Chatbot Conversation Logs and PDPA: Retention, Access, Vendors

Why chatbot logs are personal data under the PDPA

A transcript linked to a name, phone number, email or order number is personal data. So is a WhatsApp conversation, because the phone number identifies the person. The usual PDPA obligations apply: notify the purpose, use the data only for that purpose, protect it, keep it only as long as needed and let people access and correct it.

PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, published 20 July 2026, call a business that uses an AI chatbot a System Deployer and give it primary responsibility for PDPA compliance. The chatbot vendor or developer is usually your data intermediary. Our summary of the PDPC generative AI guidelines covers the roles in detail.

Where your chatbot conversations are actually stored

Most small business chatbots have two or three layers. Each one may keep its own copy.

On the AI layer, OpenAI's API data controls page says abuse monitoring logs are kept for up to 30 days by default, with zero data retention available to qualifying customers. Anthropic's commercial retention article says it deletes API inputs and outputs within 30 days, with exceptions such as zero data retention agreements or Usage Policy enforcement. Both checked 19 October 2026.

The chat platform layer is usually the bigger risk, because transcripts there are kept until someone deletes them, and they are tied to a named contact.

What to tell people when the chat starts

Put a one-line notice in the chat window, before the first question, with a link to your privacy policy. On WhatsApp, include it in the first automated reply.

• That they are talking to an AI assistant, and how to reach a person.
• Why the conversation is recorded, for example to answer enquiries, handle orders and improve service.
• Which providers process it, in general terms such as 'our chat platform and AI service provider'.
• What not to share, such as NRIC numbers, card details or medical information, unless you genuinely need them.
• How long you keep chats and who to contact about their data.

Setting a retention period for chatbot transcripts

PDPC's Retention Limitation Obligation says organisations must stop retaining personal data, or dispose of it properly, once it is no longer needed for any business or legal purpose. There is no fixed period for chat logs, so you decide and write it down.

1. 1

   Decide what you need chats for

   Answering follow-ups, order disputes, quality checks, training staff. Each purpose suggests a period.

2. 2

   Pick a period per type

   General enquiries may need only a few months. Chats that form part of an order or contract may follow your business record retention.

3. 3

   Switch on deletion in each layer

   Use the chat platform's retention or deletion settings, check the AI provider's terms, and clear copies in sheets, CRMs and inboxes.

4. 4

   Turn off logging you do not need

   Debug logs and full-transcript email alerts often keep more than anyone reads.

5. 5

   Record it in your retention policy

   Note the period, the systems and who checks it. Our data retention policy template has a format.

Check how deletion works before you rely on it. Intercom's help centre, for example, notes that deleting a contact also deletes all of that contact's conversations, and that single conversations are deleted through its API.

Access and correction requests for chat logs

A customer can ask what personal data you hold about them, including chatbot transcripts. You must reply as soon as reasonably possible, and if you need more than 30 days, tell them in writing within 30 days when you will respond. Our guide on how to respond to a PDPA access request walks through the steps.

Chatbot data breach scenarios

Chatbots add a few breach risks that ordinary contact forms do not have.

• Leaked admin login to the chat platform exposes every transcript ever kept. MFA and short retention limit the damage.
• Bot reveals another customer's data, for example an order-lookup flow that does not check the customer's identity.
• Prompt injection that tricks the bot into revealing internal documents or customer records it can access.
• Public sharing links to transcripts or exports left open.

If a breach happens, assess it quickly. It must be reported to PDPC if it is likely to cause significant harm or affects 500 or more people; our PDPA data breach notification guide explains the timelines.

Do it yourself or get help?

If you already run a chatbot, start with the notice, the retention setting in your chat platform and switching off training on conversations. That covers most of the risk in an afternoon. Our guide to AI chatbots for Singapore websites covers choosing a platform.

Our AI Website Assistant (S$790) is set up with a chat-start notice, limited data access and retention settings from day one. For a wider review of notices, retention and vendors, the PDPA Compliance Pack (S$690) covers your whole business.