Advisory Guidelines on Use of Personal Data in Generative AI
ADVISORY GUIDELINES ON USE OF PERSONAL DATA IN GENERATIVE AI
These advisory guidelines clarify how Singapore's Personal Data Protection Act (PDPA) applies to the development and deployment of generative AI models and systems. They cover exceptions for publicly available data, notification and consent requirements, data protection responsibilities across the AI lifecycle (for model providers, system providers, and system deployers), and the handling of individual access and correction requests.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Organisations, model providers, system providers, system deployers, and data intermediaries seeking guidance on complying with data protection laws when developing and deploying generative AI.
What the document contains
The document addresses the collection and use of personal data for developing generative AI models, the allocation of data protection responsibilities across the AI lifecycle for model providers, system providers, and system deployers, and the handling of individual access and correction requests under Singapore's PDPA.
The guidelines are advisory in nature, are not legally binding, and do not modify or supplement the legal interpretation of the PDPA or any subsidiary legislation.
- The advisory guidelines clarify how the Personal Data Protection Act (PDPA) applies specifically to generative AI models and systems.
- Organisations may rely on the Publicly Available Exception for web-scraped training data under certain conditions, though digital barriers and contractual terms must be assessed.
- General notifications are insufficient for training generative AI on user data; organisations must provide AI-specific notifications with clear details on how data is used.
- Generative AI stakeholders—including model providers, system providers, and system deployers—have distinct data protection obligations depending on whether they act as organisations or data intermediaries.
- Organisations are expected to navigate technical challenges regarding individual access and correction requests by adopting upstream data handling, case-by-case reviews, and emerging technical removal measures.
· PART I: INTRODUCTION AND SCOPE - 1 Introduction - 2 Scope of the Guidelines · PART II: DEVELOPMENT – COLLECTING AND USING PERSONAL DATA TO DEVELOP GENERATIVE AI MODELS - 3 Publicly Available Exception - 4 Consent and Notification Obligations - 5 Additional Considerations · PART III: DEPLOYMENT - DATA PROTECTION RESPONSIBILITIES OF GENERATIVE AI STAKEHOLDERS - 6 Generative AI Stakeholders - 7 Model Providers - 8 System Providers - 9 System Deployers · PART IV: POST DEPLOYMENT - ADDRESSING INDIVIDUAL REQUESTS ABOUT PERSONAL DATA - 10 Access and Correction Obligations
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Fairness
0/5Non-discrimination and equitable treatment
screening score · 2026-10-23
Human Dignity
0/5Respect for the inherent worth of persons
screening score · 2026-10-23
Human Oversight
4/5Humans remain in control of consequential decisions
• Introducing escalating protocols to humans for complex or high-risk tasks.
Section 9.5 Example
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
Organisations must provide AI-Specific Notifications for this purpose. The key purpose of the Consent and Notification Obligations is to enable individuals to provide meaningful consent.
Section 4.4
screening score · 2026-10-23
Enforcement
4/5Consequences and compliance mechanisms with real force
If the Commission require s the organisation to justify its reliance on the Publicly Available Exception, it must produce this documentation.
Section 3.7
screening score · 2026-10-23