The PDPA and cleaning services: what they need from you

A home cleaning service needs surprisingly little about you: your name, a phone number to reach you, the address and postal code to send someone to, and a way to take payment. It does not need your NRIC number, and Singapore's data protection rules say organisations generally should not collect one. The Personal Data Protection Act (PDPA) also gives you ways to see, correct and limit what a service keeps.

This guide covers what a cleaning service reasonably needs, what the Personal Data Protection Commission (PDPC) says about NRIC numbers, the obligations a service has towards you, and how HomeMaster handles your data.

What a cleaning service actually needs

To book a visit and send the right person to the right door, a service needs:

• Your name, so the cleaner and the team know who they are dealing with
• A contact number, for confirmations, reminders and questions
• The service address and postal code, to check the area and send a cleaner
• Details of the home, such as its size, pets and any access arrangements
• A way to pay, usually through a payment page run by a payment provider

What it does not need for an ordinary booking: your NRIC number, a photo of your IC, your bank login, a one-time password, or your card number typed into a chat. If a service asks for any of these, ask why. The last three are also classic scam requests, which our guide to spotting a cleaning scam covers.

NRIC numbers: what PDPC says

PDPC's Advisory Guidelines on NRIC numbers, applied from 1 September 2019, set a clear default. Organisations are generally not allowed to collect, use or disclose NRIC numbers, or copies of the NRIC. They may do so only when:

1. the law requires it, or an exception under the PDPA applies, or
2. it is necessary to accurately establish or verify a person's identity to a high degree of fidelity.

The same treatment covers birth certificate numbers, foreign identification numbers (FIN) and work permit numbers, and PDPC asks organisations to treat passport numbers in a similar way. Organisations should also generally not keep a person's physical NRIC unless the law requires it.

The guidelines suggest alternatives, such as an ID generated by the organisation or the customer, a booking reference, or a partial NRIC made up of the last three digits and the letter. PDPC has also advised against organisations using NRIC numbers to authenticate a person's identity or as default passwords. It has said the guidelines will be updated following a government statement in December 2024 on the appropriate use of NRIC numbers, and that they remain valid in the meantime.

For a cleaning booking, a phone number and an address do the job. There is rarely a reason for a service to ask for your NRIC number at all.

What a service owes you under the PDPA

PDPC's Advisory Guidelines on Key Concepts summarise the PDPA's main obligations on organisations. The ones you are most likely to use as a customer are these.

For access requests, PDPC's guidelines say an organisation must respond as soon as reasonably possible, and if it cannot within 30 days, it must tell you in writing when it will.

Withdrawing consent can have consequences: a service that can no longer use your address cannot send a cleaner there. PDPC's guidelines say an organisation should tell you the likely consequences of withdrawing, which can include no longer being able to provide the service.

Your own home, your own cameras

The PDPA's obligations fall on organisations. PDPC's guidelines explain that an individual acting in a personal or domestic capacity is not required to comply with the data protection provisions. That describes whom the law's obligations fall on; it is not a licence to film anywhere. Courtesy still applies: tell the service if there are cameras, and keep them out of private areas. Our guide to letting a cleaner in when you are out covers cameras, access codes and condo visitor registration in more detail.

Sharing your details sensibly

• Book through the business's own channel. Its website, its official WhatsApp number or its own booking page, not a number from an ad.
• Share access details only as needed. Give a separate door code you can delete later, rather than your own.
• Do not send photos of your IC. A cleaning booking does not need one.
• Read the privacy policy once. It should say what the business collects, who it shares data with and how to ask for deletion.
• Opt out of what you do not want. Marketing messages should come with a way to stop them.

How HomeMaster handles your data

Our privacy policy sets out what we collect to arrange your visits: contact details such as your name, phone number and email address, your service address and postal code, and your WhatsApp opt-in status, which covers messages from Helen, our AI assistant on WhatsApp. NRIC numbers are not on that list. Card payments go through our payment provider, and we do not store card details.

We do not sell your personal data. The policy lists who we share it with; for example, the cleaner assigned to your visit receives your name, address and booking details. Our website analytics run on our own systems: we do not use Google Analytics or any other third-party tracking service, and we set no advertising cookies.

You can ask to access, update or delete your personal data at any time. You can stop WhatsApp notifications by replying STOP to any of our WhatsApp messages.

To ask for deletion, our data deletion page gives two ways: email hello@homemaster.co with the subject line "Data Deletion Request", your full name and the phone number on your account, or send "DELETE MY DATA" to our WhatsApp number. We process requests within 30 days and confirm by email or WhatsApp. Transaction records the law requires us to keep for tax and accounting are retained and anonymised where possible.