PDCP expands AI privacy framework amidst data-sharing barriers

It rolled out a new guidance and an expanded PET Sandbox for privacy‑safe AI.

The Personal Data Protection Commission (PDPC) has launched a Guide on Federated Learning, updated its guidance on synthetic data generation, and expanded the Privacy Enhancing Technologies (PET) Sandbox with the Infocomm Media Development Authority (IMDA).

Launched at the Singapore Data Festival, the Federated Learning guide outlines how organisations can adopt the technology through case studies, an adoption roadmap, and recommendations on risk management.

The PDPC and the Infocomm Media Development Authority (IMDA) said in a joint statement that artificial intelligence (AI) development often requires organisations to centralise data, but the data needed to train AI models is frequently siloed, sensitive, or subject to regulatory requirements.

Federated Learning allows organisations to develop AI models without sharing original datasets.

The PDPC also updated its guide on Synthetic Data Generation (SDG) to reflect recent industry research, covering new methods for generating synthetic datasets, measures to prevent re-identification, and additional case studies.

Unlike Federated Learning, SDG creates artificial datasets that replicate the statistical properties of real data without containing individuals' personal information.

"The Federated Learning and SDG Guides help businesses assess which PET is suitable, adopt stronger safeguards, and unlock data for innovation, collaboration, and AI development in a more privacy-preserving way," the statement said.

The guides complement IMDA's PET Sandbox, which allows organisations to test privacy-enhancing technologies before deployment.

Eleven organisations across the finance, healthcare, construction, transport, and advertising technology sectors have completed projects in the sandbox, with more organisations expected to join.

IMDA is also expanding the sandbox with additional resources to allow organisations to explore and test privacy-enhancing technologies through demonstrations before implementing their own use cases.

Singapore General Hospital joined the sandbox to evaluate the cost-effectiveness and security of using cloud resources to store and process medical images through a Trusted Execution Environment (TEE).

The hospital worked with A*STAR Institute of Advanced Intelligence and Computing to test whether AI could analyse medical images in a secure cloud environment whilst protecting patient data.

Medical images were digitised and uploaded to a secure cloud environment, where AI analysed them before the results supported doctors' clinical diagnoses.

"By combining the computing power of cloud with the security of TEE, healthcare providers can process more medical images in a shorter time whilst keeping sensitive patient data protected," the statement said.

Ant International also participated in the sandbox to evaluate the use of Multi-Party Computing (MPC) in payment processing.

The company tested whether MPC could support payment request verification and risk controls without requiring merchants, wallet partners, and other participants to share or store sensitive data.

MPC enables multiple participants to perform computations using private inputs without revealing those inputs to one another, whilst allowing authorised parties to access only the final result.

"With the use of MPC, Ant International is able to evaluate risk control checks for payment requests and marketing discount eligibility checks, whilst reducing the collection and storing of potentially sensitive data, reducing privacy risks," the statement said.