Essential guidance for employers implementing COVID-19 measures at the workplace

As Singapore moves towards living with COVID-19 as an endemic disease, the Government has issued guidance for employers on the COVID-19 measures to be implemented at the workplace. We will discuss the guidance issued by (i) the Ministry of Manpower (“MOM”) on the updated safe management measures at the workplace; (ii) the MOM on COVID-19 vaccination in relation to the workplace; and (iii) the Personal Data Protection Commission (“PDPC”) on the collection of personal data at the workplace for COVID-19 contact tracing.

MOM guidance on the updated Safe Management Measures at the workplace[1]

MOM has issued an advisory which provides that, from 22 September 2021, if at least three employees working in the same premises test positive for COVID-19 within a period of 7 days and were also at the workplace within 7 days from their respective test results, the employer must implement a snap 10-day work-from-home (“WFH”) regime for all employees as soon as possible, and no later than one day after the date of the latest positive test result. During the 10-day WFH period, employees should minimize social gatherings and leave their homes only for essential activities. Employees are also encouraged to self-test every 2 to 3 days. If an employee wishes to return to the office during the 10-day WFH period, the employee is entitled to do so, provided that (i) the employee obtains a negative test result from a self-test conducted before returning to the workplace; (ii) the duration of the employee’s stay at the workplace falls within the 24-hour period from the time the negative test result was obtained; and (iii) the employee provides a reasonable justification for his/her need to return to the workplace.

The immediate steps that the employer must take upon being made aware of the positive COVID-19 cases include the following:

  1. Vacating and cordoning-off the immediate section of the workplace premises where the positive COVID-19 cases had worked; and
  2. Carry out a thorough cleaning and disinfecting of the entire workplace premises.

Even if there are no positive COVID-19 cases a the workplace, employers must ensure that no more than 50% of employees who are able to work from are at the workplace at any point in time. Social gatherings and social interactions at the workplace are also prohibited.

Note: This section has been updated to reflect the new guidance issued by the MOM on 20 September 2021.

MOM guidance on COVID-19 vaccination in relation to the workplace[2]

MOM has issued an advisory which provides that, from 1 October 2021, employees in selected sectors[3], including construction, transportation and logistics, would be required to be vaccinated or would need to undergo regular testing i.e. the “Vaccinate or Regular Test” (VoRT) regime. Although the adoption of the VoRT regime is mandatory only for employers in the selected sectors, the Government has encouraged all employers to adopt the VoRT regime as a company policy that applies to all employees. Our view is that, save in exceptional cases where there are strong reasons why it would be impracticable to implement the VoRT regime, employers ought to follow the MOM advisory.

Requirements of the VoRT regime

The VoRT regime adopts a differentiated approach for vaccinated and unvaccinated employees. “Unvaccinated” employees refers to those who have not received the full regimen of approved COVID-19 vaccines.[4] There is no blanket VoRT regime for all industry sectors, and employers can refer to their respective sector agencies for further details on the appropriate VoRT regime to implement. Nevertheless, based on the MOM advisory, the key features of any VoRT regime are as follows:

  1. Conduct regular COVID-19 testing at the workplace premises for unvaccinated employeesg. twice a week[5]. The approved COVID-19 tests include those under the existing “Fast and Easy Testing” (FET)[6] or the “Rostered Routine Testing” (RRT)[7];
  2. Require unvaccinated employees to undergo Pre-Event Testing (PET)[8] before participating in any workplace event. There should be reduced group sizes at workplace events involving unvaccinated employees, especially for mask-off activities;
  3. Redeployment of unvaccinated employees to another job or position that carries a lower risk of COVID-19 infection, taking into account the unvaccinated employee’s skills and experience; and
  4. Employers can choose to transfer to unvaccinated employees, who are medically eligible to receive the approved COVID-19 vaccines, the additional costs associated with being unvaccinated. Examples of such additional costs include the costs of Stay-Home Notice accommodation that are incurred over and above those for vaccinated employees, the additional delays arising from prolonged SHN to be taken from existing leave entitlements etc.

Recommendations for employers that adopt the VoRT regime

Given that the VoRT regime is premised on drawing a distinction between vaccinated and unvaccinated employees, it is important for employers to have in place a comprehensive system for tracking the vaccination status of employees, which would enable employers to monitor unvaccinated employees’ compliance with the VoRT regime. As part of the tracking of the vaccination status, employers should require employees to voluntarily produce proof of vaccination – employees who refuse to do so should be treated as unvaccinated.

Employers should communicate clearly and in advance to their employees (i) of its intention to implement the VoRT regime; and (ii) the details of the upcoming VoRT regime. Such advance notice may incentivize some unvaccinated employees to receive the full regime of approved COVID-19 vaccines before the implementation of the VoRT regime, and put employees who decide to remain unvaccinated in a better position to comply with the VoRT regime following its implementation.

Employers should also encourage (but not compel) all medically eligible employees who have yet to be fully vaccinated to do so. In order to facilitate employee vaccination, employers should grant paid time-off to employees to receive COVID-19 vaccination and/or grant additional paid sick leave for employees who experience adverse vaccination-related side effects.

What employers cannot do under the VoRT regime

Employers should not terminate or threaten to terminate the service of an unvaccinated employee on the basis of vaccination status alone. Employers should also not place unvaccinated employees on no-pay leave on the basis of vaccination status alone, without their written consent. However, employers may exercise their right to terminate the service of an unvaccinated employee or place him/her on no-pay leave if he/she fails to comply with any VoRT measures that are in place.

PDPC advisory on the collection of personal data at the workplace for COVID-19 contact tracing

PDPC has issued an advisory for employers on the collection of personal data for COVID-19 contact tracing.[9] This advisory contains two aspect: (i) employers’ implementation of TraceTogether-only SafeEntry at the workplace; and (ii) employers’ implementation of Safe Management Measures at the workplace.

Implementing TraceTogether-only SafeEntry at the workplace

Pursuant to the PDPC advisory, employers are required to implement TraceTogether-only SafeEntry (i.e. where people check-in via the TraceTogether App or token) for all employees and visitors entering the workplace, for the Government’s contact tracing purposes. The TraceTogether-only SafeEntry check-in has been the primary tool used for COVID-19 contact tracing in Singapore since 17 May 2021.

The data collected by and stored on the TraceTogether-only SafeEntry platform includes a person’s name, NRIC, mobile number, whereabouts and vaccination status. Such data relates to the identification of an individual and would therefore fall within the definition of “personal data” under the Personal Data Protection Act (“PDPA”). Given that employers are using TraceTogether-only SafeEntry to collect such personal data for the Government’s contact tracing purposes, employers are obliged to comply with the provisions of the PDPA relating to the collection, use and protection of personal data.

In order to ensure the safe and secure collection of personal data and minimize the risk of failing to comply with the PDPA, employers are advised to consider the following when deploying devices (e.g. smartphones, tablets) for SafeEntry:

  1. Use a dedicated device to collect the personal data. The device should not be used for any other purposes, including accessing other websites. If possible, do a factory reset before using the device for the collection of data (note: this will delete all data in the device). If using a dedicated device is not possible, the device used must be secure and capable of safeguarding the personal data adequately.
  2. Do not install unnecessary apps on the device. Ensure that there are no apps that can perform screen recording on the device.
  3. Turn off the web browser’s autocomplete/autofill function so that users cannot see what others have typed into the form previously.
  4. Regularly check the device to ensure that it is scanned for viruses and malware. Ensure that the device has not been jailbroken and that the device operating software is updated regularly.
  5. Only allow authorised personnel to have access to the device. Enable lock screen when the device is not in use, and use password or biometric protection for device login.

Implementing Safe Management Measures at the workplace

Besides TraceTogether-only SafeEntry, employers may deploy Safe Management Measures at the workplace, such as crowd counting systems or safe distancing technologies. However, employers should, as far as possible, deploy measures that do not collect, or minimise the collection of, personal data. For example, deploy crowd management solutions that only detect or measure distances between human figures, without collecting facial images. Data such as facial images can identify individuals and would fall within the definition of “personal data” under the PDPA. If no such personal data is collected, the PDPA provisions relating to the collection, use and protection of personal data will not apply.

Conversely, where personal data such as facial images is collected e.g. captured via security camera systems, employers will be obliged to comply with the PDPA provisions relating to the collection, use and protection of personal data. In this situation, employers should minimise the type and amount of personal data collected, and implement measures to protect such data. Examples of data protection measures that employers can consider are as follows:

  1. Update IT policies so that CCTV and video footage continue to be protected.
  2. Ensure that only authorised persons can access the personal data for purposes of contact tracing or safe management of premises. Provide clear instructions on who can approve the disclosure of such data.
  3. Provide training to all personnel to familiarise them with the policies relevant to their roles.


[1] The advisory can be found at: Requirements for Safe Management Measures at the workplace (

[2] The advisory can be found at: Updated advisory on COVID-19 vaccination at the workplace (

[3] The full list of sectors can be found at: annex-a2c38c82f53d24bd3a1374f87f22b1270.pdf (

[4] An individual will be considered fully vaccinated either (i) 2 weeks after he/she has received the full regimen of Pfizer-BioNTech/Comirnaty, Moderna, or any World Health Organisation’s Emergency Use Listing (WHO EUL) vaccines; or (ii) 2 weeks after he/she has received one dose of Pfizer-BioNTech/Comirnaty or Moderna vaccines, upon recovery from COVID-19.

[5] See MOH guidelines for the VoRT regime at: MOH | News Highlights

[6] The approved tests under the FET regime include the Polymerase Chain Reaction (PCR) test and the Antigen Rapid Test (ART).

[7] RRT is a surveillance testing program for workers in selected sectors, including construction and maritime, who are more vulnerable or have higher risk of exposure to COVID-19. The surveillance involves recurrent swab testing every 14 days.

[8] Unvaccinated employees must attend at an MOH-approved COVID-19 test provider to undergo either the Polymerase Chain Reaction (PCR) test or the Antigen Rapid Test (ART). The list of MOH-approved COVID-19 test providers can be found at: MOH | Regulations, Guidelines and Circulars. The validity period of a negative COVID-19 test result is 24 hours from the time the unvaccinated employee was registered at the testing premises to take the test. An unvaccinated employee will be permitted to participate in the workplace event if the workplace event takes place within the validity period of his/her negative COVID-19 test result.

[9] The advisory, which is updated as at 12 August 2021, can be found at: PDPC | Advisories on Collection of Personal Data for COVID-19 Contact Tracing and Use of SafeEntry

Special thanks for the contributions of Legal Executive, Parry Tan.