How long can a Singapore condo keep visitor records under the PDPA? The PDPA does not set a fixed number of days. Instead, its retention limitation obligation says an organisation should stop keeping personal data once it is no longer needed for the purpose it was collected, or for legal or business reasons. For an MCST, that means deciding and documenting a reasonable retention period for visitor logs, vehicle records and CCTV, then deleting records securely when the period ends.
Many condos keep years of logbooks in a storeroom and CCTV footage until the recorder overwrites it. Neither approach is a policy. This guide helps council members and managing agents set clear, defensible retention rules.
Why retention matters for MCSTs
An MCST is an organisation under the Personal Data Protection Act (PDPA), and the PDPC has published advisory guidelines for management corporations. The more personal data you keep, and the longer you keep it, the greater the damage if it is lost, stolen or misused. Old visitor logbooks with names, phone numbers, unit numbers and sometimes full NRIC numbers are a common weak point.
The PDPA has several obligations that apply here, including:
- Purpose limitation: collect and use personal data only for reasonable purposes that have been made known.
- Protection: make reasonable security arrangements to protect the data.
- Retention limitation: stop retaining data when it no longer serves the purpose and is not needed for legal or business reasons.
- Accountability: have policies and a Data Protection Officer, and make the policies available.
What visitor-related data does a condo hold?
Common visitor-related records
| Record |
Typical contents |
Main purpose |
| Visitor log (paper or digital) |
Name, contact number, unit, time in and out |
Security and incident investigation |
| Vehicle records |
Plate number, photo, entry and exit times |
Car park control and investigations |
| Contractor records |
Company, workers’ names, unit, permit dates |
Renovation control and deposit disputes |
| Delivery records |
Platform, unit, time |
Parcel and security investigations |
| CCTV footage |
Video of people and vehicles |
Security, safety and evidence |
| Access control events |
Credential used, door, time |
Security and audits |
How to decide a retention period
The PDPC does not prescribe specific periods for condo visitor records, so each MCST should decide based on its purposes. Ask three questions for each record type:
- How long after a visit could we realistically need this record? For example, to investigate a theft that is reported a few weeks later.
- Is there a legal or contractual reason to keep it longer? For example, an ongoing police investigation, insurance claim or legal dispute.
- What is the risk of keeping it longer? More data kept means more harm if there is a breach.
Many organisations choose periods measured in weeks or months for routine visitor and CCTV records, with longer retention only for records linked to an incident or dispute. Whatever you choose, write it down, explain the reasoning, and apply it consistently. Seek professional advice if you are unsure.
Handle exceptions properly
Sometimes records must be kept beyond the normal period:
- A resident reports a theft and asks for a review of entries and footage.
- The police request records for an investigation.
- A contractor disputes a deposit deduction.
- An insurance claim is in progress.
Your policy should allow the managing agent to place a “hold” on the relevant records, document why, and release them for deletion when the matter is closed.
Dispose of records securely
- Paper logbooks: shred them, or use a certified document disposal service. Do not throw them in the general rubbish.
- Digital records: use automatic deletion in your visitor management system so nothing depends on someone remembering.
- CCTV: configure recorders to overwrite after the agreed period, and protect exported clips.
- Old devices: wipe hard drives in recorders and guardhouse computers before disposal.
Why digital systems make retention easier
With paper, retention depends on someone finding and shredding old books. With a digital visitor management system, retention can be built in:
- Records are deleted or anonymised automatically after the set period.
- Access to records is limited to authorised staff, with an audit trail of who viewed what.
- Records linked to incidents can be flagged and kept until the matter closes.
- Less data is collected in the first place, because residents pre-register their guests and full NRIC numbers are not needed.
myCondo’s visitor management keeps visitor, delivery, contractor and vehicle records in one place, with access controlled by role. It integrates with LPR cameras from Dahua Technology and Hikvision, door stations from Akuvox and video systems such as Milestone XProtect, so retention can be planned across visitor records and related video.
A simple retention policy template
Retention policy outline
| Section |
What to include |
| Scope |
Which records are covered: visitors, vehicles, contractors, deliveries, CCTV, access events |
| Purposes |
Why each record is collected |
| Retention periods |
How long each type is kept, and why |
| Exceptions |
How holds for incidents and disputes are approved and released |
| Access |
Who can view and export records |
| Disposal |
How records are deleted or destroyed |
| Review |
When the policy is reviewed, for example yearly |
| Contact |
The MCST’s Data Protection Officer |
Don’t forget your service providers
Your managing agent, security agency and technology vendors handle visitor data on the MCST’s behalf. Contracts should state how they protect data, follow your retention periods and return or delete data when the contract ends. Ask vendors where data is stored and how deletion works.
Practical checklist for this quarter
- List every place visitor data is kept, including old logbooks and CCTV recorders.
- Decide and approve retention periods at a council meeting.
- Securely destroy records older than the new periods, unless on hold.
- Configure automatic deletion in digital systems and CCTV.
- Update the visitor notice at the guardhouse and the MCST’s data protection policy.
- Brief guards and the managing agent team.
Frequently asked questions
Does the PDPA say exactly how long to keep visitor logs?
No. The PDPA requires organisations to stop keeping personal data when it no longer serves its purpose and is not needed for legal or business reasons. The MCST should set and document reasonable periods.
Can we keep visitor records forever just in case?
Keeping data indefinitely without a purpose is not consistent with the retention limitation obligation and increases risk.
What about records needed by the police?
Records related to an investigation can be kept until the matter is resolved, with the reason documented.
Who in the MCST is responsible?
The MCST is accountable, and it must appoint a Data Protection Officer. Day-to-day handling is usually done by the managing agent.
Is this legal advice?
No. This article is general information. Refer to the PDPC’s guidelines or seek professional advice for your situation.
Make retention automatic
Our team can show how digital visitor management keeps your records tidy and PDPA-friendly, with no obligation.
WhatsApp or call: +65 8812 3888
Email: [email protected]
Address: 8 Ubi Road 2, #07-13 Zervex, Singapore 408538
Related reading: Can Your Condo Guard Ask for Your Visitor’s NRIC? and Paper Logbook vs Digital Visitor Management
