You will be able to explain why the same assistant can be fine on one account and not on another.
Check which account you're signed in to before you paste anything from work into an AI assistant. The account has more say over where your prompt goes than any setting you've changed.
Jia Hui (an invented example) is in the marketing team of a furniture retailer in Ubi. On Monday she uses ChatGPT on her phone to sort out a birthday dinner for a friend. On Tuesday she opens the same app and pastes in her draft of next quarter's promotion plan. Signing in to her company's tool takes longer, so she skips it.
To Jia Hui, it's one assistant doing two jobs. Her employer and the law see two uses that are nothing alike. If she had opened the assistant her company approved, the plan would sit under an agreement her employer signed, with settings her IT team chose. In the phone app, the only thing covering it is a set of terms she clicked through a year ago and hasn't read since.
Most people never check which account they're using. The account behind an app can change what that app means for an employer, and under the law, even when nothing else is different. Lesson 1.1, "What happens to the words you type into an assistant", explained how your settings shape where a prompt ends up. Your account shapes it more than your settings do.
Almost every assistant comes with a free tier and one or more paid tiers for individuals. A personal plan means any of those tiers, free or paid, sold to a single person who accepts the provider's terms by clicking through them.
The terms on these plans often let the provider use your conversations to improve its models. This is the training question from lesson 1.1. Many providers now give you a switch to opt out of training. Expect training to be on by default and the switch to sit a few screens down. Each product also gives it a different name. Paying for a personal plan gets you more features and higher limits, but the data rules don't automatically change when you upgrade.
With a personal account, the agreement is between you and the provider and nobody else. Your employer hasn't negotiated any contract, no administrator can see what you put in, and the company has no way to delete any of it for you.
Business, team and enterprise plans are sold to organisations. A business plan usually has its own commercial agreement, and that agreement typically commits the provider not to train its models on the customer's data. Many business plans also come with a data processing agreement, which sets out how the provider handles personal data on the organisation's behalf.
The employer also gets admin controls. These are settings managed by someone in IT or operations, and they apply to every user. Through them the company decides who can sign in, how long chat history is kept, which connectors are allowed, and whether conversations can be exported if there's an investigation. Some business plans let the company pick the region where its data is stored.
A business account still carries risk. It gives the company someone whose job includes reviewing those risks, and written promises from the provider that the company can enforce.
Most people who put work into a personal account are trying to get their work done. The approved tool might be slower or missing from their phone, or they might not know the company has one. Whatever the reason, the work data leaves company systems and ends up somewhere the company never agreed to and has no view of.
A part-time tutor at a small tuition centre in Tampines (an invented example) gets a complaint by email from a parent, with the child's name and the child's school in it. The tutor copies the whole email into a free assistant and asks it for a calm reply. The reply it writes is good. The centre now has a pupil's details in an account it doesn't control, under terms nobody at the centre has read. Nothing bad may come of it, but the centre can no longer say where that information is.
If customers' names or contact details are in the data, sharing it may count as a disclosure under Singapore's Personal Data Protection Act, which module 2 covers. If a client's plans are in it, it may breach a confidentiality clause. If someone later asks the company what became of the data, the company has no answer to give, since it never knew the data had gone.
What's described above are common patterns. They don't guarantee how any particular product behaves. Providers change their plans, setting names and policies, sometimes several times a year. A plan that trained on chats last year may have stopped, and one that didn't may have begun.
A colleague's account, a news report, or whatever applied on the day you signed up won't tell you the current position. Go to the provider's current privacy policy and, for work use, the terms of the plan your company is actually on.
Start by working out which account is in front of you. It's either a personal one, free or paid, or a business, team or enterprise one. At home on your own account, you decide what to share, using the three groups from lesson 1.1. At work, find out whether your employer has approved this tool and this account for this kind of data. If you don't know, assume the answer is no until you've found out.
If you can't find the terms, ask the person who manages the tool. That could be your manager, IT or compliance. People ask this question all the time, and a good IT or compliance team will be glad to get it. Jia Hui didn't know whether her company had an approved assistant. She sent her manager one message and got her answer: the company had one, and the approved tools were listed on the staff intranet.
Your next step is to find the same answer for your own workplace, and to note exactly where it's written down so you can check it again when things change.
Find out which AI tools and account types your employer has approved, and write down where that list is published.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).