Practical steps
Tell users they are chatting with an AI and link to your privacy notice. Collect only the details you need to help them. Choose an AI provider whose business terms say your data is not used to train their models, and check where data is processed and stored. Restrict staff access to chat logs, and delete logs you no longer need.
If the chatbot handles NRIC numbers, health information or financial details, apply stricter controls and consider whether the AI needs to see that data at all.
Where to check the rules
The Personal Data Protection Commission (PDPC) publishes the obligations and advisory guidelines, including guidance on the use of personal data in AI systems. This page is general information, not legal advice; take advice for anything specific to your business.