Shadow AI and the PDPA: What Happens When Your Staff Paste Customer Data Into ChatGPT

Shadow AI is personal data leaving your company through a tool you never approved, and under Singapore's Personal Data Protection Act, the fact that nobody authorised it is not a defence. When a staff member pastes a customer list, a payroll export or a patient note into a free consumer chatbot, your organisation has disclosed personal data to a third party you have no contract with, no visibility of and no power to recall. The PDPC will look at your organisation, not the employee. The fix is not a ban — bans simply move the behaviour onto personal phones where you cannot see it — it is to sanction one tool properly, write down the boundaries, and close the two or three specific gaps that make a leak unrecoverable.

What actually counts as shadow AI in a 20-person company?

It is rarely anything exotic. In the SMEs we audit, shadow AI looks like this: an operations executive pasting a 400-row debtor ageing report into a free chatbot to "summarise who to chase"; an HR admin uploading a CPF submission file to get help reformatting it; a salesperson dictating meeting notes with named clients into a transcription app chosen from an app store; a clinic receptionist dropping a patient enquiry screenshot into an image-reading chatbot to draft a reply.

None of these people are being reckless. They are doing the job faster with the only tool available to them, usually because the company never offered a sanctioned alternative. That is the important diagnosis: shadow AI is almost always a symptom of an unmet need, not of bad staff. Which is why the remedy has to include a sanctioned tool, not only a rule.

Does pasting customer data into a chatbot actually breach the PDPA?

It can, and the exposure runs through three obligations at once.

The Protection Obligation requires you to make reasonable security arrangements for personal data in your possession or control. Sending data into a consumer service whose free tier may use your inputs to improve its models, with no data processing agreement and no retention control, is hard to characterise as a reasonable arrangement.

The Transfer Limitation Obligation applies the moment that data lands on servers outside Singapore, which it does immediately. You are required to ensure a comparable standard of protection overseas — normally through contractual terms you simply do not have on a free account.

The Data Breach Notification Obligation is the one that catches owners off guard. If a breach is likely to cause significant harm to affected individuals, or involves 500 or more individuals, you must notify the PDPC within three calendar days of assessing it as notifiable, and notify affected individuals as well. A single pasted customer export can cross the 500 threshold on its own. Penalties for larger organisations reach up to 10% of annual turnover in Singapore or S$1 million, whichever is higher — but for most SMEs the real cost is the notification itself, landing in the inbox of every customer on that list.

Worth reading alongside this: the PDPC's advisory guidelines on using personal data in AI systems, and the Model AI Governance Framework for Generative AI. Neither is a statute, but both describe the standard of care a regulator will expect you to have met.

How do you find out what your team is already using?

Assume the answer is "more than you think" and go looking with curiosity rather than discipline. Four checks, roughly a morning's work:

• Ask, without consequences attached. Say plainly that nobody is in trouble and that you need to know what is actually helping. You will get honest answers once, at the start — never again if the first round produces a reprimand.
• Check the OAuth grants. In Google Workspace, review third-party apps with account access; in Microsoft 365, review enterprise applications and consented permissions. Every "Sign in with Google" an employee clicked is listed there, with the scopes it was granted.
• Check expense claims and card statements for small recurring charges in the US$10–30 range. Individually-subscribed AI tools show up here before they show up anywhere else.
• Check your browser extension inventory if you manage browsers centrally. Extensions that read page content are the quietest route for data to leave.

Write the result down as a single list: tool, who uses it, what data goes in, what it replaces. That list is your actual AI estate, and it is the input to every decision below.

Which tasks are safe to hand over, and which are not?

The useful line is not "AI good / AI bad" — it is whether identifiable personal data has to be in the prompt for the task to work.

Generally safe, even on a consumer tool: drafting a generic policy or SOP, rewriting marketing copy, explaining a regulation, writing a formula or a script, summarising a public document, brainstorming interview questions.

Safe only on a sanctioned business-tier tool with the right settings: summarising internal meeting notes, drafting a reply to a named customer, analysing sales data by customer, cleaning a product or customer master list.

Not to be handed to a general-purpose chatbot at all: payroll and CPF files, NRIC numbers, bank and card details, medical or health information, employment grievance and disciplinary records, and anything covered by a client confidentiality clause. These need either a tool with a signed processing agreement and a documented purpose, or no AI at all.

The practical enabler for the middle category is moving from free consumer accounts to the business tiers you may already own: Gemini within Google Workspace, Microsoft 365 Copilot, or a paid ChatGPT Team or Enterprise workspace. These do not train on your business content by default and give you an administrative boundary — which turns an uncontrolled disclosure into a documented processor relationship.

What should you change in your system before January 2027?

Five changes, in order of how much exposure they remove per hour spent:

1. Sanction one tool and pay for it. One tool, licensed for everyone who needs it, administered by you. The cost of a handful of business seats is trivially less than one breach notification exercise.
2. Write a one-page AI use policy. Not a legal document — a page that names the approved tool, lists the three data categories that may never be pasted anywhere, says who to ask when unsure, and is acknowledged in writing by every staff member. One page that people read beats twelve pages that sit in a shared drive.
3. Turn on MFA or passkeys everywhere, starting with the accounts that hold the data worth leaking. An AI policy on top of a single-factor Workspace tenancy is a lock on an open window.
4. Fix offboarding. Build one checklist that revokes Workspace or 365 access, removes the person from WhatsApp groups and shared drives, and — the step everyone misses — revokes their OAuth grants and any AI tool seat. Ex-staff still holding live access is the most common finding in our audits.
5. Test one restore. Pick one critical dataset, restore it to a scratch location, confirm it opens. Untested backups are not backups, and AI-assisted workflows increase the number of ways data gets overwritten quickly.

Done together, these take a small team a week of calendar time and perhaps a day of actual effort. The alternative is not safety — it is the same AI use, happening on personal accounts, with no record of what went where.

Frequently asked questions

Can I just ban AI tools at my company? You can, but enforcement is the problem: staff will use their personal phones, and you lose all visibility while keeping all of the liability. A sanctioned tool plus clear boundaries produces measurably less exposure than a ban you cannot police.

Is a paid ChatGPT, Gemini or Copilot business plan enough for PDPA compliance? It is necessary but not sufficient. Business tiers give you the contractual and administrative basis you need, but you still have to limit which data categories are allowed in, document the purpose, train staff, and keep the tool inside your access-control and offboarding processes.

What if a staff member has already pasted customer data into a free chatbot? Treat it as a potential data breach: record what was disclosed, how many individuals are involved, when it happened, and assess whether it is likely to cause significant harm or affects 500 or more people. If it is notifiable, you have three calendar days from that assessment to inform the PDPC. Delete the chat history and revoke the account, but do not assume deletion resolves the obligation — document the assessment either way.