Customer data in public AI tools
Staff paste names, contracts and payslips into free AI chat tools because nobody has said what is allowed and what is not.
AI governance and data privacy
Use AI without putting customer data at risk.
We set the rules, controls and records your company needs to use AI under the Data Privacy Act, and build them into the tools your team actually uses.
Where AI and data privacy collide
Nobody knows which AI is in use
AI features arrive inside software you already pay for, and nobody keeps a list of what processes personal data or where it goes.
Policies that stay on paper
An AI policy nobody reads changes nothing. The rules have to show up in access settings, approved tools and everyday workflows.
Decisions nobody can explain
When AI helps decide on a loan, a hire or a claim, you must be able to say how it reached the result and let a person review it.
AI governance built into how you work
We are engineers, not a law firm: we work with your data protection officer and legal counsel and turn their requirements into working controls.
AI policy and approved tools
A short, practical AI policy for your staff: which tools are approved, what data may go into them and who to ask.
AI inventory and risk assessment
A register of every AI system and feature that touches personal data, with a privacy impact assessment for the ones that matter.
Controls in your systems
Access rights, logging, data retention and private AI deployments set up in your systems, so the policy is enforced rather than hoped for.
Support for your AI lead
Whoever is accountable for AI, whether a chief AI officer, your DPO or an IT head, gets engineering help to review new tools and incidents.
How we set up AI governance
Take stock
Which AI tools and features are in use, by whom, and what personal data passes through them.
Assess the risk
Privacy impact assessments for the systems that process personal data, with your DPO, following NPC guidance.
Set the rules
An AI policy, approved tools and clear responsibilities, written for the people who have to follow them.
Build the controls
Access, logging and retention configured in your systems, staff trained, and a routine for reviewing new AI tools.
Examples of what we put in place
A safe internal AI assistant
Before: staff use personal accounts on public AI tools. After: a company assistant with approved models, access rights and logs.
An AI register
Before: nobody can say which systems use AI. After: one list of AI systems, the data each processes and who owns it.
Human review of automated decisions
Before: an AI score decides on its own. After: the score is explained, recorded and reviewed by a person before it takes effect.
Vendor checks for AI features
Before: new AI features are switched on by default. After: each is reviewed for where data goes before it is enabled.
Questions we often hear
Does the Data Privacy Act apply to AI?
Yes. The Data Privacy Act of 2012 (Republic Act No. 10173) applies whenever an AI system processes personal data, and in December 2024 the National Privacy Commission issued Advisory No. 2024-04 on how it applies to AI systems, including transparency, accountability and fairness.
Is there an AI law in the Philippines?
Not yet: several AI bills are pending in Congress, but no AI-specific law is in force. Until one passes, the Data Privacy Act and the National Privacy Commission’s guidance are the main rules for AI that handles personal data.
Do we need to register with the National Privacy Commission?
Under NPC Circular 2022-04, a company must register its data protection officer and data processing systems if it has at least 250 employees, processes sensitive personal information of at least 1,000 individuals, or processes data likely to put people’s rights at risk. Systems that make automated decisions or profile people must always be registered. Your DPO or counsel should confirm what applies to you.
Do we need a chief AI officer?
Not necessarily a new hire, but someone must be accountable for how AI is used. In many companies that is the DPO or the IT head, and we support whoever takes the role.
Is this legal advice?
No. We are an engineering company. We work alongside your data protection officer and legal counsel and implement the technical and organizational measures they decide on.
Put rules around AI before something goes wrong.
Book a discovery call. We will look at how your team uses AI today and what it takes to make it safe under the Data Privacy Act.