Singapore issues guidelines on personal data use in GenAI

Companies must ensure consent, safeguards, and PDPA compliance.

The Personal Data Protection Commission (PDPC), with support from the Infocomm Media Development Authority (IMDA), has released new guidelines on the use of personal data in Generative AI (GenAI) models and systems.

The guidelines explain how organisations can collect and use personal data for GenAI development whilst meeting Personal Data Protection Act (PDPA) requirements. It also outline the responsibilities of key GenAI stakeholders and how organisations should respond to individuals’ requests regarding the processing of their personal data.

For GenAI model development, organisations may rely on the PDPA’s “Publicly Available Exception” to collect publicly accessible personal data without consent.

However, they must assess whether data remains publicly available when access is restricted by digital barriers such as paywalls or registration requirements.

For organisations using user data to develop GenAI models, consent must be obtained where no applicable exception applies. The PDPC recommended the use of “AI-Specific Notifications” that clearly explain the purpose of data use, the types of data involved, how the data will be processed, and how individuals can decline or withdraw consent.

The guidelines also clarify the responsibilities of organisations involved in GenAI deployment. Model providers must meet PDPA obligations when processing data to develop and deploy GenAI models, including addressing data retention concerns and sharing information on model-level safeguards with downstream stakeholders.

System providers should regularly review security arrangements and share relevant safeguards with organisations deploying their systems.

Meanwhile, system deployers remain primarily responsible for PDPA compliance, including defining clear purposes for data processing, protecting personal data within their systems, and reviewing safeguards, particularly for agentic AI applications.

The PDPC further highlighted that individuals retain the right to request access to and correction of their personal data even after the data has been used for GenAI development.

Whilst such requests may be challenging due to the large volumes of training data involved and the lack of traditional data storage structures, organisations are expected to adopt best practices, including improving data handling processes, reviewing requests on a case-by-case basis, and implementing appropriate technical measures.

The guidelines incorporate feedback from a public consultation that concluded on 1 July 2026, which received responses from 40 organisations, including Google, Meta, WeChat, DBS, Singapore Airlines, Workday, Prudential, HSBC, Epic Systems Corporation, and NUHS, as well as three individuals.

The guidelines build on the PDPC’s existing guidance on AI recommendation and decision systems and key PDPA concepts.