GPS Attendance in Singapore: Geofence Clock-In and the PDPA

GPS geofenced clock-in lets staff check in on their own phone, but only when the phone reports that they are inside a virtual boundary drawn around the work site. For Singapore employers with cleaners, technicians, security officers, promoters or crews spread across condos, HDB estates, malls and client premises, it replaces the WhatsApp "reached already" message and the paper sign-in sheet with a timestamped record you can actually use for payroll.

It is also personal data. Under the PDPA you usually do not need your employees' consent to record their location at check-in for managing their employment, but you must tell them why you collect it, keep it proportionate, protect it and not keep it forever. And the resulting time records have to meet MOM's record-keeping rules.

This guide covers how geofenced check-in behaves in the real world, where it breaks, the alternatives, and a practical policy checklist.

---

How geofenced check-in actually works

There are four decisions:

1. ▸The site. You set a location for each place staff report to: an office, an outlet, a client's condo, a worksite.
2. ▸The radius. You choose how far from that point still counts as "on site". Vendors in Singapore commonly offer a small radius for a single office and a much larger one for a sprawling site.
3. ▸What happens outside the radius. Either the check-in is blocked, or it goes through but is flagged, or the worker submits a reason for a manager to approve.
4. ▸What gets recorded. At minimum: who, when, which site, and whether they were inside the fence. Some systems also store the raw coordinates and the phone's own estimate of how accurate it was.

That last decision matters more than most buyers realise, because it determines how much location data you end up holding. We come back to it in the PDPA section.

Choosing a radius

Start wider than you think and tighten based on real check-in data. A radius so tight that honest staff fail every morning trains everyone to ignore the system.

Grace periods and grace buffers

Two different "graces" are worth separating:

• ▸Time grace: how many minutes late still counts as on time. This is an HR policy decision, not a technical one. Write it down.
• ▸Distance grace: a buffer just outside the radius where check-in is accepted but flagged for review instead of blocked. This absorbs GPS drift without silently accepting someone checking in from home.

---

Where GPS falls short

Phone location is good in the open and noticeably worse in exactly the places Singapore staff tend to work.

• ▸Indoors and underground. Basements, MRT stations, underground car parks and the inside of large malls weaken satellite signals. The phone falls back on Wi-Fi and cell towers, which are less precise.
• ▸Between tall blocks. Dense HDB estates and CBD towers reflect signals, so the reported position can jump around.
• ▸Cold starts. A phone that has not used location recently may take a moment to settle, so the first reading is the least reliable.
• ▸Phone settings. Battery saver modes, denied location permission or precise location switched off can all degrade the reading.

The practical consequence: some genuine workers will occasionally appear to be outside the fence. Your process needs an exception path that a supervisor can clear in seconds, and your managers need to know that one bad reading is not evidence of dishonesty.

Spoofing

Location can be faked. Apps that fake GPS exist, and some staff will find them. Good attendance tools try to detect this, but no system catches everything. Treat GPS as strong evidence, not proof. If buddy-punching or fake check-ins are a real problem for you, pair GPS with a second factor such as a site QR code or a selfie, and look at patterns over time rather than single events.

---

Alternatives, and when they fit better

Some rules of thumb:

• ▸One fixed office: a terminal or a simple QR code is usually enough. GPS adds little.
• ▸Many client sites, indoor work: QR or NFC at each site is often more reliable than GPS inside a condo basement or a mall back-of-house.
• ▸Many outdoor or open sites: GPS geofencing is the natural fit.
• ▸Mixed: GPS as the default, QR as the fallback when the fence fails.

More "proof" usually means more personal data. Pick the lightest method that solves the problem you actually have.

---

What the PDPA requires when you collect employee location

The PDPA applies to employee data just as it does to customer data. Here is how the relevant rules apply to GPS check-in, based on PDPC's Advisory Guidelines on the PDPA for Selected Topics (Chapter 6, Employment) and the Advisory Guidelines on Key Concepts in the PDPA.

1. The employment exception: no consent needed, but notification is

PDPC states that collecting, using and disclosing employee personal data that is reasonable for the purpose of entering into, managing or terminating the employment relationship does not require consent. Its list of examples includes "managing work-schedules or work arrangements such as deployment", "conducting checks on conduct/discipline" and "managing health and safety at work".

Recording where a staff member checked in for a shift sits comfortably within that. But consent not being required does not mean silence is allowed. PDPC is explicit that employers must notify employees of the purposes. The PDPA does not prescribe the format: an employment contract clause, the employee handbook or an HR notice can all work. You do not need to re-notify before every check-in once a clear general notice is in place, but you should update staff when you add a new purpose.

2. Reasonableness: check-in only vs continuous tracking

PDPC reminds employers that even where an exception applies, they "should still act based on what a reasonable person would consider appropriate in the circumstances". The PDPA's Purpose Limitation Obligation carries the same test.

This is where most of the real risk sits:

• ▸Location captured only at check-in and check-out: easy to explain, clearly tied to attendance.
• ▸Periodic location during the shift: needs a specific reason, such as lone-worker safety or dispatching the nearest technician, and staff should be told.
• ▸Continuous tracking, or anything outside working hours: very hard to justify for attendance, and it will damage trust even if you think you can defend it.

Data minimisation is the working principle here. If your purpose is "prove the person was at the site when the shift started", then "inside site A at 07:58" may be all you need to keep long term. The raw coordinates are useful for resolving disputes, but they do not need to live forever.

3. When the exception does not cover you

PDPC says employers need consent for purposes not related to managing the employment relationship, including business or client purposes. If a client asks you to share your cleaners' live locations, or you want to reuse check-in data for something unrelated to employment, that is a different purpose. Get consent or confirm another exception applies.

The PDPA also has a general legitimate interests exception, but it comes with conditions: you must assess the adverse effect on individuals, put mitigations in place, and tell people you are relying on it. For ordinary attendance, the employment exception is usually the cleaner fit.

4. Protection

Section 24 of the PDPA requires reasonable security arrangements to prevent unauthorised access, use, disclosure or loss. For a GPS attendance system, that means asking your vendor, or whoever builds it, some plain questions: who can see location data, can a supervisor see only their own team, is access logged, and what happens when a manager leaves the company.

Also note PDPC's breach rules: a breach affecting 500 or more individuals must be notified to the Commission, even if no especially sensitive data is involved.

5. Retention

PDPC says the PDPA sets no fixed retention period. You must stop retaining personal data once it no longer serves its purpose and is not needed for legal or business reasons. Holding data indefinitely increases your risk.

6. Someone accountable

The PDPA requires every organisation to designate at least one person, usually called the Data Protection Officer, to be responsible for compliance, and to make their business contact information available. For an SME this is often the owner or the HR lead. Staff with questions about their check-in data should know who to ask.

---

What MOM expects of your time records

GPS check-in is only useful if it produces the records MOM expects. According to MOM's employment records guidance, employers must keep detailed records for employees covered by the Employment Act, including:

• ▸Working hours, including the duration of meal and tea breaks
• ▸Dates and other details of public holidays and leave taken
• ▸Salary records including overtime hours and pay

MOM requires these to be kept for the latest two years for current employees, and for one year after an employee leaves. Soft or hard copies are both acceptable.

This gives you a sensible retention anchor. Keep the attendance record, meaning who worked, where, and from when to when, for the MOM period. Hold raw GPS points for a shorter, defined window, long enough to resolve the month's disputes and payroll queries.

It also exposes a common gap. If staff only check in and never check out, you do not have working hours. For fixed-hour outdoor roles, some employers make check-out optional and record hours from the roster, but then the roster itself has to be accurate and kept. For how shifts, rest days and public holidays should be planned in the first place, see our staff rostering guide to the Employment Act.

---

Policy and notice checklist

Before switching on GPS check-in, make sure you can tick these:

• ▸ Purpose written down: "to verify attendance at assigned work sites for payroll, deployment and safety", or whatever your real purpose is.
• ▸ Staff notified through the contract, handbook or an HR notice, before rollout, in language they understand. For foreign workers, consider a translated version.
• ▸ What is collected: location at check-in and check-out only, or more? Say so explicitly.
• ▸ When it is collected: working hours only. State that there is no tracking on rest days or after the shift.
• ▸ Who can see it: owner, HR, the direct supervisor. Not the whole team, not the client, unless separately covered.
• ▸ Retention periods: the attendance record kept per MOM requirements, raw location for a shorter set period, then deleted.
• ▸ Exception process: what a worker does when the fence fails, and who approves it.
• ▸ Personal phones: if staff use their own phones, say what the app can and cannot access, and offer an alternative such as a site QR code or a company device for anyone uncomfortable.
• ▸ Security questions answered by your vendor: access controls, logs, where data is stored, what happens at offboarding.
• ▸ A named contact for PDPA questions.
• ▸ Review date: revisit the policy after the first three months of real data.

---

Mistakes we see

• ▸Treating a failed geofence as misconduct. It is usually GPS drift. Check the pattern before the person.
• ▸Collecting everything because the software can. Continuous tracking "just in case" turns an attendance tool into a surveillance tool, and staff notice.
• ▸No written notice. "Everyone knows we use the app" is not notification.
• ▸Check-in without checkout, and no reliable roster. You end up with timestamps but not working hours.
• ▸Forgetting the client site. Some condos and commercial buildings have their own rules on posting QR codes or installing tags. Ask the managing agent first.
• ▸Keeping raw location forever because no one set a deletion rule.

---

What we have built

We are currently piloting a workforce portal for a Singapore SME with staff spread across multiple sites. It is in pilot, not yet live. It includes GPS-geofenced check-in, with check-out optional for outdoor staff; shift rostering with minimum-crew and public-holiday rules; leave requests and approvals recorded on an audit ledger; and a monthly attendance report for payroll. It does not calculate payroll itself. Owners, managers and staff each have their own role and view, and key events trigger email notifications.

The pilot follows the thinking above: location captured at check-in rather than continuously, and an attendance record shaped around what payroll and MOM records need.

---

Thinking about GPS attendance for your team?

If you run field, outdoor or multi-site staff and are weighing up GPS check-in, an off-the-shelf app or something built around how your operation already works, have a look at our booking and operations solutions. If you are still deciding between buying and building, our guide to custom vs off-the-shelf systems lays out the trade-offs.

Or just drop us a WhatsApp. Tell us how your team works today and what keeps going wrong, and we will tell you honestly whether a simple app will do, or whether it is worth building something.