Your finance team’s ChatGPT habit is a cross-border data transfer

The finance team of a top-performing company in the region has been pasting customer records, financial statements, and internal strategy documents into consumer AI tools on a daily basis. When confronted with the legal implications, the room went silent, as these are not minor mistakes but widespread issues that almost every company faces due to a lack of awareness.

When data enters a cloud AI service, it leaves the jurisdiction, which is a cross-border transfer of personal data under Singapore's Personal Data Protection Act (PDPA). The PDPA even requires consent, notification, and transfer obligations, even for financial institutions. The Monetary Authority of Singapore (MAS) has issued guidelines on the use of personal data in AI systems, emphasizing the need for due diligence on service providers and audit rights.

The US's CLOUD Act also applies, as US authorities can compel AI providers to produce data, regardless of the data's physical location. The status quo reveals that finance teams are unknowingly disclosing business and personal data to third-party organizations in foreign jurisdictions. The solution is to run AI models locally, on-premises or on sovereign infrastructure, which offers better compliance, speed, and cost-efficiency.

Board members should ask critical questions about the AI tools in use, the data processing locations, legal approvals, potential MAS responses, and the feasibility of running AI workflows locally.