Is Your Customer Data Safe When Using AI?
AI tools can help businesses draft emails, analyse customer feedback, summarise documents and automate daily tasks. However, these benefits can come with privacy risks when employees enter customer information into AI applications without understanding how the data is handled.
For small and medium-sized businesses (SMBs) in Singapore, a simple mistake, such as uploading a customer database to an unapproved AI tool, could expose sensitive information or create compliance concerns.
Protecting customer data does not mean avoiding AI altogether. It means understanding the risks, choosing suitable tools and establishing clear rules for their use.
What Are the Main AI Data Privacy Risks?
Before introducing AI into business operations, identify how customer information could be exposed or misused.
- Unauthorised data sharing
Employees may paste customer names, contact details, financial information or support records into public AI tools. Depending on the provider’s terms and settings, the information may be processed or retained in ways the business has not assessed.
2. Unclear data retention practices
AI providers may have different policies for storing prompts, conversation histories and uploaded files. Businesses need to understand how long information is retained and whether it can be deleted.
3. Excessive access permissions
AI applications connected to company email, customer relationship management (CRM) systems or cloud storage may access more information than necessary. Excessive permissions increase the potential impact of an error or compromised account.
4. Third-party and cross-border risks
AI services may rely on external providers or process data in different locations. Businesses should understand the service arrangements, applicable safeguards and whether overseas data transfers meet relevant Singapore PDPA requirements.
5. Inaccurate or unintended disclosures
AI-generated responses may reveal information from the context provided or send incorrect information to the wrong recipient if workflows are poorly designed. Automated actions can make mistakes happen faster and affect more records.
These risks vary according to the tool, information involved and level of automation. A basic writing assistant and an AI agent connected to customer databases require different levels of access and oversight.
What Does Singapore’s PDPA Mean for Businesses Using AI?
Singapore’s Personal Data Protection Act (PDPA) governs how organisations collect, use and disclose personal data. Using AI does not remove an organisation’s existing data protection responsibilities.
The Personal Data Protection Commission’s (PDPC) Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems explain how the PDPA applies to relevant AI systems, including considerations around consent, exceptions, accountability and transparency.
For businesses, key considerations include:
- Purpose and consent: Establish an appropriate basis for collecting, using or disclosing personal data and communicate relevant purposes.
- Protection: Put reasonable security arrangements in place to prevent unauthorised access, use or disclosure.
- Retention: Do not retain personal data longer than necessary for legal or business purposes.
- Accountability: Assign responsibility for data protection and establish appropriate policies and processes.
- Overseas transfers: Ensure applicable requirements are met when transferring personal data outside Singapore.
The appropriate requirements depend on the circumstances. Businesses should assess their specific use cases rather than assume that using an established AI provider automatically makes their practices compliant.
6 Practical Ways to Protect Customer Data When Using AI
- Set Clear Rules for AI Use
Create an AI usage policy that explains which tools employees may use, what information they can enter and which tasks require approval.
For example, employees may use an approved AI assistant to draft general marketing content but must not upload customer records to an unapproved application.
Provide training and review the policy regularly as tools and business needs change.
2. Minimise the Data You Share
Only provide information necessary for the task. Remove customer names, identification numbers, contact details and other identifying information when they are not required.
For example, when asking AI to summarise customer feedback, use anonymised comments instead of uploading a spreadsheet containing names and email addresses.
The PDPC’s Guide to Basic Anonymisation explains how anonymisation can help reduce privacy risks. Simply removing names may not be sufficient if individuals can still be identified from other details.
3. Check the AI Provider’s Privacy and Security Terms
Before adopting an AI tool, review its data handling practices.
Check whether the provider:
- Uses submitted information to train models and whether this can be controlled.
- Retains prompts, files and conversation histories.
- Offers appropriate access controls and encryption.
- Supports data deletion and relevant contractual requirements.
- Explains where data is processed and how third-party providers are involved.
Do not assume that every AI tool offers the same protections. Choose a service that matches your data sensitivity and operational requirements.
4. Restrict Access and Permissions
Give AI applications access only to the information and functions they need.
If an AI agent connects to a CRM, for example, it may need permission to read selected customer records but not to export the entire database or modify account details.
Use multi-factor authentication where available, protect API credentials and review access permissions regularly. Require human approval before high-impact actions, such as issuing refunds or changing customer records.
5. Establish Data Retention and Incident Procedures
Define how long customer information, AI prompts and generated outputs should be retained. Remove unnecessary copies and establish deletion procedures.
Your business should also have an incident response plan covering suspected data exposure, unauthorised access and accidental disclosure.
Under Singapore’s PDPA, organisations must assess data breaches and notify the PDPC and affected individuals when the applicable notification criteria are met. Staff should know whom to contact and how to escalate an incident promptly.
6. Review AI Outputs and Automated Actions
AI outputs should not automatically be treated as accurate or safe.
Before allowing an AI workflow to send customer communications, update records or make decisions, test it with realistic scenarios and unexpected inputs.
For sensitive tasks, introduce approval checkpoints and maintain logs. Review performance regularly to identify errors, unusual access or actions outside the intended scope.
Singapore’s Model AI Governance Framework for Agentic AI provides further guidance on setting limits, maintaining human accountability and implementing technical controls when deploying AI agents.
How Exabytes Singapore Can Support Your Data Protection Strategy
Protecting customer data involves more than selecting an AI application. Businesses also need suitable infrastructure, security controls, backup arrangements and ongoing monitoring.
Exabytes Singapore offers enterprise services that can support these broader requirements.
Cloud Security and Assessment Services
Exabytes’ Cloud Security and Assessment Services help businesses assess cloud infrastructure, identify misconfigurations and monitor security threats. These services can support an organisation’s wider security programme, although they do not automatically make an AI application PDPA-compliant.
Cloud Backup and Data Protection Services
Exabytes’ Cloud Backup Services include data protection options designed to help businesses protect information against threats such as ransomware.
Backups can support recovery after data loss or system incidents, but they do not prevent every privacy breach. Businesses should also implement access controls, secure configurations and appropriate data handling practices.
Before selecting a solution, assess where your customer data is stored, which applications can access it and what safeguards your business needs.
Conclusion: Make AI Data Privacy Part of Your Implementation Plan
AI can improve business efficiency, but customer data must be handled responsibly throughout implementation and daily use.
Start by identifying the information your employees share with AI tools, assessing provider policies and limiting access to what each application needs. Establish clear usage rules, review automated actions and prepare for potential incidents.
For Singapore businesses, a practical AI data privacy strategy combines appropriate technology, employee awareness and compliance with applicable data protection requirements.
FAQs
- Is it safe to enter customer data into AI tools?
It depends on the tool, the information involved and its privacy settings. Before submitting customer data, review the provider’s retention, training and security policies. Avoid entering sensitive information into unapproved tools, and use anonymised or minimised data whenever possible.
2. How does Singapore’s PDPA apply to businesses using AI?
The PDPA applies to relevant collection, use and disclosure of personal data, including activities involving AI. Businesses should assess applicable consent, purpose limitation, protection, retention and accountability requirements. The exact obligations depend on the use case, so organisations should consult PDPC guidance and seek professional advice when necessary.
3. Can AI tools use customer data for model training?
Some providers may use submitted information for model improvement or training, depending on their terms, product settings and service arrangements. Businesses should verify these practices before use and avoid assuming that customer data remains private by default. Choose appropriate settings and contractual protections for the information being processed.
4. How can Singapore SMBs reduce AI data privacy risks?
SMBs can introduce an approved-tool policy, minimise personal data shared with AI, review provider security terms and restrict application permissions. Employee training, human approval for sensitive actions and regular access reviews can further reduce risks without requiring businesses to stop using AI.
5. What should a business do if customer data is exposed through an AI tool?
Contain the incident, restrict further access, preserve relevant records and notify the responsible internal team. Assess the information involved and follow the organisation’s incident response procedures. Under Singapore’s PDPA, assess whether the breach meets the applicable notification criteria and notify the PDPC and affected individuals when required.
