PDPC Issues Advisory for Data Protection Risks When Using Unauthorised AI Tools for the Development of Software or Scripts

On 30 September 2026, the Personal Data Protection Commission (“PDPC“) released an advisory to address risks involved in the use of unauthorised Artificial Intelligence (“AI“) tools and recommend both process and technical measures that organisations should implement to fulfil their Protection Obligations under section 24 of the Personal Data Protection Act.

The advisory identifies the following key concerns:

1. presence of Shadow AI within the organisation;
2. non-human in the loop – over reliance on AI without adequate human oversight; and
3. software development failures – inadequate testing before deployment. 

Presence of Shadow AI within the organisation

Without clear policies and asset management controls governing the adoption of AI tools, employees may independently introduce unauthorised AI tools into the organisation’s environment (“Shadow AI“), which may process personal data, and thus, create uncontrolled data flows and expose personal data to unvetted third-party services.

Recommended mitigation measures:

1. Maintain visibility and control over AI tools in use by keeping an updated inventory of all AI tools, capturing purpose, data flow, and intended users for each system.

2. Establish clear governance policies for AI tools adoption by:

• • performing a dedicated security risk evaluation for each AI tool, including assessing the necessity of processing sensitive or personal data in the said tool;
  • having clear written policies and documented processes to safeguard personal data collected and processed by AI tools; and
  • applying the principle of least privilege to access control over AI tool environments (development or deployment) and personal data.

No human in the loop – over reliance on AI without adequate human oversight

Organisations that place undue reliance on AI-generated outputs without appropriate human verification risk deploying flawed or misconfigured systems. Given the evolving nature of AI technologies, outputs such as code, scripts and automated workflows should be reviewed and validated by technically competent personnel before deployment.

Recommended mitigation measures:

1. Ensure competent oversight of AI tools by:

• • educating users on the proper use of AI tools, including the associated security and data risks, as well as data-handling training;
  • training developers on data protection policies and secure coding practices; and
  • conducting periodic infocomm technology (ICT) security awareness training to keep employees updated on evolving security threats and good practices.

2. Implement technical measures to validate AI tools behaviour before and after deployment, including:

• • monitoring and logging AI tool activity to prevent misuse or manipulation of the tool, as well as to facilitate audit and investigation; and
  • monitoring and validating input prompts, queries or API requests relating to confidential information.

Software development failures – inadequate testing before deployment

AI-generated code and automated scripts may contain errors or security vulnerabilities that are not immediately apparent. Deploying such code without rigorous testing throughout the development lifecycle may result in data breaches. Organisations should therefore follow proper software development practices, including thorough testing, code review and validation, before deploying systems that handle personal data.

Recommended mitigation measures:

1. Conduct rigorous testing throughout the software deployment lifecycle including:

• • code review and rigorous unit testing at an early stage of development;
  • testing and benchmarking of AI tools before deploying or after any updates;
  • System Acceptance Testing (SAT), load testing, and stress testing at the near-end stage of development; and
  • security testing before commissioning for production, promptly after going live, periodically, and upon major changes.

2. Documenting configurations and not using personal data in non-production environments, as follows:

• • The configurations should be tested regularly to ensure they correspond to the security requirements.
  • Where data is required for testing or other purposes, organisations should create test data using Synthetic Data Generation, if appropriate.

Click on the following link for more information (available on the PDPC website at www.pdpc.gov.sg):

• PDPC Advisory for Data Protection Risks When Using Unauthorised AI Tools for the Development of Software or Scripts
• PDPC Guide to Data Protection Practices for ICT Systems
• PDPC Advisory Guidelines on Use of Personal Data in Generative AI

 If you have any queries on the above, please reach out to our team set out on this page.

For regional Technology, Media and Telecommunications matters, please see Rajah & Tann Asia’s Technology, Media & Telecommunications Practice for more information.