PDPC issues advisory on data protection risks of unauthorised AI tools
26 Oct 2026
Overview
On 30 September 2026, the Personal Data Protection Commission ("PDPC") published an "Advisory for Data Protection Risks When Using Unauthorised AI Tools for the Development of Software or Scripts" (the "Advisory").
The Advisory highlights risks arising from employees’ use of unauthorised artificial intelligence (“AI”) tools to develop software or scripts, and recommends administrative and technical safeguards. These recommendations relate to organisations’ existing obligation under Section 24 of the Personal Data Protection Act 2012 (the “PDPA”) to make reasonable security arrangements to protect personal data in their possession or under their control.
We summarise below the Bee Cheng Hiang case, whose facts mirror the illustration in the Advisory, alongside the Advisory’s key recommendations to help you assess whether your organisation’s current safeguards adequately address these risks.
Summary of Bee Cheng Hiang
An employee of the Organisation used generative AI to develop a script for sending marketing emails in batches. An incomplete prompt and a coding error caused recipients’ email addresses to appear together in the “To” field. The error went undetected because testing focused on activity logs rather than the contents of the test emails, resulting in the disclosure of 95,364 members’ email addresses.
The PDPC observed that the Organisation:
- had not conducted sufficiently robust pre-deployment testing to validate the email distribution script;
- had relied solely on a single employee's work, without supervisory checks; and
- did not have a governance framework or policies guiding employees on using generative AI tools for work.
Key Risks and PDPC Recommendations
The Advisory identifies three areas of concern:
|
Concern
|
Key Risk
|
Recommended Mitigation Measures (summarised)
|
|
Shadow AI and Uncontrolled Adoption of AI Tools
|
Employees may independently adopt unauthorised AI tools without the organisation’s knowledge or approval resulting in uncontrolled data flows, and exposure of personal data to unvetted third-party service providers.
|
- Maintain a regularly updated inventory of AI tools in use, including their purpose, intended users and data flow information
- Conduct security risk assessments, including whether personal data (especially sensitive personal data) actually needs to be used in these AI tools
- Implement written policies and processes covering end-user prompts, inputs, outputs and enterprise data
- Restrict access to AI tools’ development or deployment environments on a least-privilege basis
|
|
Over-Reliance on AI Without Human Oversight
|
Excessive reliance on AI-generated outputs without adequate human review may result in flawed or misconfigured systems.
|
- Educate staff on proper AI use, including what data may be entered into AI tools
- Train employees involved in the development / implementation of AI tools in secure coding and good practices across the AI lifecycle
- Conduct periodic ICT security awareness training for employees
- Monitor and log AI tool inputs and outputs to prevent misuse
- Monitor and validate input prompts, queries or API requests for unauthorised access, modification or extraction of confidential information
|
|
Inadequate Testing of AI-Assisted Systems before Deployment
|
AI-generated code, scripts, or automated workflows may introduce vulnerabilities or errors that are not immediately apparent. Deploying such systems without adequate testing may lead to security incidents or personal data breaches.
|
- Conduct rigorous testing, including but not limited to code reviews, unit testing, acceptance testing and security testing (e.g. penetration testing), before commissioning for production, and periodically after go-live and upon major changes
- Document AI tools’ configurations and security settings
- Use synthetic data rather than real personal data in test environments
|
What should organisations do now?
The Bee Cheng Hiang case, read together with the Advisory, illustrates that the increasing use of publicly available AI tools for business purposes presents both opportunities and data protection risks. In particular, where appropriate AI governance measures are not in place, employees’ use of such tools may result in the inadvertent disclosure or inappropriate handling of personal data.
We recommend that organisations use the Advisory as an opportunity for their DPOs, IT teams and business units to jointly assess whether existing safeguards adequately address how employees are using AI in practice, with reference to the recommended mitigation measures above.
Please let us know if your organisation is considering using AI tools to process personal data or deploying AI-generated scripts or workflows that will handle personal data, so that relevant data protection considerations can be assessed before implementation. We would be pleased to support you in reviewing your data protection arrangements, identifying potential gaps and areas for improvement, and advising you and your IT teams on appropriate safeguards to address them. Please do not hesitate to contact us should you require any assistance in this regard.
This newsflash is intended to provide general information and may not be reproduced or transmitted in any form or by any means, in whole or by part, without prior written approval. It is not intended to be a comprehensive study of the subjects covered, nor is it intended to provide any legal advice. It should not be treated as a substitute for specific advice on specific situations.