1. Why Quillmarrow needs this now

About 80 Quillmarrow staff already use Microsoft 365 Copilot, and some use ChatGPT, to draft emails, summarise documents and write product copy. The PDPA programme found no written rule on what may go into these tools. The risk is practical: a helpdesk transcript (PD-06), a CV (PD-15) or a returns spreadsheet like the one in INC-2026-07 pasted into the wrong tool is a disclosure Quillmarrow cannot take back.

This one-page policy sets the minimum rules until the separate AI governance review (the batch A pack) is approved. Where the two differ, the AI governance pack wins once the MD signs it.

Scope: all staff, contractors and Fictional Harbour IT staff working on Quillmarrow systems, on company or personal devices, whenever Quillmarrow information is involved.

Owner: COO. Approver: Managing Director. Questions: the IT Manager for tools, the Head of Operations as appointed DPO for personal data. Status: draft v1.0 for MD approval.

Words used here. AI tool means any service that generates or summarises text, images or code, including features built into other software. Personal data means data about an identifiable person, as listed in the B3 inventory. Approved means listed by the IT Manager under section 2.

2. Which tools, for what

If a tool is not on this list, ask the IT Manager before using it for work.

3. Never put these into any AI tool

• NRIC or FIN numbers, or copies of identity documents (PD-19).
• Payment details of any kind, even partial (PD-03).
• CVs, application forms or interview notes (PD-15).
• Medical certificates or leave reasons (PD-18).
• Whole exports or spreadsheets of customers, B2B contacts or prospects (PD-01, PD-04, PD-10).
• Confidential contract terms, including the DV-01 Malaysia logistics contract.

Taking a name out does not make a record anonymous. An address, order number and product together can still identify a customer. If you need an example, make one up.

4. Check every output before it leaves you

AI output can be confident and wrong. Before you send or publish it, check:

1. Facts and product claims against the approved product sheet. Remove anything you cannot support.
2. Prices and stock against Fictional StockPoint and the approved price list, never the AI's figure.
3. Personal data that should not be there, such as another customer's details in a drafted reply.
4. Promises. Customer Service replies must not promise refunds, deadlines or outcomes that the process does not allow.

5. People decide about people

AI must not decide anything about a customer, applicant, employee or supplier on its own: not a hiring shortlist, a credit application (PD-05), a complaint outcome or a disciplinary matter. A named staff member reviews the facts and makes the decision through the normal process. Under this policy, CVs do not go into AI tools at all, so AI-assisted shortlisting is not allowed until the AI governance pack approves it.

6. If something goes wrong

If you paste personal data into the wrong tool, or send an AI-drafted message to the wrong person, tell the DPO and the IT Manager the same day. Say which tool, what data, roughly how many people and when. Do not delete the evidence or try to fix it quietly.

The DPO then follows B11. The DPO assesses the facts first: whether the incident is likely to cause significant harm, or affects 500 or more people. The MD and DPO then decide, as a separate recorded step, whether to notify. If it is notifiable, the PDPC must be told as soon as practicable and within 3 calendar days of that assessment. Staff never make that call themselves.

Not following this policy. A mistake reported promptly is treated as a learning point. Deliberately ignoring the rules, or hiding a mistake, is handled by the HR Manager under the normal disciplinary process.

7. How this policy supports the PDPA programme

8. Putting it in place: owners, evidence, next actions

These actions are tracked in B2 under G-01 (policy and staff communication) and G-07 (protection). The DPO reports progress to the MD in the quarterly update. The policy is reviewed when the AI governance pack is approved, or within six months, whichever is sooner.

This policy draws on the Model AI Governance Framework, Second Edition (PDPC and IMDA, January 2020) and the PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (March 2024). It is practical support, not legal advice; the DPO confirms legal questions with a Singapore-qualified lawyer.