Preschools and tuition centres in Singapore can use AI tools like ChatGPT, but the PDPA still applies to any children's or parents' personal data that goes into them. The safest practice is simple: remove or code names and identifying details before anything is pasted into an AI tool, never upload children's photos, use an account your centre has approved, and have a written rule that staff are trained on. The checklist below maps each PDPA obligation to what it means for AI at your centre.
Based on the PDPC's published data protection obligations and advisory guidelines, checked on 18 October 2026. This is practical guidance, not legal advice.
The PDPA obligations, applied to AI at your centre
| PDPA obligation (PDPC wording) | What it means when staff use AI |
|---|---|
| Accountability | Have a written rule on AI use, train staff on it, and make sure your Data Protection Officer knows which tools are used. |
| Notification | If identifiable data will be processed by an AI service, parents should have been told the purpose. |
| Consent | Only use personal data for purposes parents have consented to. Removing personal data before using AI avoids most of the question. |
| Purpose Limitation | Use data only for what a reasonable parent would expect: writing their child's report, not training a public model. |
| Accuracy | AI can get things wrong. A teacher checks every observation, report and message before it is used or sent. |
| Protection | Use approved accounts, strong passwords and two-factor sign-in; don't leave chat histories with personal data on shared devices. |
| Retention Limitation | Don't leave personal data sitting in AI chat histories; delete or turn off history where the tool allows. |
| Transfer Limitation | Many AI services process data overseas. Personal data sent abroad must get comparable protection, which is a strong reason to keep it out of the tool. |
| Access and Correction | If a parent asks what data you hold and how it was used, you should be able to answer, including AI use. |
| Data Breach Notification | If personal data is exposed through an AI tool, assess whether the breach is notifiable; notifiable breaches must be reported to the PDPC and affected individuals. |
The PDPC also lists a Data Portability Obligation, marked as not yet in force.
The 12-point checklist
- Write a one-page AI rule for your centre: which tools are allowed, for which tasks, and what must never go in.
- Name who owns it. Your Data Protection Officer, or whoever handles data protection, should sign it off.
- Approve specific tools and accounts. Prefer business or education accounts with clear data terms over personal free accounts.
- Code names before pasting. "Child A" or initials, with the key kept in your own records.
- Strip identifying details: NRIC or birth certificate numbers, addresses, phone numbers, medical and family information.
- No photos or videos of children in public AI tools.
- Teacher signs off everything. AI drafts; a person checks facts, tone and accuracy before anything is used or sent.
- Clear chat histories containing any personal data, and switch off history or training settings where the tool allows.
- Secure the devices: no shared logins, screen locks on, two-factor sign-in on AI accounts.
- Check your parent notices if you plan to process identifiable data with any AI service.
- Train every staff member before they use AI with centre work, and again when the rule changes.
- Know your breach steps: who to tell internally, how to assess it, and how to report to the PDPC if it is notifiable.
Three safer setups, from simplest to strongest
| Setup | How it works | Trade-off |
|---|---|---|
| Redact, then use a general AI tool | Staff code names and remove details before pasting | Simple and cheap; relies on staff following the routine |
| Business account with data terms | The centre uses an organisational account whose terms say data is not used for training | Better control; still processed by a third party, often overseas |
| Local processing | An AI model runs on hardware the centre controls | Data does not leave for a third party; needs setup and some hardware |
How Qlabs approaches it
Qlabs's AI training for preschools and tuition centres is designed PDPA-first. We teach the redaction routine before any tool is used, build templates that don't need personal data, and where a centre wants it, set up processing on local hardware. The course is delivered with an SSG-approved training partner, so eligible employers can use the SkillsFuture Enterprise Credit; see our SFEC 2026 explainer. For the prompts themselves, see our free preschool AI prompt pack.
Official sources
- PDPC: Data protection obligations
- PDPC: Advisory guidelines on the PDPA for children's personal data in the digital environment
- PDPC: Advisory guidelines on use of personal data in AI recommendation and decision systems
- PDPC: Data Protection Officers
- PDPC: Report your organisation's data breach
Frequently asked questions
Is it legal for teachers to use ChatGPT at a preschool or tuition centre?
Using AI tools is not prohibited. What the PDPA governs is how your centre collects, uses, discloses and protects personal data. If staff paste children's or parents' personal data into an AI tool, that is a use and possibly a disclosure of personal data, so the PDPA obligations apply. The simplest safeguard is to remove or code personal data before it goes into the tool.
Do we need parents' consent to use AI?
If personal data is removed or coded before it reaches the AI tool, the tool is not receiving personal data. If your centre does want to process identifiable data with an AI service, check that the purpose is covered by what parents were told and agreed to, and update your notices if it is not. Take legal advice for anything unusual.
Does it matter that the AI company stores data overseas?
It can. The PDPA's Transfer Limitation Obligation requires that personal data transferred out of Singapore gets a standard of protection comparable to the PDPA. Avoiding personal data in the tool, using business accounts with clear data terms, or processing locally all reduce this risk.
Can we upload children's photos to an AI tool?
We recommend never uploading children's photos or videos to public AI tools. Images are hard to anonymise and children's data calls for extra care under the PDPC's guidelines.
Who is responsible if a teacher makes a mistake?
The organisation is accountable under the PDPA. That is why the checklist starts with a written rule, training and a named Data Protection Officer, not with individual teachers' judgement.
Is this legal advice?
No. This is a practical checklist based on the PDPC's published obligations and guidelines. For your centre's specific situation, read the PDPC's guidance or take legal advice.
What does PDPA-first mean in Qlabs training?
We teach staff the redaction routine before any AI tool is used, set up templates that do not need personal data, and can set up processing on local hardware so data does not go to a third party.