In brief
On 30 September 2026, the Personal Data Protection Commission (PDPC) published an Advisory for Data Protection Risks When Using Unauthorised AI Tools For the Development of Software or Scripts ("Advisory").
The PDPC notes that the growing adoption of publicly available AI tools in day-to-day business tasks has introduced significant benefits but also data protection risks. Namely, the deployment of AI-generated outputs into systems (including automated scripts, workflows and communications) without adequate governance processes over Information and Communication Technology (ICT) assets, human oversight and/or testing, may result in personal data being inadvertently exposed or mishandled.
The Advisory highlights key risks observed by the PDPC in the use of unauthorised AI tools, and recommends administrative and technical safeguards that organisations should implement to fulfil their obligation under section 24 of the Personal Data Protection Act 2012 ("PDPA") to make reasonable security arrangements to protect personal data in their possession or under their control.
In more detail
The Advisory identifies three key areas of concern, together with recommended mitigation measures.
Presence of Shadow AI within the organisation
In the absence of proper policies and controls, employees may independently introduce unauthorised AI tools into the organisation's environment, without the organisation’s knowledge or approval. These “Shadow AI’ tools may process personal data without the organisation's knowledge, resulting in uncontrolled data flows and exposing personal data to unvetted third-party service providers. The PDPC recommends that organisations:
- Maintain visibility and control over AI tools in use, by maintaining a regularly updated inventory of all AI tools deployed across the organisation, alongside inventories of ICT assets. The inventory should capture each system's purpose, data flow information and intended users.
- Establish clear governance policies for AI tool adoption, by (i) performing a dedicated security risk assessment, including whether sensitive data or personal data is actually required; (ii) having clear written policies and documented processes on safeguards for the collection and processing of personal data , including end-user prompts, inputs outputs, and internal enterprise data; and (iii) ensuring that user access to AI tools' development or deployment environments is on a least privilege basis.
No human in the loop – over-reliance on AI without adequate human oversight
Organisations that place excessive trust in AI-generated outputs without human verification risk deploying flawed or misconfigured systems. AI tool outputs, code, scripts and automated workflows, must be reviewed and validated by technically competent personnel before deployment. The PDPC recommends that organisations:
- Ensure technically competent employees have oversight on the use of AI tools, by (i) educating users on the proper AI use, including associated security and data risks, what types of data or documents may be input and associated data flows t; (ii) training employees involved in developing or implementing AI tools in secure coding and good data protection practices for the AI lifecycle; and (iii) conducting periodic ICT security awareness training, including on phishing and social engineering protection.
- Implement technical measures to validate AI tool behaviour before and after deployment, by (i) monitoring and logging inputs and outputs s to prevent AI misuse and to facilitate audit and investigation; and (ii) monitoring and validating input prompts, queries or API requests for attempts to access, modify or exfiltrate confidential information.
Software development failures – inadequate testing before deployment
AI-assisted code generation and automated scripts may contain errors or security vulnerabilities that are not immediately apparent, and deploying such code without rigorous testing at each stage of the development lifecycle can result in data breaches or cybersecurity incidents. Organisations must adhere to proper software development practices, including thorough testing, code review and validation before system deployment. The PDPC recommends that organisations:
- Conduct rigorous testing throughout the software development lifecycle, including (i) early stage code review and unit functional testing and benchmarking before deployment or after any updates; (iii) system acceptance testing, load testing and stress testing at the near-end development stage; and (iv) security testing (such as vulnerability assessment, penetration testing or red teaming) before commissioning for production, promptly after going live, periodically and upon major changes.
- Document configuration settings and security policies and avoid using personal data in non-production environments. Organisations should instead use synthetic data in test environments where appropriate.
Organisations may further refer to the PDPC's Guide to Data Protection Practices for ICT Systems for best practices when adopting AI tools into their ICT environment.
Key takeaways
The Advisory makes clear that the use of AI tools, including those introduced by employees without authorisation, does not diminish an organisation's obligations under the PDPA. Organisations should review their existing governance processes and safeguards against the PDPC's recommended measures, including by:
- Taking stock of the AI tools in use across the organisation (including any Shadow AI)
- Conducting risk assessments of AI tools, and establishing appropriate AI governance policies and processes that cover AI-assisted software and script development
- Ensuring adequate human in the loop oversight and AI-enabled training for employees
- Reviewing software development and testing processes for AI-generated code, scripts and workflows
We would be pleased to assist with conducting AI and data protection risk assessments, reviewing your data and AI governance policies and processes, and addressing any compliance gaps.
For more information on how this may affect your business or AI strategy, please reach out to your usual Baker McKenzie contact.
* * * * *
© 2026 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.