In this guide · 8 sections
- 01Can staff use ChatGPT at work under the PDPA?
- 02Personal vs business AI accounts: why it matters
- 03Data staff must never paste into AI tools
- 04A one-page AI use policy you can copy
- 05Securing AI tools: what CSA recommends
- 06Rolling the policy out in a small team
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Yes, staff can use ChatGPT at work if you set rules. Use a business plan (ChatGPT Business, Claude Team or Gemini in Workspace) so data is not used for training by default, ban pasting NRIC numbers, health or customer records, and make a person check every output before it is sent.
Can staff use ChatGPT at work under the PDPA?
Yes. The PDPA does not ban AI tools. It does make your organisation responsible for any personal data your staff collect, use or disclose, including what they type into a chatbot. If an employee pastes a customer list into a personal ChatGPT account, that is your company disclosing personal data to a third party.
The PDPC's Advisory Guidelines on Use of Personal Data in Generative AI (published 20 July 2026) call businesses that use AI tools 'system deployers'. They say deployers bear primary responsibility for checking that the tools they choose let them meet PDPA obligations, and should educate staff on which types of personal data may go into prompts. They also encourage clear written policies.
That is the job of a short AI use policy. It does not need to be long. It needs to answer: which tools, which accounts, which data, and who checks.
Personal vs business AI accounts: why it matters
The biggest single decision is whether staff use their own free or Plus accounts, or a company workspace. Here is how OpenAI describes the difference, as of October 2026.
| Personal (Free, Go, Plus, Pro) | Company workspace (Business, Enterprise) | |
|---|---|---|
| Used to train models? | Yes by default; staff can opt out in settings | No by default |
| Who owns the account? | The employee | Your company |
| Admin console and roles | No | Yes |
| SAML single sign-on | No | Yes |
| Remove access when someone leaves | You cannot | Remove the seat |
| Data processing addendum (DPA) | No | Available |
OpenAI's Enterprise privacy page states it does not train on business data from ChatGPT Business and Enterprise by default, and offers a DPA. On personal plans, the data controls FAQ explains the 'Improve the model for everyone' setting, which each user must switch off themselves. Temporary chats are not used for training but may be kept for up to 30 days.
Claude Team and Gemini in Google Workspace make similar no-training commitments for business accounts. Prices for each are in our ChatGPT Business price guide and the ChatGPT vs Claude vs Gemini comparison.
Data staff must never paste into AI tools
Even on a business plan, keep a short 'never paste' list. A business plan reduces the training risk; it does not stop a mistake, a shared chat link, or an output that repeats someone's details to the wrong person.
Never paste into any AI tool
Two habits make this workable. First, anonymise before pasting: replace names with 'Customer A' and remove phone numbers and addresses. Second, paste the minimum: the paragraph you need rewritten, not the whole thread.
A one-page AI use policy you can copy
Adapt these points to your business, put them in your staff handbook, and ask everyone to confirm they have read it. Keep it to one page so people actually read it.
Approved tools and accounts
Staff may use [company-approved tools, e.g. ChatGPT Business] signed in with their work account only. Personal AI accounts and browser extensions that read web pages or email are not allowed for work data.
What may go in
Public information, your own draft text, anonymised examples and internal documents marked as non-confidential.
What must never go in
The 'never paste' list above. If unsure, ask [named person] before pasting.
A person checks every output
AI drafts can be wrong, out of date or invent facts and sources. A named staff member reads and checks anything before it goes to a customer, a government agency or social media.
No decisions about people by AI alone
Do not use AI to decide on hiring, pay, credit or refunds without a person reviewing the reasons. Tell customers when they are chatting with an AI assistant.
Report mistakes the same day
If personal data was pasted by mistake, delete the chat and tell [named person] the same day so the company can assess whether it is a notifiable data breach.
Accounts are removed when staff leave
The admin removes the person's AI seat on their last day, together with email and other logins.
Point 6 matters because the PDPA has a breach notification duty. Our data breach notification guide explains the 3-calendar-day timeline if a breach is notifiable.
Securing AI tools: what CSA recommends
CSA's Guidelines and Companion Guide on Securing AI Systems (October 2024) are written mainly for organisations that build or run AI systems. For a small business that only uses chat tools, the practical points are simpler:
- Turn on MFA for every AI account, the same as for email.
- Use single sign-on with Microsoft 365 or Google where the plan supports it, so leavers lose access in one step.
- Review connected apps. If ChatGPT or Claude is linked to your Google Drive or mailbox, check which folders it can read.
- Be careful with AI agents and browser extensions that can click, send email or buy things on your behalf.
- Treat AI output as untrusted: do not run code or formulas from a chatbot on business systems without checking them.
If you deploy AI that talks to customers, such as a website chatbot, more rules apply. Our AI chatbot guide covers notices, guard-rails and the PDPC's earlier guidelines on AI recommendation systems.
Rolling the policy out in a small team
For a team of 3 to 20 people, the rollout fits in a week. Buy a business plan with at least two seats, invite staff with their work email, and switch off any personal accounts used for work. Then run a 20-minute briefing using real examples from your business: a quote email that is fine to draft, and a customer complaint that must be anonymised first.
Add the AI tool to your PDPA records. If you keep a personal data inventory, list the AI service as a third party that may receive personal data, note the plan and settings, and keep a copy of the provider's DPA. Our PDPA checklist shows what else that inventory should contain.
Review the policy every six months. AI plans, settings and PDPC guidance change often; the generative AI guidelines above were only published in July 2026.
Do it yourself or get help?
Most owners can write the policy from the template above in an hour. The harder part is getting staff to follow it, especially the 'never paste' list and the human check.
Before you finish
If you want help, Security Awareness Training (S$390) includes a short AI-use policy and a lesson on what not to paste into AI tools, tracked per staff member. If you want AI to answer customers on your website using only your own FAQ and prices, AI Website Assistant (S$790) sets one up on accounts you own, with guard-rails.
Frequently asked questions
No. Singapore has no law that bans staff from using ChatGPT or other AI tools. The PDPA applies to any personal data they put into those tools, and your organisation is responsible for it. That is why a written policy, a business account and a ban on pasting sensitive personal data are recommended by the PDPC's generative AI guidelines.
OpenAI states that it does not train its models on data from ChatGPT Business or Enterprise workspaces by default, as of October 2026. Data can be used if your workspace explicitly opts in, for example through feedback mechanisms. Personal Free, Go, Plus and Pro accounts can be used for training unless each user turns the setting off.
Only after removing personal details, and only on a company-approved business account. Replace names, phone numbers, addresses and order numbers with placeholders, and paste only the part you need help with. Never paste NRIC numbers, health or financial details. If personal data is pasted by mistake, report it the same day.
If customers chat with an AI assistant, tell them clearly that it is AI and how their messages are handled, and update your privacy policy. If staff only use AI privately to draft text that a person checks, most businesses mention AI tools as service providers in their privacy policy rather than in every message.
It is fine for public information, such as drafting a social media post. It is a poor fit for anything involving customers or staff, because the account belongs to the employee, conversations can be used for training unless switched off, and you cannot remove access when the person leaves.