This DPA outlines the standards for protecting personal data in accordance with the Singapore Personal Data Protection Act (PDPA). As your data intermediary, SGPAY is committed to the following:

1. Roles & Responsibilities

You (The Client) are the Data Controller, and SGPAY is the Data Intermediary. We only process data based on your specific HR and Payroll instructions.

2. Security Obligations

• Implementation of administrative, physical, and technical safeguards.
• Confidentiality agreements signed by all SGPAY authorized personnel.
• Assistance in fulfilling Data Subject Access Requests (DSAR).

3. Data Breach Protocol

In the event of a suspected data breach, SGPAY will notify the client within 24-72 hours and provide full support for the regulatory reporting process to the PDPC.

Our platform is built on a highly secure, scalable architecture designed for 99.9% uptime and zero-knowledge data privacy.

Data Hosting

All SGPAY data is hosted locally in the Microsoft Azure Singapore Region (Southeast Asia). This ensures data sovereignty and minimal latency for our SG users.

Technical Safeguards

• AES-256 Encryption: Used for all sensitive database fields (Salaries, NRIC, Addresses).
• Web Application Firewall (WAF): Protection against SQL injection and Cross-Site Scripting (XSS).
• Automated Backups: Point-in-time recovery enabled with data replicated across 3 availability zones.

Access Control

Internal access to production databases is strictly restricted via VPN and requires Multi-Factor Authentication (MFA) with Just-In-Time (JIT) access logs.

To provide high-quality HRMS services, SGPAY works with a select group of vetted third-party subprocessors. Each partner is evaluated for ISO 27001 or SOC 2 compliance.

Clients will be notified of any changes to this list 30 days prior to the engagement of a new subprocessor.