Check three real or planned AI uses at your workplace against a short PDPA checklist.
AI assistants tend to spread through a workplace one person at a time. Someone finds a tool that saves an hour, a colleague copies the idea, and soon several people are putting work into different tools without anyone checking what data goes where. When a manager finally asks which uses are acceptable, most staff have no quick way to answer.
A four-question check drawn from module 2 gives you a first pass you can do yourself. It sorts the easy cases from the ones that need someone with more authority, and each use you check ends with a one-line recommendation. It is a quick first pass and not a legal review, which a lawyer would take much further.
The first question asks whether personal data is involved and whose it is. Use the definition from lesson 2.1, "PDPA basics every employee should know", along with the list in lesson 2.2. Say who the data belongs to: customers, patients, job applicants, staff or members of the public. Flag anything especially sensitive, such as health details, financial information or NRIC numbers.
The second question asks whether your organisation has approved the tool and where it processes data. The approved-tools list from lesson 1.2 settles the first part. For an approved tool, try to find out where the processing happens, since data handled overseas brings in the transfer limitation obligation. If the tool is not on the list, write that down plainly.
The third question asks whether people were told about this purpose and agreed, or whether another basis under the Act applies. The Act is the PDPA, Singapore's Personal Data Protection Act. Go back to what people were told when their data was collected, usually in a privacy notice or a form. A use outside what they were told may need fresh consent, or an exception may apply. Whether an exception applies isn't your call alone, so flag it for the data protection officer.
The fourth question asks whether identifiers can be removed, and who signs off if they can't. Follow the method from lesson 2.2. If the task still works without the personal data, the other three questions mostly fall away. If it doesn't, name the person who should approve the use.
Go ahead: no personal data is involved, or an approved tool is used for a purpose people were told about. Change it: the task is fine in principle, but something has to change first, usually removing identifiers or moving to the approved tool. Ask the data protection officer: personal data is involved and question three has no clear answer, or the data is sensitive, or you aren't sure.
When in doubt, pick the third. Asking costs a short email, while a wrong guess can cost the company far more.
Daniel works at a clinic. At the weekly meeting his manager asks which AI uses are fine and which should stop. Three people have started using assistants for different jobs, and nobody has checked any of them. Daniel volunteers to find out and gives himself thirty minutes.
Siti, at reception, pastes patient feedback forms into her personal AI assistant to find common complaints, with names and phone numbers left in. Personal data: yes, patients' names, contact details and treatment comments, and the comments include health information. Approved tool: no, it's her personal account and the clinic never approved it. Purpose: patients gave feedback to help the clinic improve, and nobody told them it would go to an outside AI provider. Identifiers: removable, since names and numbers can come out and physio names can be replaced with labels. Daniel's recommendation is change it: remove the identifiers and use the clinic's approved tool, or skip AI for this task.
Marcus, a physiotherapist, uses the approved assistant to draft a newsletter article on desk posture from his own knowledge. There's no personal data and the tool is approved, so questions three and four don't apply. Daniel writes go ahead and moves on.
The clinic manager wants to try an AI app that records treatment sessions and writes clinical notes automatically. Personal data: yes, patients' voices, health conditions and treatment, all of it sensitive. Approved tool: not yet, and the vendor's servers are overseas. Purpose: patients haven't been told their sessions would be recorded or processed this way. Identifiers: they can't be removed, because capturing the session is the whole point of the app. Daniel's recommendation is to ask the data protection officer before any trial, using the vendor questions from lesson 2.3, "What the PDPC has said about AI systems". Most of his thirty minutes go on this third use, which is where the time should go.
Pick three AI uses you know about: your own, a colleague's, or one your team is planning. Try to include at least one that you suspect is fine and one that makes you a little uneasy, so the check has something to sort.
Take each use through the four questions in order. Name whose data it is and flag anything sensitive. Say plainly if the tool isn't approved. Flag any possible exception for the data protection officer, and name who signs off if identifiers can't be removed. Then give the use one recommendation: go ahead, change it, or ask the data protection officer. Choose the last one when in doubt.
Write each answer in a sentence or two. Short answers are fine. Vague ones aren't: "some customer info" should become "customers' names and order histories". Move through the easy cases quickly and spend most of your time on the hardest use.
If your check lands on "ask the data protection officer", count that as a good result. You've turned an unspoken risk into a specific question with a named person to answer it. Start with the use you're least sure about.
Fill in the checklist for three AI uses at work, then write one line for each: go ahead, change it, or ask the data protection officer.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).