Candidate Data Compliance in APAC for AI Hiring Tools

Compliance is often treated as a box to tick during procurement. In practice, candidate data moves through several stages: someone applies, an AI system screens them, a hiring manager interviews them, and the company either hires them or keeps their details on file. Each stage raises its own questions, and the answers differ between Singapore, Malaysia, Indonesia and Hong Kong.

This guide follows that lifecycle stage by stage. For each one, it summarizes what the four markets expect and what your AI recruiting tool needs to do. It is general information, not legal advice, so confirm the details with your legal team.

The candidate-data lifecycle

Think of every application as passing through five stages:

1. Collecting the application
2. Screening it, often with AI
3. Interviewing the candidate
4. Rejecting or retaining their data
5. Transferring data across borders, and responding if it is breached

A recruiting tool that is compliant at stage 1 can still fail at stage 4, for example by keeping rejected candidates' data forever. So check each stage separately.

Stage 1: Collecting applications

Singapore. Under the Personal Data Protection Act (PDPA), applying for a job generally counts as consent to use the candidate's data to assess that application. Using it for other vacancies later usually needs separate notice and consent, as the PDPC explains in its advisory guidelines.

Malaysia. Candidate privacy notices must be provided in both Bahasa Malaysia and English under the Personal Data Protection Act 2010.

Hong Kong. The PCPD's Code of Practice on Human Resource Management expects job advertisements to explain why personal data is collected. Employers should generally wait until a candidate accepts an offer before asking for a copy of their Hong Kong identity card.

What your tool should do: show a market-specific privacy notice at the point of application, in the right languages, and let you control which documents are collected at which stage, so ID copies are requested only after an offer is accepted.

Stages 2 and 3: Screening and interviewing with AI

Once data is collected, AI screening and AI interviews process it in new ways. Candidates should know that. Your privacy notice should say which hiring steps use AI and what data the AI uses.

In Indonesia, the Personal Data Protection Law requires an impact assessment for high-risk processing, which can include automated decisions with significant effects (Article 34). Rejecting a candidate is a significant effect, so if AI ranks or filters applicants, plan for an assessment.

What your tool should do: record which AI features touched each application, keep the reasons behind every AI recommendation and make it easy to show a person reviewed the outcome. Our guide to AI governance for hiring teams covers this in more depth.

Stage 4: Rejecting candidates and retaining data

This is where many teams fall short, because nothing prompts anyone to delete old applications.

Singapore. Data on unsuccessful applicants should not be kept longer than necessary for a legal or business purpose.

Hong Kong. Under the PCPD's code, data on unsuccessful applicants may generally be kept for up to two years after rejection, then destroyed. Candidates can also ask to access and correct their data.

Malaysia and Indonesia. Both laws expect data to be kept only as long as needed for the purpose it was collected for. If you want to keep candidates in a talent pool for future roles, ask for their consent.

What your tool should do: set retention periods by market, warn you before they expire and then delete or anonymize the data, or ask candidates for consent to keep it.

Stage 5: Transfers and breaches

Regional hiring creates cross-border transfers almost by default. When a recruiter in Singapore opens the profile of a candidate in Jakarta, data has crossed a border.

Cross-border transfers. Each market sets conditions. Malaysia has published guidelines on cross-border transfers, and Indonesia's law sets out safeguards in Article 56. Singapore's PDPA requires transferred data to receive comparable protection.

Breach notification. Indonesia requires notice to affected individuals and the authority within 3 × 24 hours of a breach (Article 46). Malaysia introduced breach notification requirements through its 2024 amendments. Singapore also requires notification of qualifying breaches.

Data protection officers. Singapore requires one. Malaysia requires one for organisations meeting specified thresholds, and Indonesia in specified cases such as large-scale, systematic monitoring (Article 53).

What your tool should do: tell you exactly where data is hosted, restrict access by region and role so recruiters only see the candidates they need to, and support your breach response with access logs.

The lifecycle at a glance

Stage	Singapore	Malaysia	Indonesia	Hong Kong
Collect	Consent for the role applied for; new consent for other roles	Notices in Bahasa Malaysia and English	Lawful basis and notice required	State purpose in job ads; HKID after offer accepted
Screen with AI	Explain AI use	Explain AI use	Impact assessment for high-risk automated decisions	Explain AI use
Retain	No longer than necessary	No longer than necessary	No longer than necessary	Generally up to 2 years after rejection
Transfer	Comparable protection	Cross-border transfer guidelines	Article 56 safeguards	Comply with PDPO principles
Breach	Notify qualifying breaches	Notification required	3 × 24 hours	Voluntary notification recommended

A configuration checklist for your AI recruiting tool

Before you go live in a new market, confirm you can:

1. Show a privacy notice per market and language, including how AI is used
2. Collect consent separately for future vacancies or talent pools
3. Control which documents are requested at each stage
4. Set retention periods per market, with automatic reminders and deletion
5. Restrict access by region, legal entity and role
6. State in writing where candidate data is hosted
7. Export access logs and AI decision records on request

What a candidate privacy notice should cover

A clear notice does a lot of the compliance work at stage 1, and it is the first thing a regulator or candidate will read. For each market, make sure it explains:

• Why you collect the data: to assess the application for the role, and anything beyond that, such as future vacancies
• How AI is used: which steps involve AI, such as screening or interviews, and what data the AI uses
• How long you keep it: the retention period for that market and what happens afterwards
• Where it goes: whether data may be transferred to or accessed from other countries
• What candidates can do: how to access or correct their data, withdraw consent or ask questions
• Who to contact: your data protection officer or privacy contact

Keep it short and write it in plain language. In Malaysia, publish it in both Bahasa Malaysia and English. In other markets, match the languages your job ads use.

How Moka AI handles this

Moka AI hosts candidate data on servers in Singapore and controls access by region and user role. It holds SOC 2, ISO/IEC 27001 and ISO/IEC 27701 certifications. Ask the team to show retention and consent settings configured for each of your markets in the demo.

Next step

Take the checklist into your next vendor demo and ask to see each item configured live, not described on a slide. If a vendor can't meet the rules in one of your markets, it doesn't belong on your shortlist. For the rest of the evaluation, see how to choose an AI recruiting tool for APAC.

This article is general information, not legal advice. Rules change, so check the latest guidance from each regulator and confirm requirements with your legal team.