PDPA and AI: what your charity can actually do

Somewhere in Singapore right now, a charity director is sitting on an idea that would give her caseworkers their evenings back — and not acting on it, because someone in a meeting said the three letters that end conversations in this sector: P-D-P-A.

The fear is understandable. Your data isn't sales leads; it's families in crisis, children's circumstances, financial hardship. If anyone should be careful, it's you.

But "careful" and "frozen" are not the same thing. The PDPA is a law about handling data responsibly, not a law against technology. So let's walk through what it actually asks — in plain English, for the people who run programmes, not the people who run servers.

What the PDPA actually asks of you

The Personal Data Protection Act applies to charities and social service agencies just as it does to companies. Strip away the legal language, and its demands are things a good organisation would want to do anyway:

• Have a reason. Collect and use personal data for purposes a reasonable person would consider appropriate — and that you've told people about.
• Get consent (or rely on a legal exception), and let people withdraw it.
• Protect what you hold. Reasonable security for the data in your care.
• Don't keep it forever. When the purpose is over, the data should go.
• Mind where it travels. Data sent overseas must enjoy comparable protection.
• Own it. Someone in your organisation is accountable — your DPO — and your policies should say what you actually do.

Notice what isn't on that list: any prohibition on using software, automation, or AI. The question the PDPA asks of an AI tool is the same one it asks of a filing cabinet: is the data in it handled properly?

The regulator has already answered the AI question

In March 2024, the Personal Data Protection Commission published its Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems.¹ The very existence of this document tells you something: the regulator's position is not "don't", it's "here's how".

In plain English, the guidelines say:

• You can use personal data in AI systems — with consent, or in some cases under exceptions like business improvement and research.¹
• Be transparent. Your written policies should tell people, in understandable terms, when AI plays a part in decisions or recommendations that affect them.
• Be accountable. Know what data goes in, document how the system is used, and keep a human responsible for outcomes.
• Design privacy in — don't bolt it on after launch.

The guidelines aren't legally binding in themselves, but the PDPC has indicated it will take enforcement positions consistent with them² — which makes them the closest thing you have to a map.

Four rules of thumb that keep you safe

Here is how we translate all of that into practice when we build for the social sector:

The part nobody enjoys: when things go wrong

Since the PDPA's data breach rules took effect, the arithmetic is unforgiving and worth knowing cold: a breach is notifiable if it's likely to cause significant harm to anyone affected, or if it touches 500 or more people. Once you've assessed that a breach is notifiable, you have three calendar days to tell the PDPC — and where significant harm is likely, you must tell the affected individuals too.³

For a charity, the harm bar matters more than the headcount bar: a leak affecting even a handful of beneficiaries in sensitive circumstances can clear "significant harm" easily. Which is exactly why rule i — the AI sees the minimum — is your best insurance. Data that never entered a system can never leak from it.

A checklist before you switch anything on

1. Name the workflow. One process, clearly described — "drafting donor acknowledgements", not "using AI".
2. List the data it touches. Then cut the list down. Then cut it again.
3. Get the vendor's answers in writing. Where is data processed? Is it used for training? How long is it retained? Is there a data processing agreement?
4. Decide who approves outputs. A named person, not "the team".
5. Update your privacy notice if AI now plays a part in how you handle personal data.
6. Tell your DPO — and if you don't have one, appointing one isn't optional under the PDPA.

Six steps, one afternoon with the right people in the room. That's the real cost of doing this properly — not a year of paralysis.

Where we fit

We build software for this sector — Socianote for case management and donor work, and AI-assisted workflows designed the way this article describes: minimum data, human approval, privacy decided at the design stage. When we scope a project, the data-protection questions above are part of the scope document, not an afterthought — and if we think a workflow is too sensitive for AI, we'll tell you to keep it out.

Worth reading next: how to fund a digitalisation project through NCSS — because doing this properly is also the kind of well-governed project that funders like to support.