What the law establishes
The Personal Data Protection Act 2010 governs how a business processes personal data in a commercial transaction, and private employment agencies are named among the classes of business the Act’s Class of Data Users Order requires to register with JPDP. That registration requirement is a real, specific fact: agencies handling household and worker details for a placement aren’t operating in a space the law is silent on.
The Act structures a registered business’s obligations around seven named principles, general handling, notice and choice about collection, disclosure limits, security, retention, data integrity, and an individual’s access to their own data. The specific detail of how any one agency implements these is set by that agency, not spelled out item-by-item in the Act for every business type.
A 2024 amendment added real teeth
The Personal Data Protection (Amendment) Act 2024, in force since 1 June 2025, added a mandatory data breach notification requirement, a registered data user must notify JPDP’s Commissioner, and affected individuals where the breach is likely to cause significant harm, within set timeframes, and a threshold-based requirement to appoint a Data Protection Officer for businesses handling data at scale. Whether a specific small agency meets that appointment threshold isn’t something this site can determine for you; it depends on the scale of that business’s own data processing.
What you can and can’t check yourself
Unlike JTKSM’s agency licence register, there’s no public-facing tool confirming whether a specific business is a registered data user, so this isn’t something you can independently verify the way you can a licence number. Ask the agency directly whether it’s registered under the Act, and what it does with the household and personal details it collects during an enquiry.
If you believe your data has been mishandled, JPDP runs its own complaint channels, a call centre, an email address, and an online complaint portal, separate from JTKSM’s licensing-related channels covered elsewhere on this site. The two departments handle different kinds of concern.