Singapore PDPA and AI chatbots: what the law asks

Under Singapore's Personal Data Protection Act (PDPA), a customer chatbot that collects names, phone numbers or order details needs consent or an exception, must tell people why it is collecting their data before it does, may use that data only for purposes a reasonable person would accept, and must keep it secure. The PDPC's Advisory Guidelines on use of Personal Data in AI Recommendation and Decision Systems, issued on 1 March 2024, add practical guidance on what to tell users and what to write down.

This is general information, not legal advice. Check your position with your adviser or data protection officer.

Does the PDPA apply to your chatbot?

Yes, if it handles personal data, and most customer chatbots do: a name and number to call back, an order number tied to an account, a complaint that mentions a medical condition. The PDPC's guidelines open by saying the PDPA applies to all collection and use of personal data, including to develop, test, monitor and deploy AI systems.

One caution. The guidelines are written for machine learning systems that recommend, predict or decide, such as content feeds, credit scoring and job matching. They do not mention generative AI or chatbots. For a chatbot that answers questions from your documents, treat them as the PDPC's clearest statement of what good practice looks like, not as rules written for your case. They are also advisory: the PDPA itself is what binds you.

Consent and notification: what to say first

Section 20 of the PDPA says you must tell people the purposes for collecting their data on or before collection, tell them before using it for any new purpose, and on request give the business contact of someone who can answer their questions.

For a chatbot, that usually means:

1. A short notice in the opening message: what the assistant collects (for example name, mobile number, order number), what it is for (answering the query, arranging a callback), and a link to your privacy policy.
2. Ask only for what the task needs. An opening-hours question needs no phone number.
3. A named route to a person, which also serves the "who can answer questions" duty.

The PDPC suggests notices cover the product function that needs the data, the types of data, how the processing relates to the feature, and which data most influences the result. It also suggests "layering": the key points up front, with detail in an expandable section or a linked policy.

Purpose: what can you do with the transcripts?

Section 18 limits use to purposes a reasonable person would consider appropriate and that the person was told about. The awkward question is reuse: can you feed last year's chat logs into a better assistant?

The guidelines discuss the Business Improvement Exception, which can allow use of personal data you collected lawfully, without fresh consent, to improve or develop products and processes. Two conditions apply: the purpose cannot reasonably be achieved without identifiable data, and a reasonable person would consider the use appropriate. The PDPC also encourages anonymising datasets where possible, and documenting internally why you chose personal data over anonymised data when you do.

In practice, strip names, numbers and account details from transcripts before they go anywhere near an evaluation set or a search index, and keep a note of the decision.

Protection, retention and breaches

Section 24 requires reasonable security arrangements against unauthorised access, use, disclosure or loss. For a chatbot, that covers the transcript store, the admin screens, the model provider's access and the logs. Guardrails help on the output side: they stop the assistant reading one customer's details back to another.

Section 25 says to stop keeping personal data once its purpose is served and retention is no longer needed for legal or business purposes. Set a retention period for transcripts and delete on schedule.

If something leaks, section 26D requires you to notify the PDPC no later than 3 calendar days after you assess a breach as notifiable. A breach affecting 500 or more people counts as significant scale. Section 26 also limits transfers abroad to destinations with comparable protection, which matters if your model API or vendor sits outside Singapore.

What the guidelines expect from the firm that builds it

Section 12 requires written policies and practices, and the PDPC encourages organisations to publish their AI policies on their website rather than only on request. The guidelines suggest these cover safeguards such as pseudonymisation, data minimisation and system security, and, where outcomes matter more to people, how human oversight works.

The guidelines also address service providers. A firm that builds a bespoke AI system and processes personal data for you is a data intermediary under the PDPA, and is encouraged to help you meet your notification, consent and accountability obligations: keeping track of which data went into the system and explaining how it works in plain language. Ask your vendor for this in writing.

A short note on Malaysia

Malaysia's Personal Data Protection Act 2010 was amended by the Personal Data Protection (Amendment) Act 2024, which came into force in three phases. From 1 April 2025, "data users" became data controllers, biometric data became sensitive personal data, data processors became bound by the Security Principle, and the whitelist regime for transfers abroad was removed. From 1 June 2025, controllers and processors must appoint a data protection officer, breach notification became mandatory, and people gained a right to data portability. A chatbot serving Malaysian customers should log enough to support a breach report and a portability request.

Building it with the paperwork in mind

Our RAG chatbots answer from your own documents, keep personal data out of the search index where it is not needed, filter answers by the user's access rights and log who asked what. We work from Chennai for businesses in Singapore and Malaysia, and we can document the data flows, retention settings and safeguards in the handover so your DPO has what the PDPC's guidelines describe.

Book a consultation.