Short answer: the PDPA does not stop you using AI, but it does not switch off when you open an AI tool either. If personal data goes into a prompt, you are processing personal data, and your existing obligations apply. This article answers ten questions we hear often. It is general information, not legal advice; confirm specifics with your legal or compliance team.
1. Does the PDPA apply when staff use AI tools?
Malaysia's Personal Data Protection Act 2010 covers personal data handled in commercial transactions. Pasting customer, candidate or employee details into an AI tool is a form of handling that data, so the same care you apply elsewhere should apply here. Ask your legal team how the Act's principles apply to each tool you use.
2. Can we paste customer data into an AI assistant?
Not by default. Decide it deliberately: which tool, which plan, which kinds of data, for what purpose. Many tasks do not need personal data at all, and removing names and identifiers before prompting is the simplest safeguard. We cover this in detail in can you put customer data into Claude?
3. What is the safest first step?
Classify your data. A simple scheme such as public, internal, confidential and personal data lets you say clearly what may go into which tool. Without it, every employee makes up their own rule.
4. Do we need a written AI-use policy?
A short, plain one is far better than none. It should name approved tools, set data rules, require human review for important outputs and say who owns the policy. See what a company AI usage policy should include and our wider guide to AI governance and the PDPA.
5. Is a business plan different from a free personal account?
Often, yes: business offerings typically come with admin controls and different data-handling terms from personal accounts. Because terms change, read the current terms of the specific plan and have your legal team review them rather than relying on a general statement. Make it a rule that staff use approved company accounts, not personal ones, for work data.
6. Who is responsible if the AI gets something wrong?
The company and the accountable person who used the output, not the tool. That is why human review matters for anything customer-facing, legal, financial or affecting people. Our article on how to check if AI output is accurate gives a practical review routine.
7. What about using AI in HR and hiring?
Candidate and employee records are personal data, and decisions about people carry extra risk. Use AI to draft and organise, keep a person accountable for every decision, and avoid feeding in more personal detail than the task needs. Check your approach with HR and legal.
8. Do regulated industries need to do more?
Usually, yes. Banks, insurers and other regulated businesses have sector rules and supervisors in addition to the PDPA, and those rules differ by sector. If you work in financial services, read our page on AI training for banking and financial services and speak to your compliance function before rollout.
9. What should we log or record?
At minimum: which tools are approved, who has access, what the data rules are, and how incidents are reported and handled. Keeping this simple and current is more useful than a long document nobody reads. Your legal team can advise on any retention or record-keeping duties.
10. How do we make sure staff actually follow the rules?
Train them. Rules that people do not understand are not followed, and the commonest breach is well-meaning shortcuts. Governance and risk is a core part of the Claude Certified Associate curriculum; see the governance and risk domain, or explore our AI training programs. Agmo Studio is a Select Partner of the Anthropic Claude Partner Network, and Agmo Academy is an HRD Corp registered training provider; claimability is subject to eligibility and HRD Corp approval.
A simple checklist to take away
- Classify your data and write down what each class may do.
- Approve specific tools and plans; ban personal accounts for work data.
- Strip personal identifiers from prompts wherever the task allows.
- Require named human review for anything important.
- Train staff and revisit the policy regularly, because tools and terms change.
- Take the open questions to your legal or compliance team.
Again, this is general information and not legal advice.