If your software supplier asks to use customer data to train its own AI system, treat that request as a separate contractual decision. Permission to process records to deliver your service is not the same commercial bargain as permission to develop a reusable product. Identify the data, proposed use and parties before accepting a broad online update.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
What exactly would the new clause permit?
Ask whether the supplier means training a general model, improving a customer-specific feature, testing accuracy or retaining support conversations. Request a written explanation that connects each activity to particular data fields. “Service improvement” alone may leave the scope unclear.
Separate confidentiality from data-protection obligations
A confidentiality promise does not by itself settle whether a proposed use of personal data complies with the PDPA. The PDPC’s guidance on AI recommendation and decision systems addresses the use of personal data in that setting. Have your adviser identify the applicable legal basis and any additional guidance relevant to the actual product. Do not assume every AI use requires, or qualifies for, the same exception.
Example: support tickets become a training dataset
A retailer authorises a supplier to resolve customer enquiries. The supplier later proposes keeping ticket histories to train a tool for other customers. The retailer should assess the new purpose, personal information in the tickets and what customers were told. Removing names alone should not be treated as proof that the remaining dataset is anonymous.
Points to settle in the written agreement
- The specific permitted activities and prohibited secondary uses.
- Whether approval is required before changing the purpose or model provider.
- Access controls, onward transfers and subprocessors.
- Retention periods and what deletion covers, including copies.
- How the supplier will evidence compliance and handle an incident.
- Exit arrangements if the business refuses the new permission.
Ask technical staff to explain whether training effects can realistically be reversed. A promise to delete source files may not answer what happens to an already-trained model. Record limitations honestly rather than accepting an absolute assurance that nobody has tested.
Negotiate before uploading the next batch
Preserve the old terms, proposed amendment, supplier explanation and affected data inventory. Pause the proposed additional use while the responsible team reviews it; do not disrupt existing lawful processing without a transition plan.
Does a supplier’s standard clause remove our own obligations?
No. Your organisation must assess its own responsibilities as well as the supplier’s promises.
Is a generic NDA enough?
It can address secrecy, but the parties still need clear processing purposes, safeguards and exit terms.
Related guidance
sharing customer data under an NDA; company data-protection obligations; outsourcing access and exit terms.
Discuss your next step
RCS can coordinate review of supplier data-use terms through advisers from associated law firms. Email [email protected] or WhatsApp +65 8501 7133. Legal advice, where needed, is provided by advisers from associated law firms.