Key Takeaways
Keep NRIC numbers, financial details, health information and anything else that identifies a client out of AI tools. The PDPA covers how you use client data, and the PDPC’s NRIC guidelines say organisations should generally not collect, use or disclose NRIC numbers unless the law requires it or identity must be verified to a high degree of fidelity.
- Always minimise the collection, use, and disclosure of personal data, as advised by the Personal Data Protection Commission (PDPC).
- The PDPC’s Advisory Guidelines on NRIC and other national identification numbers limit when organisations should collect, use or disclose them.
- The Personal Data Protection Act (PDPA) applies to how property agents collect, use and disclose client information.
- Strip or replace identifiers before using AI; the PDPC’s Guide to Basic Anonymisation explains how.
- Under the PDPA you stay responsible for personal data that a service provider processes on your behalf.
In Detail
Property agents handle a lot of personal data: names, NRIC numbers, phone numbers, addresses, income and loan details. The Personal Data Protection Act (PDPA) governs how that data is collected, used and disclosed, and under the PDPA an organisation stays responsible for personal data that a service provider processes on its behalf. An AI tool you paste client details into is one such service.
According to the Personal Data Protection Commission (PDPC), organisations should identify and minimise the collection, use, and disclosure of personal data. This principle is crucial when integrating AI into your workflow. Before inputting any client details into an AI tool, consider if the data is truly necessary for the AI to perform its intended function.
Sensitive Data and Anonymisation
NRIC numbers deserve the most care. The PDPC’s Advisory Guidelines on the PDPA for NRIC and other national identification numbers say organisations should generally not collect, use or disclose them unless the law requires it or it is necessary to verify a person’s identity to a high degree of fidelity. Drafting a listing, a reminder or a reply never needs one, so an NRIC number has no place in an AI prompt.
For everything else, strip or replace identifiers before you prompt. The PDPC’s Guide to Basic Anonymisation sets out simple techniques. Anonymisation removes identifying information, while pseudonymisation replaces it with artificial identifiers, making it difficult to link data back to an individual without additional information. This practice helps protect client privacy while still allowing AI tools to assist with tasks that do not require direct personal identifiers.
Consent and Accountability
Beyond data minimisation and anonymisation, consent is a cornerstone of the PDPA. The PDPC states that individuals must give consent for the collection, use, or disclosure of their personal data, unless an exception applies. When using AI tools, ensure that your data handling practices align with the consent obtained from your clients. If an AI tool requires personal data that was not covered by initial consent, new consent may be needed.
Ultimately, you are accountable for the security of client data, even when a tool or platform does part of the work. It is essential to understand the security arrangements of any AI tool or service provider you use. The PDPC provides guidance on what constitutes ‘reasonable security arrangements’ for protecting personal data, which agents should review to ensure compliance. Remember that rules and guidelines can change, so always confirm the latest information on the official PDPC and CEA websites.
Putting This Into Practice
This belongs to the DELEGATE step: Guardrails, ensuring you set clear boundaries for AI use. Here is a template for anonymising client details before using an AI tool for a property listing description:
Create a compelling property listing description for a 3-bedroom HDB flat in [Estate Name], near [MRT Station]. The property has [Number] bathrooms and a floor area of [Square Metres] square metres. Key features include [Feature 1], [Feature 2], and [Feature 3]. The asking price is [Price Range, e.g., ‘in the mid-range for the area’]. The seller is looking for a quick sale. Do not include any personal names, NRIC numbers, contact details, or specific unit numbers.
Always review and approve any AI-generated content before it is sent to a client or published publicly.
Key Questions Answered
What is considered sensitive personal data for a property agent?
Sensitive personal data includes NRIC numbers, passport numbers, financial details, health information, and any other data that could uniquely identify an individual and potentially lead to harm if compromised. The Personal Data Protection Commission (PDPC) specifically highlights NRIC numbers as requiring higher protection.
Can I use AI to draft property descriptions with client names?
No, you should avoid including client names or any direct personal identifiers in AI-generated property descriptions. The PDPC advises minimising the collection, use, and disclosure of personal data. Instead, use anonymised details like “the seller” or “the current owner” to protect client privacy.
What are the risks of putting client NRIC numbers into an AI tool?
Putting client NRIC numbers into an AI tool carries significant risks, including potential data breaches, identity theft, and non-compliance with the PDPA. The PDPC classifies NRIC numbers as sensitive data requiring higher protection, and their unauthorised disclosure can lead to severe consequences for both the client and the property agent.
How can I use AI tools safely while complying with PDPA?
To use AI tools safely and comply with the PDPA, focus on anonymising or pseudonymising data, making sure your use is covered by the consent you obtained, and ensuring the AI tool’s security arrangements are robust. Only input data that is strictly necessary for the AI’s function, and always review and verify AI outputs before use. The Cyber Security Agency of Singapore (CSA) recommends these techniques.
Who is responsible if client data is compromised through an AI tool I use?
As a property agent, you remain responsible for the security of your client’s data, even when using third-party AI tools or services. Under the PDPA, personal data processed on your behalf is still your responsibility, so check how any AI provider stores and uses what you send it.
Sources
- Personal Data Protection Commission, Technical Guide to Advisory Guidelines on NRIC Numbers
- Personal Data Protection Commission, Advisory Guidelines on Key Concepts in the PDPA (17 May 2022)
- Personal Data Protection Commission, Guide to Basic Anonymisation (updated 24 July 2024)
- Personal Data Protection Commission, Safeguard your organisation with accountable data protection practices
- Council for Estate Agencies, Practice guidelines and circulars