Most companies need a policy on AI recording devices, though usually not a blanket ban. Smart glasses, AI voice recorders and transcription bots now capture meetings with little visible sign, and the PDPA makes the organisation answerable for recordings made for work. A short, device-neutral policy covers it. It should say which tools are approved, when recording is allowed, how people are told, and how long recordings are kept.
This post is the practical template. It turns the issues from our three companion posts into rules you can adapt: recording and consent in meeting rooms, AI smart glasses in meetings and unapproved AI transcription bots. If your organisation already has a BYOD rule, see Should Companies Ban Personal Laptops From Their Office Network? for how device policies fit together. Legal references are from official PDPC and Singapore Statutes Online pages. This is general information, not legal advice; have your data protection officer or lawyer review any policy before adoption.
Why is a policy needed if the PDPA already exists?
Because the Act sets obligations but leaves the day-to-day choices to you. Several points from official sources show where a policy fills the gap:
- The organisation carries the obligations. Section 4(1)(b) of the PDPA says its data protection Parts impose no obligation on an employee acting in the course of employment. The PDPC's Advisory Guidelines (revised May 2024) explain at paragraph 4.8 that the organisation must comply instead.
- The PDPC expects preventive systems. Paragraph 4.6 of the same guidelines says employers are advised to put in place systems and processes to stop employees causing breaches.
- Some recording sits outside the Act. Section 4(1)(a) excludes individuals acting in a personal or domestic capacity. A visitor recording for themselves may not be covered, so confidentiality depends on house rules and contracts.
- Retention needs a decision. Section 25 says to stop keeping personal data once the purpose is served and there is no legal or business need. Someone has to set that period.
What should an AI recording device policy cover?
Keep it to a few pages. The table below is a template structure with suggested starting rules. Adjust each line to your sector, risk appetite and existing policies.
| Section | Suggested rule | Why it matters |
|---|---|---|
| 1. Scope | Any device or software that can capture audio, images, video or transcripts: glasses, pins, phones, laptops, bots, room systems | Device-neutral wording covers new products automatically |
| 2. Approved tools | A named list of approved recording, transcription and AI recap tools; everything else not allowed for work meetings | Keeps data inside systems you control and have assessed |
| 3. When recording is allowed | Only with a stated business purpose, started by an authorised role | Purpose and notice are central PDPA concepts (sections 18 and 20) |
| 4. Notice and consent | Announce before recording; door notices in rooms; written record for sensitive sessions | The PDPC says written or recorded consent is good practice |
| 5. No-record meetings | Named meeting types where no recording of any kind is allowed | Removes judgement calls in high-risk sessions |
| 6. Personal and wearable devices | Recording functions off in meetings unless the chair agrees; set aside in no-record meetings | Covers glasses and pins the platform cannot see |
| 7. Visitors and contractors | Told at sign-in; same rules apply on premises | Their own recordings may fall outside the PDPA |
| 8. Platform settings | Bot detection, lobby or waiting room, recording permissions and expiry set by IT | Technical enforcement of the written rules |
| 9. Storage and retention | Approved locations only; default expiry; no copies to personal accounts | Protection and retention obligations (sections 24 and 25) |
| 10. Incidents | Report unapproved recordings to the DPO; deletion and review steps | Fast containment |
How should the approved-tools list work?
Approve a small number of tools and say so plainly. For most organisations that means the recording and transcription built into Microsoft Teams or Zoom, plus any AI recap licence you have assessed. Third-party notetakers should need a specific approval that checks where data is stored, who can access it and whether data leaves Singapore. Section 26 of the PDPA restricts transfers of personal data outside Singapore except under prescribed requirements.
Pair the list with platform settings so the rule is enforced, not just written. Microsoft documents Teams external bot detection, which holds detected bots in the lobby by default. Zoom documents the Waiting Room, guest identification and an Active Apps Notifier that shows when a tool accesses meeting content. Our bot controls post lists the settings.
What should the rules say about smart glasses and pins?
Write them as behaviour rules, since IT cannot switch these devices off. Suggested wording:
- Recording, photo and AI capture features on personal and wearable devices must be off during work meetings unless the chair has agreed and attendees have been told.
- In no-record meetings, wearable devices capable of capture are set aside, except where the person needs them as prescription eyewear and confirms capture is off.
- Staff should know common recording signals. Meta, for example, says its camera glasses show a blinking white capture light during photos and video.
- Anyone may ask whether a device is recording, and the question should be answered.
Some organisations add a device-parking point outside boardrooms. A lockable charging cabinet such as the Ergotron Zip12 Charging Wall Cabinet (S$1,800.00) offers six-point locking steel doors and 12 bays. Ergotron rates it for tablets and Chromebooks up to 12 inches, so check your devices fit its size limits first.
How should meeting rooms be configured to match the policy?
Rooms should make the policy visible. Put a door notice in every room stating whether AI features are on and that recording happens only when announced. Use hardware that shows its state. The Yealink UVC40 E2 (S$645.00) has an electric lens cap, and the Jabra Speak2 75 UC (S$415.00) has a mute button and a light ring Jabra calls a Microphone Quality Indicator.
Remember that consent in rooms needs a human step. Microsoft says its Teams participant agreement policy auto-consents Teams Rooms devices, so the announcement and door notice do the work for people in the room. Screen privacy also belongs in the policy for open-plan areas. The Kensington 27-inch Monitor Privacy Filter by Lenovo (S$206.00) narrows the viewing angle of a 27-inch 16:9 monitor. Prices as listed on 25 Oct 2026.
A good recording policy fits on a door sign and a two-page document. If it needs a lawyer to read it, staff will not follow it.
How do you roll the policy out?
- Draft using the ten sections above, in plain English.
- Review with your DPO, HR and legal adviser, and align with existing IT, BYOD and confidentiality policies.
- Configure Teams or Zoom to match: bot detection, lobby or waiting room, recording permissions, expiry.
- Label rooms with door notices and brief reception on visitor rules.
- Train organisers in five minutes: announce, check the participant list, know the no-record meetings.
- Review every six to twelve months, or when a new device category appears.
For related housekeeping, see Your Company Has 20 Different IT Subscriptions. Who's Actually Tracking Them?, which helps you find AI tools already in use. SourceIT can quote meeting room hardware, privacy filters and device storage; use Request for Quotation on the product page or email sales@sourceit.com.sg.
Frequently asked questions
Should companies ban AI recording devices completely? Usually not. A device-neutral policy that lists approved tools, names no-record meetings and requires notice is more workable than a ban, especially as many smart glasses are prescription eyewear.
Is the employee or the company responsible for work recordings under the PDPA? Section 4(1)(b) of the PDPA says its data protection obligations do not fall on an employee acting in the course of employment; the PDPC's guidelines say the organisation must comply. This is not legal advice.
Does the PDPC say companies should have systems to prevent breaches by staff? Yes. The PDPC's advisory guidelines say employers are advised to put in place systems and processes to prevent employees from causing breaches.
How long should meeting recordings be kept? Section 25 of the PDPA says to stop keeping personal data once the purpose is served and there is no legal or business need. Set a default expiry in your platform that matches the purpose.
Can IT enforce a ban on AI notetaker bots? Partly. Microsoft documents Teams bot detection that holds bots in the lobby, and Zoom documents waiting rooms and app controls. Neither catches every bot, so organiser training is still needed.
Do visitors have to follow our recording policy? Visitors on your premises can be asked to follow house rules at sign-in. Their personal recordings may fall outside the PDPA, so confidentiality relies on the rules and any agreements you have with them.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
