You will be able to recognise the kinds of information that should stay out of an assistant unless you have approval.
Check anything you're about to put into an AI assistant for personal data or confidential business data. If you find either, keep it out until your company has approved that use. If you aren't sure what you're looking at, take it to your manager or the data protection officer and let them help you decide.
Hafiz is the invented character you first came across in Lesson 2.1, and much of what lands on his desk is HR-type material. Picture an ordinary Tuesday before lunch. A medical certificate comes in by email. A manager passes him notes for a staff appraisal. Finance wants him to confirm next month's payroll changes. A recruitment agency sends over three CVs, and each one lists the candidate's phone number, home address and expected salary. Between these, he is working on a new version of a job advert.
An assistant could speed up every one of those jobs, so Hafiz needs a fast way to tell which items are allowed in. Nothing about this material feels dramatic to him. It is part of a normal working day, and sensitive information that feels routine is easy to paste in without stopping to think. His method is two tests followed by a sort into three colours.
Personal data means information about a person who can be identified from it, either by itself or once it's combined with other information you hold. A name by itself might identify someone or might not. Put that name next to a phone number, an email address or an employee ID, and the person is identified.
In most offices, personal data shows up as names with contact details, NRIC numbers, dates of birth, home addresses, salaries and bank account numbers. A few kinds call for extra care, since a leak causes more harm: health information such as medical certificates and diagnoses, performance and disciplinary records, and anything touching a person's finances or family circumstances. Hafiz's medical certificate, his appraisal notes and the payroll changes each belong to one of these groups.
It also sits in places you might not think to look. A screenshot of a group chat carries names and phone numbers. A meeting transcript shows who said what. A spreadsheet of customer orders holds names, addresses and buying history. As a working test, ask yourself whether you'd be uncomfortable if the item were forwarded to a stranger. If you would, handle it as personal data.
Singapore's PDPA (Personal Data Protection Act) sets the rules for how organisations collect, use and disclose personal data. Broadly, an organisation should collect and use personal data only for purposes people were told about and agreed to, keep it protected with reasonable security, and hold it only as long as it's needed. The Personal Data Protection Commission oversees the Act, and its guidance is published at pdpc.gov.sg.
Putting a colleague's details into an outside assistant means your company is passing personal data to a third party. Whether it may do so depends on things like the purpose, the terms agreed with the provider, and the security around the tool. An approved company tool covered by a proper contract and a personal account on your phone are very different situations. Responsibility for handling personal data sits with the company, and it reaches you through company policy and the data protection officer, so this is a decision you shouldn't take by yourself. You'll find out how to locate and use your own company's policy on personal data in Lesson 2.3.
Confidential business data covers information the company or its clients would not want leaving the organisation. Client lists and contact databases, contracts and their terms, pricing and margins, financial results not yet released, plans for products or restructuring, and anything under a non-disclosure agreement are the usual examples.
The test is two questions. First, would the company or a client object if this turned up outside the firm? Second, would a competitor getting hold of it cause harm? If the answer to either is yes, treat it as confidential. A missing label changes nothing, and plenty of the most important documents in any office have no label on them.
A lot of client material is personal and confidential at once, such as a list of a client's employees and their salaries. Where both apply, you follow whichever rule is stricter.
Some material will stay unclear after both tests. An internal org chart could go either way on confidentiality. A summary of anonymous survey comments could count as personal data if the team has only four people, since the comments may point back to individuals. In cases like these, treat the material as confidential and check with your manager or the data protection officer. A question costs you a few minutes, and a disclosure is far harder to reverse, and sometimes can't be reversed at all.
With both tests done, each item goes into one of three groups:
Green covers anything already public or with nothing about people or clients in it, such as a published job description. You can use it freely. Amber covers internal material that holds no personal details, such as a draft policy. It may go into an approved company tool. Red covers anything with personal data, health or pay details, or a client's confidential terms. It stays out of every assistant unless it has been redacted or your policy plainly permits it.
Applied to Hafiz's Tuesday, the medical certificate, the appraisal notes, the payroll changes and the three CVs all land in red. The job advert is his single green item. When something won't sit neatly in one colour, he handles it as confidential and checks with his manager or the data protection officer before he does anything with it.
People who sort their own files this way often find they see their week differently afterwards. Go through a week of your own files using the same three colours, and pick out five examples of the personal or confidential data you handle.
Look through one week of your work files. List five examples of personal or confidential data you handle, and sort them from most to least sensitive.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).