You upload your P5 kid’s homework photo. She talks to the tutor for 40 minutes. That’s her handwriting, her voice, her wrong answers, her name — all sitting on someone’s server. Where does it go? Who reads it? Does it train the next model?
Most parents never ask. Yet nearly nine in ten Singapore parents worry about online harm, and only 37% feel confident guiding their child’s digital habits (KiasuParents forums are full of exactly this anxiety). The good news: Singapore’s Personal Data Protection Act (PDPA) already gives you real, enforceable rights. Here are the five that matter.
Right 1: Consent — They Must Ask First
Under the PDPA, an AI tutor can’t collect, use, or disclose your child’s personal data without consent. For a minor, that consent is yours to give — not a buried checkbox during a rushed signup. Before you subscribe, the platform must tell you what it collects (transcripts? voice? photos?) and why. If a tool harvests more than it needs to teach — location, contacts, browsing — that’s a red flag. Purpose limitation is the law, not a courtesy.
Right 2: Access — You Can See Everything on File
You have the legal right to ask what personal data a company holds on your child and how it’s been used. A trustworthy AI tutor makes this easy: conversation logs and progress viewable by the parent, on demand, without an email fight. This doubles as a parenting tool — you see what your kid actually asked, where she got stuck, whether the tutor gave answers or taught. If a platform can’t show you the transcripts, ask why not.
Right 3: Correction — Fix What’s Wrong
AI gets facts wrong. It hallucinates, sometimes on PSLE-style questions where a single bad answer costs trust. The PDPA lets you request correction of inaccurate personal data. That covers a mis-recorded name or level, but the principle runs deeper: you should never be locked out of fixing your child’s record. Pair this with a tutor that teaches Socratically rather than spraying answers, and errors become teaching moments instead of quiet mistakes your kid memorises.
Right 4: Withdrawal — Pull Consent and Delete
You can withdraw consent at any time, and the platform must stop using the data and, on request, delete it. This is where predatory contracts collide with the law. A one-year lock-in with a 30-day refund window and auto-renewal doesn’t override your PDPA right to withdraw. If a sales rep tells you data “stays in the system” after you cancel, that’s your cue to get it in writing. Flexible, cancel-anytime tools respect this instinctively; lock-in tools fight it.
Right 5: Protection — No Training on Your Kid
Companies must make reasonable security arrangements to protect personal data. For an AI tutor, “reasonable” in 2026 means a clear answer to one question: do you train your models on my child’s conversations? The safest platforms say no — child input is used to teach that child, then protected, not fed into a training set or shared. Ask about encryption, breach notification, and data location too. A tool that treats your kid as free training data is failing the spirit of the PDPA, even where it scrapes past the letter.
How to Use These Rights Before You Pay
Don’t wait for a breach. Before subscribing to any tutor — a S$49/month chatbot or a S$154/month premium plan — read the privacy policy for four things: what’s collected, whether it trains on the data, whether you can view logs, and how to delete everything on withdrawal. Government tools like MOE’s SLS run under a reviewed ethics framework; hold private tools to the same bar. Your child’s data is theirs for life. Spend ten minutes protecting it.