Article
A PDPA-Minded Checklist for Using AI Tools at Work in Malaysia
Staff are already using AI tools at work, often on personal accounts and without any guidance. That is understandable, because the tools are useful. It is also a risk when customer names, phone numbers, IC numbers or complaint details end up pasted into a service nobody in the company has reviewed.
Malaysia's Personal Data Protection Act 2010 applies to personal data processed in commercial transactions, and it was amended in 2024. This checklist is not legal advice, but it gives SMEs a sensible starting point. For official guidance, refer to the Personal Data Protection Department.
Know What Counts as Personal Data
Personal data is broader than many people think. It includes names, phone numbers, emails, addresses, IC and passport numbers, photos of identifiable people, and records of purchases or complaints linked to a person. Some categories, such as health information, are treated as sensitive and need extra care.
A useful test: if the information could identify a real customer or employee, directly or combined with other details, treat it as personal data. Most of what AI needs for writing and analysis does not require that information at all.
Staff data matters too. Performance reviews, medical certificates and salary details belong to employees, and pasting them into an AI to "help write a warning letter" is exactly the kind of casual use that causes problems.
Checklist Before Anyone Uses an AI Tool
- Decide which AI tools are approved for work and on which plans.
- Read each vendor's data policy: is input used for training, how long is it kept, and where is it processed?
- Prefer business plans with admin controls over personal free accounts.
- Write down what types of data must never be entered.
- Tell staff who to ask when they are unsure.
- Review your privacy notice to see whether it covers this kind of processing and transfer.
None of this needs to be complicated. A one-page rule that people actually read beats a long policy nobody opens.
Make the rule visible. Pin it in the staff WhatsApp group, include it in onboarding, and repeat it when new tools are introduced. Policies that live only in a shared drive tend to be forgotten within weeks.
Minimise and Anonymise
The simplest protection is not sending personal data at all. Before pasting text into an AI tool:
- Replace names with roles, such as "Customer A" or "the supplier"
- Remove phone numbers, emails and IC numbers
- Summarise the situation instead of pasting full chat logs
- Use sample or dummy data when testing spreadsheets and formulas
Tip: if a task truly needs real customer data, that is a sign it should run on an approved business system with proper controls, not a quick chat in a browser tab.
Anonymising takes a few extra seconds, and in most cases the AI's answer is just as useful. A reply template for "a customer whose order arrived damaged" works for every customer, not just the one whose name you removed.
Think About Cross-Border Transfers and Vendors
Most popular AI services process data outside Malaysia. Cross-border transfer of personal data has its own rules under the PDPA, and the 2024 amendments changed how these transfers are handled. If you plan to send personal data to an overseas AI provider in a systematic way, such as a customer service chatbot, get proper advice and document your reasons and safeguards.
Treat the AI provider like any other vendor: know what they do with the data, what security they offer, and how you would respond if something went wrong. Our post on agentic chatbots built on company data discusses what actually gets sent to these APIs.
Prepare for Mistakes
Someone will eventually paste something they should not have. Plan for it calmly. Staff should know to report it quickly rather than hide it. Find out whether the tool lets you delete the conversation, and record what happened and what you did about it.
The 2024 amendments introduced data breach notification obligations, so it is worth understanding when an incident needs to be reported. Clear internal rules, combined with a no-blame reporting culture, make it far more likely you hear about problems early. For the wider policy, see how to write an AI usage policy for a small company.
FAQ
Is using ChatGPT at work illegal under the PDPA?
No. The issue is how personal data is handled. Using AI for tasks without personal data, or with proper safeguards, is a normal business activity.
Do I need a lawyer for this?
For a basic internal rule, often not. For systematic processing of customer data through AI, such as chatbots, professional advice is sensible.
What is the quickest win?
Ban personal data in free AI accounts and give staff an approved business tool. That removes most of the risk immediately.
Using AI responsibly under the PDPA mostly comes down to habits: approved tools, minimal data, clear rules and honest reporting. Start with a one-page rule this week and improve it as your use of AI grows.