Last updated: 30 October 2026
You can use AI tools on customer data in Singapore, but only within the PDPA. You need a valid basis for the use, you should share only the data you need, and you must protect it. The safest habit for journey mapping is to remove names, phone numbers and email addresses before anything goes into an AI tool. This is practical guidance and is not legal advice.
In July 2026 the Personal Data Protection Commission (PDPC) issued guidelines on using personal data in generative AI. This guide explains where they matter for a business that is mapping its customer journey, and gives a checklist to run before you paste customer data into any AI tool. We are a training provider, and a lawyer has not reviewed this page. Check the PDPC’s own pages and take legal advice for your situation.
What did the PDPC’s July 2026 guidelines say about generative AI?
The PDPC issued its Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, after a public consultation that ran from 2 June to 1 July 2026. They are advisory and set out how the PDPC reads the existing obligations in the PDPA. The summaries we read do not give a separate effective date.
Where an organisation relies on consent to use customer data to develop or fine-tune a generative AI model, the guidelines expect an AI-specific notification. It should explain the purpose, the data used, how it will be used and how people can decline or withdraw consent. A general line about “new product development” is not enough for large-scale model training. Organisations should not make agreement to AI model development a condition of a product or service beyond what is reasonable. The guidelines also encourage anonymising datasets where possible, using only the data needed and setting retention rules for training data.
This summary draws on the law-firm briefings from Allen & Gledhill and Baker McKenzie. Read the PDPC’s own text for the full detail.
Do the guidelines apply if you only use an AI tool for journey mapping?
The AI-specific notification is aimed at organisations that use customer data to develop or fine-tune models. A business that pastes customer data into a third-party tool to analyse it may be in a different role, and the guidelines treat that role separately. For example, they say organisations that deploy AI systems should document their safeguards in written policies and review them regularly. Which rule applies to you depends on how the tool uses your data, so read the tool’s terms and ask a qualified adviser if you are unsure.
| Situation | What you are doing | What to look at |
|---|---|---|
| Training a model | Using customer data to train or fine-tune a model | AI-specific notification where consent is the basis, plus anonymising, data minimisation and retention rules |
| Using a third-party tool | Pasting or uploading customer data to analyse it | Written safeguards that you review regularly, the tool’s data terms and your ordinary PDPA obligations |
| Acting on AI output | Using AI recommendations to decide things about customers | The PDPC’s 2024 advisory guidelines on AI recommendation and decision systems, which cover what to tell consumers when seeking consent and good practices |
What personal data does journey mapping usually touch?
Journey mapping often draws on CRM exports, form submissions, WhatsApp and email threads, call recordings and transcripts, and website behaviour data. Names, phone numbers and email addresses are personal data. Messages and recordings can also contain personal data when no name is typed, such as a voice, an employer or the details of a purchase. If a person could be identified from the data, assume the PDPA applies.
What is the PDPA checklist for using AI on customer data?
Run this before you paste or upload customer data into any AI tool. The obligation names are the ones used in the PDPA.
| Step | What to check | PDPA obligation | Evidence to keep |
|---|---|---|---|
| 1. Remove identifiers | Strip names, phone numbers, email addresses and ID numbers. Replace them with codes such as Lead 12 | Protection and Purpose Limitation | A before-and-after sample of the cleaned file |
| 2. Check the purpose | Customers were told, or agreed, that their data could be used for analysis like this, or an exception applies | Consent, Notification and Purpose Limitation | The privacy notice or consent wording at the point of collection |
| 3. Read the tool’s data terms | Does the tool keep your data, use it to train models or share it? Which plan settings change that? | Protection | A dated copy of the terms and your settings |
| 4. Check where data goes | Is the data processed outside Singapore? | Transfer Limitation | The provider’s location statement and your own assessment |
| 5. Limit access | Decide who can export and use the data, and avoid shared logins | Protection | An access list |
| 6. Set a retention date | Delete the exported file and the chat history when the analysis is done | Retention Limitation | A deletion log |
| 7. Check the output | Review AI output before using it to decide anything about an individual, and fix the source record if it is wrong | Accuracy | Review notes |
| 8. Plan for requests | Know how you would respond if someone asked to see or correct data that was used | Access and Correction | A named owner and a simple process |
| 9. Name an owner | Give one person responsibility for AI use of personal data, and write down your policy | Accountability | A written policy and your Data Protection Officer’s contact details |
| 10. Plan for incidents | If data goes into the wrong tool, know when and how to assess and report it | Data Breach Notification | Written incident steps |
What should you tell customers?
Say in plain words what data you collect, why you collect it and that you may analyse it with software tools, including AI tools. Put the wording where people give their details, such as the registration form. For example: “We use the details you give us to follow up on your enquiry and to improve our courses. We may analyse this information with software tools, including AI tools, and we remove names and contact details before we do.” Only promise what you actually do.
What about decisions and recommendations made with AI?
If you use AI to score leads or choose which offer a person sees, the PDPC’s 2024 guidelines on AI recommendation and decision systems are the place to start. They cover the information to give consumers when seeking consent and good practices for businesses. For journey mapping, keep a person in charge of any decision that affects an individual.
What are the common mistakes?
- Pasting a full CRM export into a public AI tool just to see what comes out.
- Assuming a paid plan keeps your data private without reading the terms.
- Keeping exports and chat histories indefinitely.
- Using messages collected for customer support to build marketing profiles without checking the purpose.
Frequently asked questions
Can I put customer data into ChatGPT or another AI tool in Singapore?
You can use AI tools on customer data if you meet your PDPA obligations. Remove identifiers first, check that your notice or consent covers the use, read the tool’s terms on retention, training and where data is processed, and keep a record. If you are unsure, take legal advice.
Do the PDPC’s July 2026 guidelines require an AI notice for everything?
No. The AI-specific notification is aimed at organisations that rely on consent to use customer data to develop or fine-tune AI models. Using a third-party tool is a different situation, but your ordinary PDPA obligations and the expectation to document your safeguards still apply.
Is anonymised data still personal data?
Data that cannot identify a person is not personal data. Removing names alone may not be enough if other details still point to one person, such as a rare job title at a named employer. Ask whether a person could be recognised from what is left.
Do I need a Data Protection Officer?
Under the PDPA, an organisation must designate at least one person to be responsible for its compliance, and make that person’s business contact information available. That person is usually called the Data Protection Officer.
Where can I find the official guidance?
The PDPC publishes its guidelines on its website. Start with the guidelines on AI recommendation and decision systems and look for the July 2026 generative AI guidelines in the same section.
Learn to map customer journeys with AI
If your team wants to use AI on customer data with more confidence, QD Academy’s 3-day course, Developing an Effective Customer Journey Map using AI and Automation, teaches marketers, sales and service teams to build persona-based journey maps from their own data and to set up AI follow-up workflows. Eligible Singapore learners can use SkillsFuture funding, and our team handles the grant paperwork. See grants and subsidies for eligibility, and check the course page for dates and fees.