Singapore’s Personal Data Protection Act sets the rules for how any organisation operating here collects, uses, discloses, and protects personal data — names, NRIC numbers, contact details, financial records, anything that identifies a person. It applies regardless of whether the processing is done by a human employee or an AI system, and an agent that mishandles personal data is still the company’s liability, not the vendor’s.
For AI specifically, PDPA turns two ordinary failure modes into legal ones. An agent that retrieves a customer record it should not have access to, or a model that echoes a training example containing someone’s real details, is a data breach with the same reporting obligations and penalties as a hacked database. Testing an AI system for PDPA compliance means running attack cases designed to surface exactly this kind of leak, not just checking that the system gives the right business answer.
Companies that treat PDPA as a legal afterthought, bolted on after launch, consistently find the fix requires re-architecting how the system accesses data — because the leak was structural, not a prompt that needed tightening.