Corporate training and PDPA in Singapore, what to check before using an AI platform
Before using an AI training platform in Singapore, confirm where your material and learner data are processed, what learners are asked to consent to, whether anything involving cameras is optional and switchable off, how long records are kept and who can delete them, and whether the vendor will sign data processing terms. Involve your data protection officer before the pilot, not after.
- Key takeaways
- Your training material is company data. Ask where it is processed before you ask what the AI can do.
- Learner data collected during a session needs a stated purpose and a retention rule. No default deletion is safer than a surprise one.
- Cameras and anything derived from them are the sensitive part. Make them opt-in per learner and switchable per organisation.
Singapore's Personal Data Protection Act sets obligations on any organisation that collects, uses or discloses personal data, and employee data is not exempt. An AI-led training platform touches three kinds of data at once: your material, your learners' answers, and, in some products, video of your learners. This checklist is written for the learning team and the data protection officer to work through together. It is a practical guide, not legal advice.
1. Your material
Training decks and documents are often the most valuable text in the company. Ask the vendor three questions:
- Where is the material processed when the platform builds a session from it?
- Is any of it sent to a public AI service, and if so, which one and under what terms?
- Is there an option to run the processing on infrastructure you control?
A vendor who can answer in one sentence has thought about it. A vendor who says "it is all encrypted" has answered a different question.
2. Learner data during a session
A live AI-led class records answers to questions, assessment results and completion. That is personal data about employees. Under the PDPA's purpose limitation and notification obligations, learners should be told what is collected and why, in plain language, before the first session. Ask the vendor for the wording they show learners and check it matches what the platform does.
3. Cameras
If the platform uses a learner's camera for anything, treat it as the sensitive part of the deal. Three requirements:
- Opt-in per learner. A learner who keeps the camera off still gets the full class.
- A switch per organisation. Your DPO can turn the feature off for everyone.
- No inference about emotion or mood. Ask the vendor directly whether the system infers emotional state from faces. The answer you want is "never."
4. Retention and deletion
Ask who can set a retention period and what happens by default. A platform that deletes nothing until an administrator sets a period is safer than one with a hidden default, because the deletion decision belongs to your organisation and its own regulator. Ask for a dry-run of any deletion before it runs, and confirm audit records are excluded from routine deletion, since they are what shows compliance later.
5. Contracts and access
- Data processing terms that name the sub-processors.
- Role-based access, so a trainer sees their cohort and a manager sees their reports.
- Export of your data in a standard format if you leave.
Run the checklist in the pilot
Do not wait for a procurement round. Put these questions to the vendor before the pilot starts, and have the DPO sit in the first live session. A platform that welcomes that is the one to keep talking to.
Questions people ask
Does an AI training platform need our DPO's approval?
Involve your data protection officer early. The platform will process employee personal data, and if it uses cameras or records answers, the purposes and retention need to be stated to learners. Early involvement avoids a pilot that has to be paused.
Is it safer to keep training material off public AI services?
For sensitive or proprietary material, yes. Ask the vendor whether session planning runs on infrastructure they control or on a public AI service, and whether a self-hosted option exists.
Should learners be required to turn cameras on?
No. Make camera use a learner's choice, tell them what it is used for, and give the organisation a switch to turn the feature off entirely.