Cybersecurity, Privacy & Compliance
Deepfakes are often discussed as a cybersecurity problem, but they are increasingly becoming a legal, regulatory, and governance concern. As artificial intelligence (AI) makes it easier to create convincing fake voices, images, and videos, organisations must consider not only the risk of fraud, but also potential breaches of privacy, data protection, reputational damage, and regulatory compliance.
For businesses, the question is no longer whether deepfakes exist, but whether existing policies, controls, and employees are prepared to manage the risks associated with them.
THE SHORT VERSION
No Single Law: Singapore currently has no single “Deepfake Act” or standalone deepfake legislation. Instead, deepfake activities may fall under multiple existing laws depending on how the technology is used.
Penalties can be steep. Organisations may face regulatory consequences when personal data, images, voices, or biometric information are collected, used, or disclosed without proper authority or consent.
Detection tools. Enterprise-grade software can flag AI-generated audio, video and images, though none is foolproof.
Best habit either way: verify on a known channel before acting on anything suspicious.
Are Deepfakes illegal in Singapore?
The answer depends on how the deepfake is used. Creating a deepfake is not automatically illegal in Singapore. The technology itself is not prohibited. Similar to artificial intelligence, photo editing software, or video editing tools, deepfake technology can have legitimate uses in education, entertainment, marketing, research, and media production.
However, the moment a deepfake is used to deceive, impersonate, defraud, harass, spread misinformation, or misuse a person’s personal data, it may become unlawful and subject to regulatory action, civil liability, or criminal prosecution.
Singapore regulates deepfake-related activities through a combination of existing laws rather than a single dedicated regulation. These laws may apply when deepfakes are used to mislead, impersonate, defraud, harass, or misuse personal information.
For example:
From a data protection perspective, a person’s photograph, video image, voice recording, or biometric characteristics may constitute personal data when they can identify an individual.
If an organisation develops, distributes, or uses AI-generated content that incorporates an individual’s likeness without appropriate consent or legal basis, the PDPA may apply. Organisations can face significant financial penalties for failing to protect personal data or using it improperly.
Fraud and Impersonation
Deepfake videos and cloned voices are increasingly used in business email compromise (BEC) scams, fake executive instructions, and payment fraud schemes.
Where a deepfake is used to deceive victims into transferring funds or disclosing information, criminal offenses relating to cheating, impersonation, and fraud may apply.
False and Misleading Information
Where synthetic media is used to spread false information that impacts public interest, authorities may exercise powers under legislation addressing online falsehoods and manipulation.
Harassment and Defamation
Deepfakes that damage an individual’s reputation, cause emotional distress, or depict non-consensual content may expose the creator, distributor, or publisher to both civil and criminal liabilities.
Why Businesses Should Be Concerned
Many organisations assume deepfakes are primarily a public-sector or political issue. In reality, businesses are increasingly becoming targets.
Common business scenarios include:
Executive Impersonation
Attackers create convincing audio or video impersonations of senior executives to authorise financial transfers, payroll changes, or confidential disclosures.
Recruitment Fraud
Synthetic identities and AI-generated profiles may be used during recruitment processes, potentially allowing malicious actors to infiltrate organisations.
Brand and Reputation Abuse
Fake videos or statements appearing to originate from company executives can quickly spread online, causing reputational damage and eroding customer trust.
Data Protection Risks
Employees may unknowingly upload customer data, employee images, voice recordings, or confidential information into public AI platforms, creating compliance concerns under the PDPA and contractual obligations.
For many organisations, the reputational impact of a successful deepfake incident may exceed the immediate financial loss.
Singapore Laws That May Apply to Deepfake Misuse
Depending on the circumstances, several pieces of legislation may apply to deepfake-related incidents.
| Law | Business Relevance |
|---|---|
| Personal Data Protection Act (PDPA) | Regulates the use, collection, and disclosure of personal data, including images, videos, voice recordings, and biometric information. Organisations may face significant financial penalties for non-compliance. |
| Penal Code (Cheating & Personation) | Applies when deepfakes are used to deceive victims into transferring funds, disclosing information, or taking actions they would not otherwise have taken. |
| Defamation Provisions | May apply when AI-generated content harms the reputation of individuals or organisations. |
| Protection from Harassment Act (POHA) | Addresses situations where deepfakes are used to harass, intimidate, distress, or target victims. |
| POFMA | May be relevant where false AI-generated content affects the public interest or contributes to misinformation. |
| Elections (Integrity of Online Advertising) Act | Specifically addresses AI-generated election-related misinformation and manipulated content involving election candidates during election periods. |
The DPO's Perspective: Deepfakes Are a Data Protection Issue
From a governance perspective, deepfakes should no longer be treated purely as an IT security problem.
✔ Whether employee images, recordings, or biometric data are adequately protected.
✔ Whether staff understand the risks of uploading business information to AI tools.
✔ Whether policies govern the use of generative AI technologies.
✔ Whether incident response plans address AI-generated fraud and impersonation.
Just as organisations developed policies for phishing, ransomware, and data breaches, they should now establish governance frameworks for AI-related risks.
Practical Controls Businesses Should Implement
1. Strengthen Verification Procedures
Employees should never approve payments, disclose confidential information, or reset access credentials based solely on a phone call, video conference, or voice message. Independent verification procedures should always be used.
2. Update Security Awareness Training
Employees should never approve payments, disclose confidential information, or reset access credentials based solely on a phone call, video conference, or voice message. Independent verification procedures should always be used.
3. Review AI Governance Policies
Organisations should establish clear policies governing:
✔ Use of generative AI tools
✔ Protection of personal data
✔ Handling of customer information
✔ Employee responsibilities when using AI technologies
4. Implement Dual-Approval Processes
High-risk financial transactions, vendor payment changes, and administrative account requests should require independent approval from multiple authorised personnel.
5. Prepare Incident Response Procedures
Deepfake incidents should be incorporated into existing cybersecurity and data breach response plans. Organisations should know how to preserve evidence, assess potential privacy impacts, communicate with stakeholders, and engage relevant authorities when required.
Deepfake Detection Tools: Can Technology Help Identify Deepfakes?
Yes. A growing number of tools are available to help organisations and individuals assess whether an image, video, audio file, or online content may have been generated or manipulated using artificial intelligence.
However, it is important to understand that no deepfake detection tool is infallible. As AI-generated content becomes increasingly realistic, detection technologies are constantly evolving to keep pace. These solutions should therefore be viewed as part of a broader verification process rather than a definitive source of truth.
The following tools may be useful for preliminary screening and investigation:
TruthScan
TruthScan is designed to detect manipulated images and videos, including face swaps and AI-generated content. The platform analyses facial movements, blinking patterns, and pixel-level artefacts that may indicate synthetic media.
The solution also supports live-stream and video-call analysis, making it particularly useful for organisations concerned about executive impersonation, business email compromise (BEC), and deepfake-enabled fraud. Enterprise integrations and APIs are available for larger deployments.
Best suited for: Organisations requiring enterprise-grade media verification and real-time analysis capabilities.
DeepfakeDetection.io
DeepfakeDetection.io provides a simple and accessible way to analyse images and audio clips for signs of AI manipulation.
The platform includes separate detection engines for images and voice recordings. Image analysis focuses on visual inconsistencies such as lighting, texture, and rendering anomalies, while voice analysis identifies indicators commonly associated with voice cloning technologies.
A notable advantage is that the service provides free checks without requiring user registration, making it useful for quick validation of suspicious content.
Best suited for: Individuals, SMEs, and awareness training exercises.
UncovAI
UncovAI is a browser-based extension that enables users to analyse online content directly from their web browser.
In addition to detecting AI-generated images, the platform can assist with identifying AI-written text and potentially malicious links. This makes it particularly relevant for employees who regularly review online content, social media posts, news articles, or potential phishing attempts.
By integrating detection capabilities directly into everyday web browsing, UncovAI promotes a more proactive approach to digital content verification.
Best suited for: Everyday users, security awareness programmes, and browser-based content validation.
Raid AI
Raid AI is a real-time, multi-modal detection platform capable of analysing audio, video, and images simultaneously.
Designed for enterprise environments, the platform supports live communications and collaboration platforms, including Microsoft Teams, Zoom, and Google Meet. Organisations can leverage its real-time detection capabilities to identify synthetic media during online meetings and communications.
The solution is particularly relevant for organisations concerned about AI-assisted impersonation attacks targeting executives, finance teams, or high-value business transactions.
Best suited for: Enterprises with elevated fraud risks and organisations seeking additional protection during virtual meetings,
Need Help Assessing Your Risks?
Entrust Network helps organisations strengthen their cybersecurity posture through:
✔ Cybersecurity Risk Assessments
✔ Microsoft 365 Security Reviews
✔ Security Awareness Training
✔ Data Protection and PDPA Compliance Advisory
✔ ISO/IEC 27001 and SS 714 Data Protection Trust Mark (DPTM) Implementation
✔ Incident Response Planning and Tabletop Exercises
Whether your organisation is just beginning to explore AI-related risks or looking to enhance existing governance controls, understanding your exposure to deepfake-enabled threats is an important first step.
In the age of AI, trust alone is no longer enough, verification must become part of every organisation’s culture.
About the Authors
Written. by
Zou Yu Heng is a cybersecurity and digital forensics practitioner specializing in vulnerability assessment, security testing, and risk management. He is actively involved in website and business security assessments and supports organizations in identifying and mitigating cybersecurity risks. As a member of the ISO/IEC 27001 and SS 714 Data Protection Trust Mark (DPTM) implementation team, he contributes to incident response, vulnerability testing, and IT policy development. Yu Heng holds a Diploma in Cybersecurity from Singapore Polytechnic.
Technical review and contributions by: Jamson Lim
Jamson Lim is an IT and cybersecurity professional with over 20 years of experience in cloud security, data protection, secure infrastructure, and AI workflows.
He holds a Master of Computing from the National University of Singapore and an Advanced Diploma in Data Protection from Singapore Management University. His certifications include Certified Ethical Hacker (CEH), Practitioner Certificate in Personal Data Protection, and Certified Linux Systems Engineer (CLSE).
Throughout his career, Jamson has supported small and medium-sized enterprises (SMEs), non-profit organizations (NPOs), and regulated industries in strengthening their cybersecurity posture and compliance frameworks. His advisory work covers ISO/IEC 27001 Information Security Management Systems (ISMS), Singapore’s Personal Data Protection Act (PDPA), the Monetary Authority of Singapore’s Technology Risk Management (MAS TRM) Guidelines, and the Ministry of Health’s Cybersecurity and Data Security Essentials (CS/DS Essentials) under the Health Information Act (HIA).
