KEEP IN TOUCH
Subscribe to our mailing list to get free tips on Data Protection and Cybersecurity updates weekly!
Practical takeaway: Organisations do not need to choose between embracing AI and managing its risks. A clear governance structure — covering approved tools, permitted uses, employee responsibilities and appropriate specialist oversight — allows organisations to benefit from AI while managing foreseeable risks. Where personal data is involved, the DPO should be brought in early to assess the relevant data protection considerations and safeguards.
Artificial intelligence is increasingly becoming part of everyday business operations. Teams are using AI to draft communications, summarise documents, analyse information, support customer service, develop software, automate workflows and improve productivity.
For organisations, the objective should not simply be to restrict AI usage. Instead, the priority is to establish clear, practical guardrails so employees understand which AI tools are approved, what they may be used for, what information may be provided to them, and when additional review or approval is required.
Privacy Ninja has observed increasing questions from organisations about AI policies, governance responsibilities and the use of personal data within AI-enabled workflows. A practical starting point is to establish clear ownership of AI governance, supported by the relevant stakeholders across management, business functions, cybersecurity, legal, procurement and data protection.
Where personal data is involved, the DPO plays an important role in identifying foreseeable data protection risks and recommending appropriate safeguards. However, data protection represents one component of a broader AI governance framework, rather than the entirety of it.
Effective AI governance starts with clear internal ownership. Organisations should appoint an appropriately authorised stakeholder to lead and coordinate their AI strategy and governance, with sufficient management support to establish approved uses, make decisions and bring together the relevant functions.
That lead should not operate alone. Depending on the organisation and the AI use case, support may come from department heads and process owners, IT and cybersecurity, legal, procurement, risk, HR and the DPO.
Each stakeholder contributes expertise within their respective area. Where an AI use case involves or may involve personal data, the DPO should be consulted early to assess the relevant PDPA considerations, identify foreseeable data protection risks and recommend appropriate safeguards.
A comprehensive AI governance Singapore framework may cover business objectives, approved and prohibited uses, tool selection, procurement, cybersecurity, access controls, confidential information, intellectual property, output accuracy, human oversight, vendor management, employee responsibilities and incident handling.
Singapore’s Model AI Governance Framework emphasises clear internal roles, operational controls, appropriate human involvement, and understandable communication. IMDA’s framework for agentic AI also stresses upfront risk assessment, limits on autonomy, meaningful human accountability, technical controls, transparency, and training.
The most effective governance model therefore brings these disciplines together rather than expecting any single function — whether data protection, IT, legal or cybersecurity — to manage AI risk in isolation.
A practical AI governance Singapore approach begins with appointing an appropriately authorised internal stakeholder to lead and coordinate the organisation’s AI governance programme. The exact structure may vary depending on the organisation’s size, functions and AI use cases, but ownership, consultation and approval responsibilities should be clearly assigned from the outset.
Here is a simplified guide:
| Governance role | Recommended responsibility |
|---|---|
| Owned or coordinated by | Management, Risk, Compliance, IT or another relevant and authorised business function |
| Consulted stakeholders | Information Security, Legal, Human Resources, the DPO, and other relevant operational teams |
| Approved by | CEO, Board, or an authorised senior-management committee |
The AI governance owner coordinates the overall programme, while relevant stakeholders contribute specialist knowledge based on the particular AI use case. For example, a department owner can explain the business purpose and intended workflow, cybersecurity can assess technical risks, procurement or legal can review contractual considerations, and the DPO can advise on applicable personal data protection requirements.
The DPO should be involved when an AI system collects, uses, discloses, stores, analyses or otherwise processes personal data. Under Singapore’s PDPA, personal data is data about an identifiable individual, whether identification is possible from that data alone or together with other information available to the organisation. Organisations remain responsible for applicable data-protection obligations.
The DPO should understand the proposed use, identify foreseeable data-protection risks, and recommend safeguards. This allows the DPO to contribute specialist data protection expertise as part of the wider governance process, while the organisation’s appointed AI governance owner and management retain responsibility for the overall AI initiative and business decisions.
Not automatically. An organisation may use AI to generate generic marketing copy, create fictional images, summarise non-personal business information, develop presentation layouts, or conduct research without processing personal data at all.
However, the assessment must cover prompts, uploaded files, source records, outputs, logs, stored histories, profiles, inferences and AI-supported decisions. Even where the PDPA is not engaged, issues such as confidentiality, cybersecurity, copyright, intellectual property, contractual, accuracy, and reputational risks may remain.
The DPO should be informed before implementation where AI will, or may, process personal data. Examples include analysing or summarising personal records, profiling or scoring individuals, personalising services, monitoring employees or customers, processing complaints, supporting recruitment, or making recommendations or decisions affecting individuals.
Where Privacy Ninja is the appointed DPO, clients should provide sufficient information for fact-finding before launch. The PDPC has issued guidance on personal data used in AI recommendation and decision systems, including development, deployment, consent information, data-intermediary responsibilities and compliance practices.
The organisation should identify the AI tool and provider, business purpose, intended users, categories and sources of personal data, system inputs and outputs, retention practices, model-training arrangements, storage locations, overseas transfers, access permissions, human review, and whether outputs affect individuals or create new inferences or profiles.
Recommendations may include data minimisation, anonymisation, or pseudonymisation, access controls, vendor due diligence, retention and deletion rules, overseas-transfer safeguards, human verification, transparency to individuals, risk assessments, and updates to internal or external PDPA documents.
Fresh consent is not automatically required whenever AI processes personal data. The position depends on existing notified purposes, the proposed processing, the circumstances and any applicable PDPA provisions or exceptions. Relevant obligations may include notification, consent, purpose limitation, accuracy, protection, retention, overseas transfers, access and correction, accountability, and breach notification.
1.
2.
At minimum, employees should understand:
Organisations should also consider whether existing acceptable-use, information security, confidentiality or data-protection policies can be updated instead of creating unnecessary standalone documents. The appropriate approach depends on the organisation’s existing governance framework.
3.
If your organisation is already using or planning to introduce AI tools, a good first step is to understand what tools are being used, for what purposes, by whom, and what information is being provided to them.
Where an AI use case involves or may involve personal data, Privacy Ninja DPO-as-a-Service clients are encouraged to involve us early. Share the proposed AI tool, its intended business purpose, the categories of personal data involved, how the information will be used and the intended implementation timeline.
We can then assess the relevant PDPA considerations, identify foreseeable data protection risks and recommend practical safeguards before the workflow becomes embedded into day-to-day operations.
AI can deliver significant productivity and operational benefits. Good governance is not about preventing its use — it is about giving employees and management clear boundaries so the organisation can use AI confidently and responsibly.
To help organisations put this into practice, Privacy Ninja CEO Andy Prakash will be hosting a live client webinar on 2 December 2026, from 10:00 am to 11:00 am, covering practical AI governance, data protection considerations and live examples of safer AI usage.
EXPRESS INTEREST IN THE LIVE WEBINAR BY SIGNING UP HERE: forms.gle/AMTE1kxABYFXcChm8
Subscribe to our mailing list to get free tips on Data Protection and Cybersecurity updates weekly!
Subscribe to our mailing list to get free tips on Data Protection and Cybersecurity updates weekly!