When staff paste company data into an AI tool, where it goes depends almost entirely on which plan they are signed into. On consumer ChatGPT, OpenAI says it may use your content to train its models unless the user switches that off; on ChatGPT Business, Enterprise, Edu and the API, OpenAI says it does not train on your data by default; and Microsoft says Microsoft 365 Copilot prompts and responses are not used to train its foundation models, although they may be processed outside Singapore. Whichever tool it is, PDPA responsibility for personal data stays with your organisation.
Our view: the danger is not AI, it is AI that nobody chose. Below we compare plans, retention, residency and PDPA duties, and when local AI hardware such as the ASUS Ascent GX10 or NVIDIA DGX Spark makes sense next to licensed Microsoft 365 Copilot.
Consumer vs business AI plans: what happens to your data?
| Question | Consumer ChatGPT (Free, Plus, Pro) | ChatGPT Business / Enterprise / API | Microsoft 365 Copilot (work account) | Local AI on your own hardware |
|---|---|---|---|---|
| Used to train models by default? | May be, unless "Improve the model for everyone" is turned off | No, unless you opt in | No, per Microsoft | No third party involved |
| Who controls retention? | The individual user | Workspace admins (Business, Enterprise); API up to 30 days, zero retention on eligible endpoints | Your admins, via Microsoft Purview retention policies | You |
| Where is it processed? | Not set by your organisation | Asia data residency, including Singapore, for new Enterprise, Edu and API projects that select it | Outside the EU, queries "may" be processed in the US, EU or other regions | Your office or server room |
The difference between consumer and business plans is not model quality; it is who holds the controls.
Does ChatGPT train on company data?
For consumer accounts, OpenAI's help centre states that "we may use your content to train our models", and that users can opt out under Settings > Data controls or through its Privacy Portal. OpenAI notes that thumbs-up or thumbs-down feedback can still send that conversation for training, even after opting out.
For business offerings the default flips. OpenAI's enterprise privacy page says: "We do not train our models on your data by default", covering ChatGPT Business, Enterprise, Edu and the API, and lists AES-256 encryption at rest and SOC 2 Type 2 audits.
The catch: on a personal account the opt-out belongs to the employee, not to you, and you cannot see what was shared.
What does Microsoft 365 Copilot do with prompts?
Microsoft's Copilot privacy documentation states: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot." Copilot only surfaces organisational data that the individual user already has at least view permission for. If your SharePoint permissions are loose, Copilot will find what people could reach but never stumbled on, so tidy permissions first.
Microsoft stores prompts and responses as interaction history, which admins can search and govern with Microsoft Purview retention policies. Web search queries sent to Bing are stripped of user and tenant identifiers, but Bing runs under the Microsoft Services Agreement rather than the enterprise data protection terms.
On the store, the Microsoft 365 Copilot Annual Subscription is S$460.00 per user for 12 months, an add-on that needs a qualifying base licence. Smaller organisations can look at the Microsoft 365 Business Premium and Copilot Business bundle at S$490.00, or start with Microsoft 365 Business Premium at S$335.00, which our Business Premium listings describe as adding Intune, Entra ID P1 and Data Loss Prevention for controlling where files go.
Where is AI data stored and processed?
Training is half the question; geography is the other half. OpenAI announced data residency in Asia on 7 May 2025, covering Japan, India, Singapore and South Korea for ChatGPT Enterprise, ChatGPT Edu and the API Platform; for ChatGPT it applies to new workspaces set up with residency.
Microsoft's position for Copilot is less local. Its documentation says customers outside the EU "may have their queries processed in the US, EU, or other regions". Singapore is not on Microsoft's Advanced Data Residency list, which does include Malaysia and Indonesia. That does not rule Copilot out, but it should be a documented decision, not an assumption.
What does the PDPA require when staff use AI?
The PDPA does not ban AI tools, but its obligations still apply when personal data goes into one. Four matter most:
- Protection Obligation: make reasonable security arrangements to protect personal data from unauthorised access, use or disclosure.
- Retention Limitation Obligation: stop retaining personal data, or dispose of it properly, once it is no longer needed.
- Transfer Limitation Obligation: transfer personal data overseas only in line with prescribed requirements, so protection stays comparable to the PDPA standard.
- Accountability Obligation: appoint a data protection officer and have policies you can show.
The Data Breach Notification Obligation also applies: if a breach is likely to result in significant harm, you must notify the PDPC and affected individuals as soon as practicable. Since 1 October 2022 the maximum financial penalty is 10% of annual turnover in Singapore for organisations with local turnover above S$10 million, or S$1 million, whichever is higher.
The PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, issued on 1 March 2024, add guidance on consent and notification, and note that service providers building bespoke AI systems may be data intermediaries under the PDPA.
Should you just ban public AI tools?
A ban is simple and closes the personal-account loophole. But bans tend to push use onto phones and home laptops, where you have even less visibility. Allowing AI has a strong case too: staff draft and summarise faster, and a sanctioned business plan gives you admin controls, retention settings and contractual terms that a ban never will.
Shadow AI is a procurement failure before it is a security failure. Give people a sanctioned tool and most of the risk goes with it.
Our verdict: buy business plans for the people who use AI, block or discourage personal accounts for work, and keep a short list of data that never goes into any cloud AI tool. For the wider risks, see Your AI Assistant Might Be Your Biggest Security Risk and Are Businesses Becoming Too Dependent on ChatGPT?
When does local AI make sense for confidential data?
For material you do not want leaving the building, such as HR files, client contracts or unreleased financials, running an open model on your own hardware removes the third party. The ASUS Ascent GX10 (128GB / 1TB) is S$7,200.00 and the NVIDIA DGX Spark (128GB / 4TB) is S$8,800.00, both NVIDIA GB10 systems with 128GB memory. You still own security, patching and access control, as our posts on when running AI locally beats the cloud and the hidden costs of owning an AI workstation explain. Before you pilot either, read Why AI Projects Look Amazing in Demos but Fail in Real Offices, and if you are tempted to hand agents spending power, Would You Trust an AI Agent With Your Company's Credit Card?
AI data checklist for Singapore companies
- List every AI tool in use, including personal accounts.
- Move work use onto business plans where training is off by default and admins control retention.
- Write down where each tool processes data, and whether that meets your Transfer Limitation position.
- Fix file permissions before enabling Copilot or any tool that reads your documents.
- Set retention periods in the admin console that match your PDPA retention policy.
- Name the data classes that stay off cloud AI, and offer a local alternative for them.
Buying Microsoft 365 Copilot and local AI hardware in Singapore
Prices above are as listed on 23 Oct 2026, and all five items showed stock at the time of writing. SourceIT supplies Microsoft subscriptions with local support and a GST invoice, and NVIDIA and ASUS AI systems with local warranty; confirm the term for your SKU when requesting a quote. Browse Microsoft 365 for Business or the ASUS Ascent GX10 collection. To check which Copilot licence fits, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Does ChatGPT use my company data to train its models? On consumer accounts OpenAI may use content for training unless the user turns off "Improve the model for everyone". On ChatGPT Business, Enterprise, Edu and the API, OpenAI says it does not train on your data by default.
Is Microsoft 365 Copilot trained on our emails and files? Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs. Copilot only shows users data they already have permission to view.
Can AI data be kept in Singapore? OpenAI offers data residency in Singapore for new ChatGPT Enterprise and Edu workspaces and API projects that select it. Microsoft says Copilot queries from outside the EU may be processed in the US, EU or other regions, and Singapore is not on its Advanced Data Residency list.
Does the PDPA apply to AI tools? Yes. The Protection, Retention Limitation, Transfer Limitation and Accountability obligations still apply when personal data goes into an AI tool, and the PDPC has issued advisory guidelines on personal data in AI systems.
What is the maximum PDPA penalty? Since 1 October 2022, up to 10% of annual Singapore turnover for organisations with local turnover above S$10 million, or S$1 million, whichever is higher.
