Is DeepSeek or Qwen Safe for Business? Data, PDPA and Open Models

Hosted app vs open weights: the difference that matters

'DeepSeek' and 'Qwen' each mean two different things, and the risk is very different.

DeepSeek publishes its models, including DeepSeek V4.1 Flash, on its Hugging Face page, and Alibaba publishes open Qwen models such as Qwen3.8 27B on the Qwen page. Not every model is open: Arena lists Qwen3.8-Max as proprietary, meaning it is only available through Alibaba's own service.

What DeepSeek's privacy policy says about your data

These points come straight from the DeepSeek privacy policy, read in October 2026. It covers the DeepSeek apps, website and related services.

• Who controls the data: Hangzhou DeepSeek Artificial Intelligence Co., Ltd., with its registered address in China.
• What it collects: account details, your text and voice input, prompts, uploaded files, photos and chat history, plus device data such as IP address and device identifiers.
• Where it is stored: 'we directly collect, process and store your Personal Data in People's Republic of China.'
• Training: the policy lists improving and training its models as a purpose, and offers a right to opt out of training.
• Sensitive data: it says the services are not designed for sensitive personal data and that you should not provide it.

What the PDPA expects when data leaves Singapore

The PDPA does not ban any AI tool. It sets obligations on your business when you collect and use personal data. Two matter most here, as described on the PDPC data protection obligations page:

• Transfer Limitation Obligation: you may transfer personal data to another country only according to the PDPA regulations, so that it gets a standard of protection comparable to the PDPA.
• Protection Obligation: you must make reasonable security arrangements to protect personal data in your possession or under your control.

Pasting a customer's details into an overseas AI service is a transfer. With an enterprise AI plan, the vendor contract usually covers this. With a consumer app whose policy says data is stored in China and used for training, it is hard to show comparable protection. Singapore's Ministry of Digital Development and Information, answering a parliamentary question on DeepSeek in March 2025, said the Government uses frameworks to evaluate technologies by performance, security and resilience. It did not ban the tool. This is general information, not legal advice.

How good are DeepSeek and Qwen compared with ChatGPT or Claude?

IT Sorted has not run its own tests. On published leaderboards, the best open models are capable but behind the top closed models.

The appeal of open models is cost and control rather than raw quality. A smaller open model on your own server can handle sorting emails, tagging documents or answering FAQs from your own files, with data that never leaves your environment. For general office work, a business plan from a major vendor is simpler; see ChatGPT vs Claude vs Gemini for business.

Rules for staff: what is fine and what is not

Write the rule down in one paragraph and send it to everyone. The same rules apply to any free AI tool, whichever country it comes from. Our PDPA checklist for small businesses shows where an AI-use rule fits in your data protection policy, and the PDPA rules on NRIC numbers explain why NRICs need extra care.

If you want to use an open model safely

1. 1

   Write down the use case

   What task, what data goes in, who sees the output. If no personal data is involved, the risk is much lower.

2. 2

   Choose where the model runs

   Your own server, or a cloud provider with a Singapore or chosen region and a data processing agreement. Hugging Face lists third-party hosts for many open models; each host has its own terms.

3. 3

   Check the licence

   MIT and Apache 2.0 allow commercial use. Some models carry their own licence, so read it before you build on it.

4. 4

   Lock down access

   Put the tool behind your company login, keep logs, and limit who can upload files.

5. 5

   Test answers before staff rely on them

   Run a set of real questions with known answers and check accuracy, especially for prices and policies.

Our IMDA AI governance checklist turns Singapore's frameworks into a one-page record of these decisions.

Do it yourself or get help?

Setting a staff rule on AI apps is a ten-minute job you should do today. Running an open model yourself is a technical project: a server, updates, access control and testing.

Security Awareness Training (S$390) gives staff a short session and a written AI-use rule covering DeepSeek, Qwen and other free tools. If you want an internal AI tool on infrastructure you control, Custom Tool or Dashboard (from S$1,990) scopes and builds it in writing with a fixed price before work starts.