Is Your Chatbot PDPA-Compliant? A Plain-English Checklist for Singapore Businesses

Your chatbot is collecting personal data right now. Every name, phone number, email, order detail, and "my address is..." message your WhatsApp or web bot captures is personal data under Singapore law, and the moment a bot collects it, the full weight of the PDPA applies to you, not your vendor. Most SME owners discover this the hard way: a customer asks "where did you store my number?", or a staff member pastes a chat log into ChatGPT to "draft a reply faster," and suddenly a tool meant to save time is a liability.

Here is why it matters more in 2026 than it did two years ago. The PDPC opened public consultation on draft Advisory Guidelines for the use of personal data in generative AI on 2 June 2026 (open through roughly 1 July 2026, per pdpc.gov.sg), a signal that AI-driven data handling is squarely on the regulator's radar. And the financial downside is real: breach penalties run up to S$1 million, or up to 10% of annual Singapore turnover for organisations turning over more than S$10 million (in force since 1 Oct 2022 under the PDPA; confirm the current figures at pdpc.gov.sg). You don't need a legal department to get the basics right. You need a checklist.

One thing up front, in plain English: this is practical guidance for general understanding, not legal advice. I'm a founder who builds these bots, not a lawyer. Before you rely on any of it, run your specifics past a qualified Data Protection Officer or a Singapore data-protection lawyer. The PDPA's own text lives at pdpc.gov.sg, that's your source of truth, not this post.

This is the governance companion to our WhatsApp automation playbook. That one shows you how to build the bot. This one keeps it out of trouble.

What actually counts as "personal data" in a chat

Before the checklist, settle this. Under the PDPA, personal data is any data about an identifiable individual. In a chatbot conversation that quietly includes a lot more than you'd think:

• Name, phone number, email, obvious.
• Delivery address, unit number, postal code.
• NRIC or partial NRIC (treat as highly sensitive, avoid collecting it at all unless you genuinely need it).
• Order history, booking details, the substance of a complaint.
• The WhatsApp number itself, that's an identifier even before anyone types their name.

If your bot touches any of the above, you are collecting personal data, and the obligations below are yours.

The plain-English self-audit checklist

Singapore's PDPA is built on a set of core Data Protection obligations, Consent, Purpose Limitation, Notification, Access and Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, Accountability, plus Data Breach Notification added in 2021 (per the PDPC's official obligations page, dated 3 April 2023). Here's how each one lands on a working chatbot. Go through them in order.

1. Tell people it's a bot, and tell them what you collect, before you collect it. The Notification obligation requires you to inform individuals of the purpose for collecting their data at or before the point of collection. In practice: an opening message that says "Hi, you're chatting with an automated assistant. We collect your name and contact details to respond to your enquiry." Cheap to add. Easy to forget.

2. Get consent for the actual purpose, and stick to it. Consent and Purpose Limitation work as a pair: you may only collect, use, or disclose personal data for purposes a reasonable person would consider appropriate, and only the purposes the person agreed to. If someone messages your bot to book a haircut, that is not consent to add them to a marketing blast. Want to market to them later? Ask separately.

3. Don't capture more than you need. Purpose Limitation cuts both ways, every extra field is extra liability. If your enquiry flow doesn't need a NRIC or a date of birth, don't ask for it. The data you never collected is the data you can never leak.

4. Lock down where the chat data lives. The Protection obligation requires reasonable security safeguards. For an SME bot that means: access to the chat inbox restricted to staff who need it, strong unique passwords with 2FA on the platform, no shared logins, and a vendor who encrypts data in transit and at rest. If five people share one WhatsApp Business login on their personal phones, you have a Protection problem.

5. Be able to honour access and correction requests. Individuals can ask what personal data you hold about them and ask you to correct it. You don't need a fancy portal, you need a known process and a named owner. If a customer emails "what do you have on me?", someone in your business must know how to answer.

6. Set a retention rule and actually delete. Retention Limitation says: stop keeping personal data once the purpose is served and there's no remaining legal or business need. Chat logs pile up forever by default. Decide a period, say, enquiries deleted after 12 months unless they became a customer, write it down, and enforce it. "We keep everything forever" is not a policy; it's a liability that compounds.

7. Watch the staff-pasting-into-ChatGPT trap. This is the one that bites good teams. A staff member copies a customer's chat, name, number, complaint, into a public LLM to draft a faster reply. There's no single PDPC rule named "don't paste data into ChatGPT," but the act can engage your Protection, Consent, Purpose Limitation and Transfer Limitation obligations all at once: a public tool may log, retain, or train on whatever you paste, and that can amount to an unauthorised disclosure or overseas transfer. The fix is a written internal policy: no customer personal data into public AI tools, full stop. If you want AI drafting, use an enterprise tier with contractual no-training, no-retention terms, or a setup where data stays inside systems you control.

8. Designate a DPO and publish the contact. The Accountability obligation makes a Data Protection Officer mandatory, every organisation must appoint at least one, and the DPO's business contact must be publicly available (under the PDPA's Accountability obligation; confirm the current requirement at pdpc.gov.sg or Singapore Statutes Online). For most SMEs this is an existing staff member wearing one more hat, plus a dpo@yourcompany.com line on your privacy page. It is not optional, and "we're too small" is not an exemption.

9. Know your breach-notification clock before you need it. If your chat data leaks, two thresholds make a breach notifiable to the PDPC (either one triggers it): it's likely to cause significant harm to individuals, or it affects 500 or more individuals regardless of harm. Once you've assessed a breach as notifiable, you must notify the PDPC within 3 calendar days, and the clock starts when your assessment concludes, not when you first discovered it. The PDPC generally expects the whole timeline, discovery to notification, to land within about 30 days, with your steps documented. Where significant harm is likely, you also notify affected individuals as soon as practicable. (All per the PDPC's "Guide on Managing and Notifying Data Breaches under the PDPA," dated 15 March 2021.)

10. Treat the AI-specific rules as moving, not settled. Two live edges to flag honestly. First, the PDPC's finalised Advisory Guidelines on personal data in AI recommendation and decision systems were issued 1 March 2024, but they explicitly do not cover generative AI. Second, the GenAI guidelines are still in draft consultation as of June 2026 (see above). So don't let any vendor wave a "PDPC-compliant AI" guidelines reference at you as if generative AI rules are finalised. They aren't yet. Build to the existing obligations and watch the consultation.

A quick word on the WhatsApp policy noise

You may have seen headlines that Meta moved to bar "general-purpose" AI chatbots from WhatsApp Business, with an intended effective date of 15 January 2026. The practical takeaway for SMEs: a chatbot built for a specific business function, support, bookings, order status, is the permitted kind, not the banned kind. The ban targets open-ended ChatGPT-style assistants. Worth noting, the policy's enforcement has been legally contested in several jurisdictions and its global and Singapore status looks unsettled as of late June 2026, so confirm the current position before making decisions on it. A purpose-built business bot, governed under the PDPA obligations above, sits on solid ground.

What to do this week

You don't need to boil the ocean. In order of effort-to-payoff:

• Today: add the "you're chatting with a bot + here's what we collect" opening message. Send the no-public-LLM rule to your team in writing.
• This week: name your DPO, publish the contact, and write down a retention period.
• This month: tighten inbox access (2FA, no shared logins), and draft a one-page "what we do if data leaks" plan with the 3-day clock written on it.

Most of this is an afternoon of work, not a project. The bot that saves you time should not be the thing that triggers a PDPC financial penalty. Those penalties run up to S$1 million for smaller organisations, and up to 10 percent of annual turnover in Singapore for larger ones, so the cap scales with your size.

If you want a second pair of eyes on how your automation is set up, what it collects, where it stores it, and where the gaps are, that's part of how we build and run automation and how we work with clients. No hard sell; happy to just point at the risks. Get in touch if it's useful.

, Zyle