2 Nov 2026
- PDPC Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, pages 95, 96, 105, 117 and 119, read 2 Nov 2026