Automated Decision-Making and Profiling (ADMP) under the PDPA
Credit scores, fraud flags, CV screening, dynamic pricing, churn prediction and marketing segments all make or shape decisions about people, often with no one looking at the individual case. The Automated Decision-Making and Profiling guideline released by JPDP on 30 April 2026 brings that activity squarely under the PDPA. It defines automated decision-making as decisions made by automated means without human involvement, and profiling as the automated processing of personal data to predict or generate information about a person. It requires privacy notices to tell individuals that their data is subject to ADMP, and explicit consent where sensitive personal data is involved. Under the DPIA guideline, automated decision-making is also a trigger for an impact assessment whatever the volume of data.
This two-day course is for the teams that own those decisions: DPOs, AI and analytics leads, product owners, and the business owners of credit, HR, fraud and customer decisions. It is honest about what the guideline does and does not require. It leans on transparency rather than a hard rule that a human must review every decision, so the course treats human oversight as a design choice you must make deliberately and be able to justify. It connects to AI Governance & Ethics for the wider AI programme and to DPIA for the assessment itself.
HRD Corp SBL-Khas Claimable
Programme Agenda
Day 1, 9:00 AM - 9:15 AM
Welcome and Programme Overview
Introduction to the session, objectives, and housekeeping.
Day 1, 9:15 AM - 10:15 AM
What Counts as ADMP
The guideline's definitions of automated decision-making and profiling, the difference between a decision made by a system and one merely supported by it, and the grey zone of rubber-stamp human review. Examples from banking, insurance, HR, retail, telco and public services.
Day 1, 10:15 AM - 10:30 AM
Break
Day 1, 10:30 AM - 11:30 AM
Building an ADMP Inventory
Finding the automated decisions and profiles already running across the organisation, including those inside vendor platforms and marketing tools. Recording purpose, data inputs, logic, outputs, the people affected and the owner of each.
Day 1, 11:30 AM - 12:30 PM
Lawful Processing, Consent and Sensitive Data
How the PDPA principles apply to ADMP, the explicit consent requirement where sensitive personal data such as health or biometric data is involved, and inferred data that becomes sensitive by prediction.
Day 1, 12:30 PM - 1:30 PM
Lunch
Day 1, 1:30 PM - 3:15 PM
Transparency and Explaining Decisions
Telling individuals that ADMP is used, what a useful explanation of the logic looks like without exposing trade secrets, and handling a customer who asks why they were declined, flagged or priced differently. Drafting notice language that is accurate and readable.
Day 1, 3:15 PM - 3:30 PM
Break
Day 1, 3:30 PM - 4:45 PM
Fairness, Bias and Accuracy
Where bias enters: training data, proxies for race, religion, gender or age, feedback loops and drift. Practical testing for disparate outcomes, accuracy and data quality checks, and what to do when a model performs worse for one group.
Day 1, 4:45 PM - 5:00 PM
Day 1 Close
Recap and what to review before day two.
Day 2, 9:00 AM - 9:15 AM
Day 1 Review
Recap of day one and the questions it left open.
Day 2, 9:15 AM - 10:15 AM
Human Oversight as a Design Decision
Choosing where a human reviews, overrides or audits decisions, what makes review meaningful rather than nominal, escalation and appeal routes, and documenting the reasoning so it can be defended.
Day 2, 10:15 AM - 10:30 AM
Break
Day 2, 10:30 AM - 12:30 PM
Vendors, Third-Party Models and Generative AI
ADMP inside bought-in systems, scoring bureaus and AI services, the questions to ask vendors, contract terms, and the extra risks of large language models used to summarise, rank or recommend people.
Day 2, 12:30 PM - 1:30 PM
Lunch
Day 2, 1:30 PM - 3:15 PM
DPIA, Records and Accountability
Why ADMP triggers a DPIA regardless of volume, what the assessment should focus on, monitoring and re-assessment when models change, and reporting to management and the board.
Day 2, 3:15 PM - 3:30 PM
Break
Day 2, 3:30 PM - 4:45 PM
Workshop: Reviewing an Automated Decision End to End
Teams take a realistic case, such as an automated credit limit decision or an AI-assisted hiring shortlist, and produce the inventory entry, notice wording, fairness test plan, oversight design and DPIA focus areas.
Day 2, 4:45 PM - 5:00 PM
Wrap-Up and Q&A
Key takeaways, next steps, and close.
Key Outcomes
- Identify which of your decisions and data uses count as automated decision-making or profiling
- Maintain an ADMP inventory with owners, inputs, logic and affected individuals
- Apply consent requirements, including explicit consent for sensitive personal data
- Write accurate ADMP notices and explain an automated outcome to an individual
- Test for bias and accuracy, and design human oversight you can justify
- Govern vendor and generative AI models used to make decisions about people
Training Mode Physical / Online / Hybrid / e-learning
HRD Corp SBL-Khas Claimable
Level Intermediate. For DPOs, AI, data science and analytics leads, product owners, and business owners of credit, HR, fraud and customer decisions. Basic PDPA knowledge assumed.
Duration 2 Days (16 Hours) | 9:00 AM to 5:00 PM daily
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment An end-to-end ADMP review of a supplied scenario, presented in the workshop, plus a written knowledge check
Certificate Certificate of Completion issued to all participants upon full attendance