A sharp warning has been dropped into the global tech conversation, and Singapore small and medium enterprises must pay attention. A post linked to China Central Television flagged revisions to Anthropic’s privacy policy that—if taken at face value—expand how user data can be moved and shared, including with US intelligence agencies under broad conditions. That is not hypothetical. It is a practical problem for every company that uses hosted models, cloud services, or third-party data processing across borders.
What happened and why it matters
Anthropic reportedly altered its privacy policy 13 times since 2023. Changes include provisions to transfer user data from jurisdictions such as Canada, Brazil, South Korea and the European Union to the United States, and an increase in the number of data sources the company may use for model training. A notable shift: model-training terms that default to using customer data unless opted out. Additionally, the firm was cited as sharing technical indicators with intelligence agencies and advertising threat-intelligence roles favoring Mandarin- or Russian-speaking candidates with government or military backgrounds and high-level clearances.
Those details intersect with politics—US-China trade talks and an anticipated meeting between President Xi Jinping and President Donald Trump—and with legal risk: cross-border transfers, default opt-in training clauses, and opaque sharing arrangements. For Singapore SMEs, the immediate takeaway is straightforward: trust should be conditional, contracts must be surgical, and assumptions about where data goes cannot be naively optimistic.
Real-world consequences for Singapore SMEs
Picture this. A fintech startup in Bugis adopted an external language model to summarise customer support chats. The vendor’s terms allowed data to be used for training unless explicitly declined. Months later, the startup discovered that transcripts might have been ingested into model training pipelines that routed data through U.S. infrastructure—and possibly exposed metadata to parties beyond the company’s control. Panic set in. Reputation risk rose. Regulatory exposure loomed under PDPA obligations.
That is not an isolated tale. It is an every-day scenario where convenience meets latent risk. Sensitive customer information, IP embedded in prompts, and business logic shared with models—all can leak through permissive policies or default settings. No company is immune, and small firms often lack the legal teams to parse dozens of privacy-policy revisions.
Concrete steps that must be taken now
- Map the data flow. Know where data originates, where it travels, and where it lands. If a model vendor processes or stores data outside Singapore, label it and treat it as high-risk until proven otherwise.
- Negotiate contractual controls. Make opt-out defaults a requirement. Insist on written guarantees that customer data will not be used for training or shared with third parties without explicit consent. Insert audit rights and breach-notification timelines.
- Apply strict data minimisation. Only send what is necessary to external models. Strip PII and proprietary context before transmission. When feasible, use anonymisation or tokenisation.
- Prefer regional or private deployments. Where risk is unacceptable, deploy models on-premises or within regional clouds that guarantee data residency. Hybrid approaches can balance capability and control.
- Encrypt and control access. Use end-to-end encryption where possible, enforce multi-factor authentication, and apply the principle of least privilege to API keys and system integrations.
- Run DPIAs and maintain logs. Conduct Data Protection Impact Assessments for model use cases and retain detailed logs to support audits or investigations.
- Train staff hard and often. Employees must understand that using public models to draft contracts, analyse customer data, or rehearse sales scripts can create exposure. Simple rules reduce catastrophic mistakes.
Negotiation language to demand
Contracts must be precise. Demand clauses that specify:
- No use of customer data for model training without explicit, time-limited consent.
- Data residency guarantees and a list of all subprocessors.
- Rapid breach notification (within 72 hours) and forensic cooperation.
- Right to audit and independent third-party assessments on data handling practices.
Blanket phrases such as “may share with affiliates” or “as required by law” are red flags unless they are constrained by clear procedures, notice and contest mechanisms.
When to escalate and when to pause
Pause implementation when a vendor’s policy changes to broaden training use or permit cross-border transfers without safeguards. Escalate to legal and compliance teams when contracts fail to carve out training and intelligence-sharing risks. If vendor answers are unsatisfactory, walk away. There is no virtue in exposure disguised as speed.
Closing, with urgency
Talks between major powers and headlines about intelligence ties can feel distant. They are not. Policies that allow default data ingestion and wide transfers transform commercial tools into geopolitical vectors overnight. Small and medium enterprises in Singapore need not be helpless. With disciplined contracts, tight configuration, and rigorous operational controls, it is possible to reap the benefits of advanced models while keeping sensitive data where it belongs—under the company’s control.
Act now. The cost of inaction is not theoretical: it is reputational damage, regulatory fines, and the erosion of customer trust. There is momentum in the market to demand better transparency and to bind vendors to accountable behaviour. Push for those changes. Demand clarity. Protect the business.