ChatGPT, Claude or Gemini? Choosing AI Tools and Staying PDPA-Safe as an SME

“Should we use ChatGPT, Claude or Gemini?” is one of the questions we get asked most. Frankly, for most SME use cases, how well the process is designed matters far more than the differences between models. Still, there is a sensible way to choose.

Four criteria for choosing

1. Task fit: Is your task customer replies, document understanding, writing or data tidying? Test with your own real material (including Chinese and BM) rather than relying on leaderboards.
2. Cost: Subscriptions suit individual staff use; pay-per-use API pricing suits embedding into a process. Estimate your monthly usage before comparing.
3. Data policy: Is your data used for model training? Where is it stored? For how long is it kept? This is the criterion most easily overlooked.
4. Integration: Can it connect through an API to the tools you already use (WhatsApp, Google Workspace, accounting software, n8n/Make and so on)?

Consumer versions vs business plans/API

Staff pasting customer data straight into a free consumer chat tool is the most common data risk. Business plans or API options usually come with clearer data-handling terms (for example, data is not used for training by default), but please refer to each provider’s terms of service. Read the terms before you choose.

What to watch for under the PDPA

Malaysia’s Personal Data Protection Act 2010 (PDPA) applies to organisations that process personal data in commercial transactions. Names, identity card numbers, phone numbers, addresses and photos are all personal data. The 2024 amendments introduced requirements such as data breach notification and appointing a data protection officer, with some provisions taking effect in phases, so please refer to official announcements. When AI is involved, pay particular attention to the following:

• Collecting personal data requires notice and consent, and you must explain the purpose.
• When sending personal data to a service overseas, be aware of the rules on cross-border transfers.
• You need to take reasonable security measures and keep the data only for as long as necessary.

Checklist: an AI usage code for SMEs

1. Write a one-page “AI usage policy” so everyone knows what is and isn’t allowed.
2. Ban entering identity card numbers, bank account numbers, passwords and other sensitive data into consumer tools.
3. Avoid personal data where you can; where you must use it, mask it first (hide names and numbers).
4. Give automated workflows least-privilege accounts, not admin accounts.
5. Keep usage logs so issues can be traced.
6. Check each vendor’s data terms and where data is stored.
7. Review regularly, because both tools and regulations change.

This article is general information only and does not constitute legal advice. For compliance questions, please consult a qualified legal adviser.

Summary

There is no need to obsess over “which one is the strongest”. Define your tasks and data boundaries first, then run small tests to find the combination that suits you. That is usually worth more than arguing over model rankings.