When businesses add AI to their email, phone lines and marketing, they also add new ways to process personal data: transcripts of calls, logs of email replies, customer details sent to an AI provider. If you serve customers in Singapore, Malaysia and Australia, three different privacy laws can apply. This article compares the practical points that matter for automation. It is not legal advice; laws change, and you should confirm the details for your situation with a qualified adviser.
The three laws at a glance
- Singapore: the Personal Data Protection Act 2012 (PDPA), administered by the Personal Data Protection Commission (PDPC). It covers consent, purpose, notification, access and correction, protection, retention, transfers outside Singapore and data breach notification. It also contains the Do Not Call provisions for marketing messages to Singapore numbers.
- Malaysia: the Personal Data Protection Act 2010 (PDPA), administered by the Personal Data Protection Department. It applies to personal data processed in commercial transactions and is built around seven principles. Amendments passed in 2024 introduced, among other things, mandatory data breach notification, a requirement for many organisations to appoint a data protection officer, a data portability right and direct obligations on data processors.
- Australia: the Privacy Act 1988, with the Australian Privacy Principles (APPs), administered by the Office of the Australian Information Commissioner (OAIC). It includes the Notifiable Data Breaches scheme. Many small businesses with an annual turnover of A$3 million or less are currently exempt, but there are important exceptions, for example health service providers and businesses that trade in personal information. Reforms are under way, so check the current position.
Australia also has the Spam Act 2003 for commercial electronic messages and the Do Not Call Register for telemarketing calls. Singapore has its Spam Control Act alongside the PDPA.
Common ground: what all three expect
Despite the differences, the practical expectations overlap a lot. If you build automation that meets these, you are in a good position in all three markets:
- Collect only what you need. An AI phone agent does not need a caller's IC or passport number to book a callback.
- Tell people what you do. Your privacy notice should explain that messages and calls may be processed with automated tools and by service providers.
- Use data for the purpose it was given. An enquiry email is not consent to a marketing newsletter.
- Protect it. Limit access to AI logs and recordings, use strong authentication, and choose reputable providers.
- Do not keep it forever. Set retention periods for email logs, call recordings and transcripts.
- Let people access and correct their data. Know where it is stored so you can respond.
- Handle breaches. Have a simple plan for what to do and whom to notify if data leaks.
Where the differences bite
Consent and marketing
All three restrict unsolicited marketing, but the mechanisms differ. Singapore's Do Not Call registry applies to marketing calls and messages to Singapore numbers. Australia's Spam Act requires consent, sender identification and a working unsubscribe for commercial electronic messages. Malaysia's PDPA gives individuals the right to stop processing for direct marketing. Practical rule: keep automated replies transactional, and run marketing only to people who have clearly opted in.
Small business exemption
Australia's small business exemption has no direct equivalent in Singapore or Malaysia. A small Singapore or Malaysian firm is generally covered by its PDPA. An Australian small business may be exempt, but many choose to follow the APPs anyway because customers and larger partners expect it, and because the exemption may narrow in future.
Transfers abroad
Your AI and email providers probably process data in other countries. Singapore requires that transferred data is protected to a comparable standard, usually covered by contracts. Malaysia's rules on cross-border transfers were updated by the 2024 amendments. Under the APPs, an Australian business disclosing personal information overseas generally remains accountable for how it is handled. In practice: read your providers' data processing terms, note where data is stored, and switch off use of your data for model training where possible.
Breach notification
All three now have mandatory breach notification in some form, with different thresholds and timelines. Write down, before anything happens, who decides whether a breach is notifiable and who contacts the regulator and affected people.
Applying this to specific automations
AI email replies
Use the enquiry data to answer the enquiry. Keep logs for a defined period. Exclude sensitive categories (health, finances, identity numbers) from what the AI stores where possible. Have a human approve replies that involve sensitive personal matters.
AI phone agents
Tell callers up front that the call is handled by an automated assistant and may be recorded. Store recordings securely, limit access and delete them on schedule. For Australian callers, be aware that call recording consent rules differ between states.
Marketplace and CRM automation
Customer details from marketplaces should be used to fulfil orders and handle support. Moving them into a marketing CRM needs a lawful basis and, for promotional messages, consent.
A one-page checklist
- Map which tools receive personal data: email, phone, AI provider, CRM, calendar.
- Note where each stores data and whether it trains on it.
- Update your privacy notice to mention automated processing.
- Set retention periods and automate deletion.
- Restrict access to logs and recordings.
- Separate transactional messages from marketing.
- Write a breach response plan of half a page.
- Review once a year, or when you add a new tool.
Privacy done well is mostly good housekeeping, and it builds trust with customers in every market. For how I set up automation, see AI automation, and for country context see Singapore, Malaysia and Australia. Related reading: AI email automation for Singapore SMEs and AI automation for Australian small businesses.