Task 5 — Retention Periods & Transfers

How long do you keep it — and does it leave the country or the group?

Complete each processing activity with its retention period and its transfers. They are the basis for the retention schedule in Workshop 6 and the transfer checks in Workshop 10.

What to document

Retention period: a fixed period or the criteria to determine it, and the event that starts it (e.g. end of contract)
Transfers to other countries: the recipient countries, including cloud services and support teams with access from abroad
Transfers within the group: e.g. a shared HR or CRM system run by the parent company

In ResGuard: transfers are recorded in Supplier Management, the module for third parties and vendors. Create each recipient there, such as a vendor, a group company or another third party, with its country, and link it to the processing activity in the RoPA.

Transfers in your jurisdiction

Singapore

Under the Transfer Limitation Obligation, data may only leave Singapore if the recipient provides a comparable standard of protection, ensured through legally enforceable obligations (law, contract or binding corporate rules) or specified certifications such as APEC CBPR or PRP. Data intermediaries need a contract and are themselves bound by the Protection, Retention Limitation and breach notification obligations.

Example: retention and transfers

Processing activity	Retention period	Transfers
Payroll	Period required by tax and social security law, from the end of the year	Payroll provider in the same country
Recruitment	A few months after the position is filled, longer only with the applicant's consent	None
Newsletter	Until consent is withdrawn	E-mail marketing service hosted abroad
CRM	Duration of the customer relationship plus statutory periods	Group CRM operated by the parent company

The exact periods depend on your tax, accounting and employment laws — record the law next to each period.