Singapore PDPC warns of data risks from unauthorised AI tools

Singapore’s Personal Data Protection Commission (PDPC) published an advisory on 30 September 2026 addressing data protection risks from unauthorised AI tools used to develop software or scripts. Deploying AI-generated code, workflows or communications without adequate controls can expose or mishandle personal data. Organisations remain responsible for reasonable security arrangements under section 24 of the Personal Data Protection Act 2012, even when employees introduce tools without approval.

The guidance identifies shadow AI, excessive reliance on generated outputs and inadequate software testing as key concerns. Unapproved tools can create uncontrolled data flows and expose personal information to unvetted service providers. Recommended safeguards include maintaining an updated inventory of AI tools, documenting their purposes and data flows, conducting security risk assessments, setting written data-handling policies and restricting access on a least privilege basis.

Technically competent personnel should review and validate generated outputs before deployment. Organisations should train employees in secure coding and data protection, log inputs and outputs, and monitor requests for attempts to access or extract confidential information. Testing should span the software development lifecycle, including code reviews, functional checks and security assessments. The PDPC also recommends documenting configurations and security policies, avoiding personal data in non-production environments and using synthetic test data where appropriate.