CEIAI Governance Database
Back to the database
Record STMT-WCE222CAdvisory

Response to Feedback on Public Consultation on Proposed Advisory Guidelines on Use of Personal Data in Generative AI

RESPONSE TO FEEDBACK ON PUBLIC CONSULTATION ON PROPOSED ADVISORY GUIDELINES ON USE OF PERSONAL DATA IN GENERATIVE AI

Report State lawSouth-eastern Asia · SGin force

This document outlines the Personal Data Protection Commission's response to public feedback on its proposed advisory guidelines regarding the use of personal data in generative AI. It addresses key issues raised during the consultation period, such as the application of the publicly available exception, consent and notification obligations, data protection responsibilities across stakeholders, and access and correction obligations. The report explains refinements made to the guidelines to balance compliance burdens with privacy protections.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

Personal Data Protection CommissionRegulator · SG
Lead issuer
Legal forceAdvisory
Under whose authorityState law
Judged fromfull text

Who it governs

CompaniesRegulatorsAI developers and providersAI deployers and usersResearchers and academics

This document is for organizations, AI developers, and stakeholders seeking to understand how data protection laws apply to generative AI development and deployment in Singapore.

Sectors
Cross-sector

What the document contains

What's covered

The document addresses public feedback on generative AI guidelines regarding personal data protection, covering exceptions for publicly available data, consent and notification rules, the distribution of responsibilities among model providers and system deployers, and individual access and correction rights.

What's missing

It does not provide a comprehensive treatment of emerging agent-specific data issues or exhaustive technical rules for machine unlearning, noting these require separate study.

Key takeaways
  • The Commission received 40 responses from organisations and three from individuals during the public consultation on generative AI guidelines.
  • The Commission removed the best practice of notifying controlling organisations prior to web-scraping due to implementation challenges and instead emphasized documentation and appropriate digital barriers.
  • Consent and notification obligations apply only when deemed consent and exceptions, such as for business improvement and research, are not applicable.
  • AI-specific notifications do not require a rigid template, allowing organizations flexibility as long as sufficient information is provided to enable meaningful consent.
  • Stakeholders holding multiple roles in generative AI development and deployment must maintain policies and practices to meet all overlapping obligations.
Outline
· PART I: INTRODUCTION
  - 1 Background
· PART II: OVERVIEW OF ISSUES
  - 2 Publicly Available Exception
  - 3 Consent and Notification Obligations
  - 4 Data Protection Responsibilities of Generative AI Stakeholders
  - 5 Access and Correction Obligations
· PART III: CONCLUSION
Issued20 July 2026
Length1,812 words · 7 pages
FormatNot recorded
Scopenational

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

4/5

Clear responsibility for AI outcomes

the allocation of personal data protection responsibilities across the Generative AI lifecycle

1 Background

screening score · 2026-10-23

Fairness

0/5

Non-discrimination and equitable treatment

screening score · 2026-10-23

Human Dignity

0/5

Respect for the inherent worth of persons

screening score · 2026-10-23

Human Oversight

0/5

Humans remain in control of consequential decisions

screening score · 2026-10-23

Privacy

4/5

Protection of personal data and private life

Proposed Advisory Guidelines on Use of Personal Data in Generative AI

1 Background

screening score · 2026-10-23

Transparency

4/5

Openness about how AI systems work and are used

to enhance transparency for end-users. It has also clarified that “training” and “fine-tuning” refer only to activities

3 Consent and Notification Obligations

screening score · 2026-10-23

Enforcement

0/5

Consequences and compliance mechanisms with real force

screening score · 2026-10-23

Impact Assessment

4/5

Required assessment of an AI system's risks/impacts before or during use

it must explain its assessment and reasoning in a Data Protection Impact Assessment or other written record (s)

2 Publicly Available Exception

screening score · 2026-10-23

Topics

Physical AI Governancecore
generative_ai personal_data data_protection public_consultation ai_governance