What the NPC’s AI guidance means for your customer data

The Data Privacy Act applies to AI

On 19 December 2024, the NPC issued Advisory Guidelines on the application of the Data Privacy Act to artificial intelligence systems that process personal data (National Privacy Commission). The guidance applies across the whole life of an AI system, from design and training to deployment and monitoring.

Among the expectations the guidance sets out:

• Privacy impact assessments for AI systems that process personal data.
• Privacy by design and privacy by default, so protection is built in rather than added later.
• Continuous monitoring of how the system behaves once it is running.
• Governance for the ethical use of AI inside the organisation.
• Mechanisms for human intervention in decisions made by automated systems.

Using someone else’s AI does not move your liability

In July 2026, the NPC reminded organisations that deploying a third-party AI system does not transfer their liability for the personal data it processes (MLex, July 2026). If your business puts customer or employee data into an AI tool, your business remains responsible for how that data is handled, even when the tool belongs to a large international provider.

This has practical consequences. A staff member pasting a client list into a personal AI account, or a chatbot vendor storing conversations without clear terms, is the business’s exposure, not only the vendor’s.

Public data is not free data

On 13 April 2026, the NPC issued Advisory No. 2026-01 on scraping publicly available personal data (National Privacy Commission). The advisory rejects the view that data being public means consent has been given. Scraping, especially automated, large-scale or commercial scraping, is regulated processing. It needs a lawful basis and a specific, legitimate purpose, and it calls for a privacy impact assessment, including when a third party does the scraping on your behalf (Baker McKenzie, May 2026).

For businesses, this affects lead lists built from websites and social media, tools that collect contact details automatically, and any AI system trained or enriched with data gathered from public pages.

Practical steps for a business owner

None of these steps requires a large compliance team. Most can start this month.

• Make an inventory. List every AI tool in use, officially or not, and what data each one touches.
• Set a rule on personal accounts. Decide which tools staff may use with company data, and provide an approved option so people are not tempted to use their own.
• Read the terms. For each vendor, check where data is stored, whether it is used to train models, and how it can be deleted.
• Assess the risky workflows. Run a privacy impact assessment for any AI system that handles customer, patient, employee or financial data.
• Keep a person in the loop. Make sure a human reviews decisions that affect people, such as approvals, refunds or anything clinical or legal.
• Log what the system does. Keep records of inputs, outputs and human overrides, so questions can be answered later.
• Check how lists are built. If you use contact lists gathered from public sources, confirm the lawful basis and purpose before using them.

Governance as a design choice

The simplest way to meet these expectations is to build them into AI systems from the start: data kept in the company’s own accounts, access controlled by role, personal data minimised before it reaches a model, an audit log of what the system did, and a clear route for a person to step in. Added afterwards, the same controls are harder and more expensive.

The same applies when choosing a vendor or a partner to build for you. Ask where the data will live, who can see it, whether it is used to train anyone else’s model, how long it is kept and how it is deleted. If the answers are vague, the risk stays with your business.

Done well, governance is not only a legal safeguard. It is what lets a business use AI with confidence on the data that matters most.