CEIAI Governance Database
Back to the database
Record STMT-W954D81Advisory

Advisory Guidelines on Use of Personal Data in Generative AI

ADVISORY GUIDELINES ON USE OF PERSONAL DATA IN GENERATIVE AI

Guidelines State lawSouth-eastern Asia · SGin force

These advisory guidelines clarify how the Personal Data Protection Act 2012 (PDPA) applies to the development, deployment, and post-deployment phases of generative artificial intelligence models and systems in Singapore. They outline expectations for relying on the publicly available exception for web-scraping, providing AI-specific notifications and obtaining consent, allocating responsibilities among model providers, system providers, and system deployers, and handling individual access and correction requests.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

Personal Data Protection CommissionRegulator · SG
Lead issuer
Legal forceAdvisory
Under whose authorityState law
Judged fromfull text

Who it governs

CompaniesRegulatorsAI developers and providersAI deployers and users

Organisations, model providers, system providers, and system deployers developing or utilizing generative AI models and systems in Singapore.

Sectors
Cross-sector

What the document contains

What's covered

The document addresses the data protection issues associated with generative AI across its lifecycle, including web-scraping and the publicly available exception, notification and consent requirements for user data, data protection responsibilities for model providers, system providers, and system deployers, and individual access and correction requests.

What's missing

The guidelines are advisory in nature, are not legally binding, and do not modify or supplement the legal interpretation of the PDPA.

Key takeaways
  • The advisory guidelines clarify how personal data can be collected, used, and disclosed under the PDPA for generative AI model development and deployment.
  • Organisations relying on the Publicly Available Exception for web-scraping must assess whether digital barriers meaningfully restrict access to online personal data.
  • General privacy policies are insufficient; organisations must provide AI-specific notifications and obtain meaningful consent when using user data for large-scale generative AI model training.
  • Responsibilities across the generative AI lifecycle are allocated between model providers, system providers, and system deployers, who may act as organizations or data intermediaries depending on the context.
  • Organisations must comply with access and correction obligations for personal data processed in generative AI systems, subject to technical limitations and statutory exceptions.
Outline
· PART I: INTRODUCTION AND SCOPE
  - 1 Introduction
  - 2 Scope of the Guidelines
· PART II: DEVELOPMENT – COLLECTING AND USING PERSONAL DATA TO DEVELOP GENERATIVE AI MODELS
  - 3 Publicly Available Exception
  - 4 Consent and Notification Obligations
  - 5 Additional Considerations
· PART III: DEPLOYMENT - DATA PROTECTION RESPONSIBILITIES OF GENERATIVE AI STAKEHOLDERS
  - 6 Generative AI Stakeholders
  - 7 Model Providers
  - 8 System Providers
  - 9 System Deployers
· PART IV: POST DEPLOYMENT - ADDRESSING INDIVIDUAL REQUESTS ABOUT PERSONAL DATA
  - 10 Access and Correction Obligations
Issued20 July 2026
Length6,020 words · 18 pages
FormatNot recorded
Scopenational

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

4/5

Clear responsibility for AI outcomes

System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA

Section 9

screening score · 2026-10-23

Fairness

0/5

Non-discrimination and equitable treatment

screening score · 2026-10-23

Human Dignity

0/5

Respect for the inherent worth of persons

screening score · 2026-10-23

Human Oversight

3/5

Humans remain in control of consequential decisions

It decides to enhance its existing protection safeguards by: • Implementing additional role-based data controls to restrict the assistant’s file and network access; • Implementing data classification systems that tag personal data of a more sensitive nature and requiring stricter handling measures for such data; and • Introducing escalating protocols to humans for complex or high-risk tasks.

Section 9

screening score · 2026-10-23

Privacy

5/5

Protection of personal data and private life

The Personal Data Protection Act 2012 ( “PDPA”) governs the collection, use and disclosure of personal data by organisations in a manner that jointly recognises the right of individuals to protect their personal data

Section 1

screening score · 2026-10-23

Transparency

4/5

Openness about how AI systems work and are used

Organisations must provide AI-Specific Notifications for this purpose. The key purpose of the Consent and Notification Obligations is to enable individuals to provide meaningful consent.

Section 4

screening score · 2026-10-23

Enforcement

2/5

Consequences and compliance mechanisms with real force

If the Commission require s the organisation to justify its reliance on the Publicly Available Exception, it must produce this documentation.

Section 3

screening score · 2026-10-23

Topics

data_protection generative_ai consent_obligation publicly_available_exception ai_lifecycle