The enterprise push toward Generative AI (Gen AI) is driven by unprecedented efficiency gains. According to a field study published by the National Bureau of Economic Research (NBER), Generative AI conversational assistants increased customer support productivity by 14% on average, while accelerating the learning curve for novice representatives by 34%. Across corporate operations, from automating internal digital marketing campaigns to streamlining vendor procurement, Large Language Models (LLMs) offer undeniable performance advantages.
However, rapid adoption without proper governance introduces severe corporate privacy risks and regulatory exposure. In Malaysia, where data compliance is heavily regulated under the Personal Data Protection Act (PDPA) 2010, failure to manage enterprise AI usage creates friction between digital transformation goals and legal accountability. Without structured frameworks, staff utilising public AI platforms risk leaking sensitive corporate data, directly breaching statutory requirements and exposing organisations to strict regulatory liabilities.
The Hidden Danger of Public, Consumer-Grade AI
When employees utilise free consumer-grade AI tools to summarise internal documents or generate code, they engage in Shadow AI, which refers to the unsanctioned use of technology without oversight from IT or Governance, Risk, and Compliance (GRC) teams.
This creates significant data and confidentiality risks. Public LLMs may retain user prompts for purposes such as improving, refining, or training future versions of their models. As a result, employees who input sensitive company information into these platforms may inadvertently expose proprietary data. For instance, an employee may paste proprietary financial projections, unreleased product roadmaps, or confidential salary information into a public AI interface. Without appropriate safeguards, such information could be retained or processed by the platform, creating a risk of unintended disclosure and loss of organisational control over sensitive data.
Legal Implications Under Malaysia’s PDPA
Under the PDPA 2010, organisations are required to comply with seven core data protection principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity, and Access. These principles establish the requirements for how personal data should be collected, used, disclosed, secured, retained, and accessed. The adoption of Gen AI introduces potential compliance risks across several of these principles, particularly Security, Disclosure, and Retention, as illustrated below.
Fig. 1: Potential Gen AI Exposure Risks
Under the Security Principle, organisations must take practical steps to protect personal data from loss, misuse, unauthorised access, modification, or disclosure across the systems and software used to process that data. In a Gen AI context, this includes ensuring that employees do not enter personal or confidential information into unapproved AI platforms and that appropriate access, security, and data-handling controls are implemented across AI-enabled systems.
These requirements highlight the need for clear organisational controls over Gen AI use, ensuring that sensitive data remains secure, is disclosed only for authorised purposes, and is retained in accordance with PDPA requirements.
Case Study: Samsung’s ChatGPT Data Leak
Samsung’s experience provides a useful example of how enterprises can move from restricting Gen AI to adopting it under stronger governance controls. Following a 2023 data security incident in which an employee uploaded work-related source code to ChatGPT, Samsung took a cautious approach to external Gen AI and relied primarily on its own AI models. However, in June 2026, Samsung reversed its position and announced that its Device eXperience (DX) Division would introduce ChatGPT, Gemini, and Claude for employees as part of its broader AI Transformation (AX) strategy. Before the rollout, Samsung piloted the tools with 2,500 employees to assess their effectiveness and sustainability for workplace use.
Importantly, the shift was not simply a removal of restrictions. Samsung is simultaneously establishing dedicated AI organisations, developing security frameworks to balance expanded AI use with risk control, and providing extensive AI training for executives and employees. This illustrates a broader shift from banning Gen AI to governing its use. Rather than treating AI adoption and data protection as opposing objectives, organisations can establish appropriate controls that allow employees to benefit from external AI tools while reducing the risks associated with sensitive data exposure.
Roadmap to Safe Corporate Gen AI Deployment
Mitigating the risks associated with Gen AI adoption requires organisations to move beyond unmonitored consumer applications towards controlled, enterprise-grade deployment. This involves establishing technical safeguards, formal governance policies, and practical training that enables employees to use AI reasonably within their respective roles.
Fig. 2: Overview of Roadmap to Safe Corporate Gen AI Deployment
1. Establish Technical Controls
The first step is to ensure that the AI infrastructure itself provides appropriate safeguards for corporate data. Where organisations use external AI services, they should configure enterprise API settings to opt out of model training and, where available, implement Zero Data Retention (ZDR) arrangements. This reduces the risk of sensitive prompts and business information being retained or subsequently used by the service provider.
For organisations handling highly sensitive intellectual property, a closed-container Retrieval-Augmented Generation (RAG) architecture can provide an additional layer of control. Rather than uploading proprietary documents directly into a public LLM, RAG allows an organisation to connect the model to information stored within a controlled, private environment. Relevant information can then be retrieved from an enterprise-managed knowledge base or vector database when responding to a query, helping organisations maintain greater control over their corporate data.
2. Formalise Corporate AI Governance
Technical safeguards alone cannot prevent employees from using AI inappropriately. Organisations should establish a formal corporate AI policy that clearly defines how, when, and for what purposes Gen AI may be used.
This policy should maintain a roster of approved AI platforms and tools, alongside clear data classification rules. For example, organisations can categorise information as Public, Internal, Confidential, or Restricted, with specific rules governing which categories may be entered into AI systems. Higher-risk applications, particularly those involving personal data or customer-facing outputs, should also require review or approval from relevant Governance, Risk and Compliance (GRC) teams.
These controls create a clear line of accountability and help employees understand that AI adoption is not simply a matter of choosing the most powerful available tool.
3. Implement Department-Specific Training
Even well-designed policies are ineffective if employees do not understand how they apply to their daily responsibilities. AI training should therefore be tailored to different departments, since the risks associated with Gen AI vary depending on the type of data and tasks involved.
For instance, training for the Human Resources team should focus on protecting employee information, anonymising personal data, identifying potential bias in AI-generated content, and avoiding the use of sensitive employee records in unapproved AI tools. For Marketing teams, training should address output verification, protection of customer data, accuracy of AI-generated claims, and copyright and intellectual property considerations when creating marketing assets.
This approach transforms AI governance from a purely technical or legal requirement into a practical workplace discipline. Employees are not only told what they cannot do, but are given the knowledge and tools to understand how to use Gen AI safely and responsibly.
Ultimately, safe corporate Gen AI deployment requires more than restricting access to AI tools. Organisations need to combine technical controls, formal governance, and role-specific training to create an environment where AI can deliver productivity gains without undermining data protection, ethical standards, or legal accountability.
Connecting Governance with Practical Education
Organisations do not need to choose between digital innovation and compliance. Effective AI governance is built on hands-on, practical education.
Straits Interactive provides specialised, two-day HRD Corp Claimable training programmes in Malaysia designed to help teams adopt AI securely.
- Application of Generative AI in Digital Marketing: Focuses on secure prompt design, compliant campaign planning, and protecting brand IP while leveraging conversational AI models.
- Applications of Generative AI – Business Productivity and HR: Tailored for HR professionals and operational leaders to streamline talent management and daily workflows without exposing corporate data.
These training modules utilise the Capabara Classroom Toolkit, which is a secure environment that simulates real-world enterprise applications. Capabara acts as a protected workspace, allowing participants to master advanced prompting, automated workflow design, and application building without transmitting data to public networks.
By pairing theoretical AI governance with sandboxed execution, employees can learn to identify privacy risks and enforce safety guardrails before deploying solutions in live environments.
Empower your teams with Generative AI without exposing your business to data leaks. Explore Straits Interactive’s Generative AI Courses today to book a secure, in-house corporate Gen AI workshop, or test our secure Capabara platform.
