PDPA and your queue system: what to collect, what to show, and when to delete

A queue or booking system handles personal data all day: names, phone numbers, sometimes NRIC numbers, and for clinics, the reason for the visit. Singapore's Personal Data Protection Act (PDPA) applies to all of it. This guide covers the practical questions we hear most from businesses setting up a queue.

This is general information, not legal advice. For your specific situation, check the PDPC's guidelines or speak to a lawyer.

Collect only what you need

The simplest rule: if you do not need it to serve the customer, do not ask for it.

• To call someone and message them when it is their turn, a first name (or just a ticket number) and a phone number are usually enough.
• To prepare for the visit, a short reason or the service they chose is often helpful. Keep it short and optional where you can.
• Customers should not need an account to join a queue. Every extra field is a reason for people to give up, and more data for you to protect.

NRIC: off unless you really need it

The PDPC's advisory guidelines say organisations should generally not collect NRIC numbers or copies of NRIC unless the law requires it, or it is necessary to accurately establish a person's identity to a high degree of fidelity. A healthcare provider confirming a patient's identity is the kind of case where it may be justified. A salon or a restaurant waitlist is not.

If you do collect NRIC:

• state the purpose when you collect it;
• mask it wherever it is displayed (for example, only the last few characters);
• never show it on a TV display or a printed ticket;
• delete it with the rest of the visit record when you no longer need it.

A good queue system lets you switch NRIC collection on per service, for a stated purpose, and keeps it off everywhere else.

Be careful what the screen shows

Queue displays are public. Show ticket numbers, or at most a first name or initials, never a full name together with anything else that identifies the person. The same goes for the reason for the visit: "A012, Room 3" is fine; "Tan Ah Kow, diabetes review" is not.

Tell people why, and keep it to that purpose

Under the PDPA's consent and notification obligations, customers should know what you collect and why. A single line on the join form usually does it: "We use your number only to tell you when it's your turn." If you later want to send promotions, that is a different purpose, which needs consent and a check against the Do Not Call registry.

Delete on a schedule

The retention limitation obligation means you should not keep personal data longer than you need it. For a queue, that is usually a short period after the visit, long enough for disputes and reporting and no more. Choose a period, write it down, and make sure your system actually deletes data when the period ends. Aggregated numbers (how many visits, average waits) can be kept, because they no longer identify anyone.

Protect it, and know what to do if something goes wrong

• Limit who on your staff can see customer details, and give each person their own login.
• Prefer systems that host data in Singapore and encrypt it.
• Since February 2021, organisations must assess data breaches and notify the PDPC (and in some cases the people affected) of notifiable breaches. Know who in your business would handle that.

Checklist

1. We collect only name/number and what the visit needs.
2. Customers can join without an account.
3. NRIC is off by default, and on only where justified, masked and deleted.
4. Displays and tickets show numbers or initials only.
5. The join form says why we collect each detail.
6. Visit data is deleted after a fixed period.
7. Staff access is limited and individual.
8. We know how we would handle a breach.

Sedia is designed around these defaults: no customer accounts, NRIC off unless you switch it on for a stated purpose, masked displays, data hosted in Singapore and visit details deleted on a schedule. See how it works for clinics or our checklist for choosing a clinic queue system.