Asia: Privacy

Businesses collect personal information, financial records, employee documents, customer communications and operational data every day. However, retaining information indefinitely can create privacy, security and regulatory risks. Data retention policies help organisations determine what information they should keep, why it is required, how long it should remain accessible and when it must be securely deleted.

With the advent of Artificial Intelligence (“AI”) enabled tools, industries throughout the world are witnessing a stark shift in their operations and increasingly trying to harmonize the operations of their enterprises with AI led efficiencies. Even Global Capability Centres (“GCCs”) in India are making significant investments in AI with EY India GCC Pulse Survey 2025 estimating that 83% of GCCs already operating in India have invested in GenAI, and 58% of GCCs operating in India already investing in Agentic AI.

Singapore's Personal Data Protection Commission has issued new guidelines clarifying how companies must handle personal data when developing and deploying generative AI systems. These guidelines address critical compliance questions around publicly available data, consent requirements, anonymization practices, and ongoing obligations for access and correction requests throughout the AI lifecycle.