Key Takeaways from New PDPC Advisory Guidelines on Use of Personal Data in Generative AI

The use of Generative AI models has become nearly ubiquitous in recent years. The capabilities of these models have rapidly improved due to, amongst other reasons, the use of user prompts and publicly available data for model training. These have significant implications on users’ personal data. On 20 July 2026, the Personal Data Protection Commission (“PDPC”) of Singapore launched new Advisory Guidelines on the Use of Personal Data in Generative AI (the “GenAI Guidelines”) to address this.

The GenAI Guidelines clarify the application of the Personal Data Protection Act 2012 (“PDPA”) to the collection, use and disclosure of personal data in the context of Generative AI models and systems. The key takeaways from the new GenAI Guidelines are as follows.

1. Publicly available personal data can be used to develop Generative AI Models

Personal data that is publicly available (i.e., can be accessed or obtained with few or no restrictions, including personal data observable by reasonably expected means at public events or locations) may be used by organisations to develop Generative AI models without first obtaining the consent of the individual. The PDPC considers that such personal data falls within the “Publicly Available Exception” in paragraph 1, Part 2 of the First Schedule to the PDPA.

However, if personal data is behind a digital barrier which, through technical or financial means, meaningfully restricts access to the personal data whether wholly or partially (for example, paywalls, registration requirements, authentication mechanisms, access controls or technical restrictions such as bot blockers and Turing tests), organisations must carefully assess whether the personal data can still be considered publicly available. Relevant considerations to assess if the exception applies include the complexity of, effect and purpose of the digital barrier(s).

Organisations should document in writing the reasons for their reliance on the “Publicly Available Exception”. If there is reasonable argument that the personal data is not publicly available, the organisation must be prepared to justify its reliance on the exception by way of a Data Protection Impact Assessment or other written record(s), which must be produced to the PDPC upon request.

2. If consent to collection, use or disclosure of personal data is required, individuals must be expressly notified that the purpose of collection, use or disclosure includes training or fine-tuning of large-scale Generative AI models

The PDPC has clarified individuals must be expressly notified if one of the purposes of the collection, use or disclosure of their personal data is the training and/or fine-tuning of large-scale Generative AI models. This notification must be given to the individual at the point of obtaining their consent by way of an explicit statement. It is not enough to include a general statement in the privacy policy, for example that the personal data is being collected, used and/or disclosed for “new product development” if AI or Generative AI development is not also specified.

The notification must explicitly specify:

(a) Which function(s) of the Generative AI model require the use of personal data;

(b) That the purpose(s) of collection, use and/or disclosure includes AI and/or Generative AI model training and/or fine-tuning;

(c) What type(s) of personal data is affected and how the personal data will be used to train or fine tune the Generative AI model; and

(d) How individuals may decline or withdraw consent for use of personal data for said purposes (for example, step-by-step instructions or an easily accessible opt-out mechanism).

The GenAI Guidelines emphasises that even if consent was previously obtained, fresh consent is required if the collection, use and/or disclosure of personal data for AI or Generative AI model development is such a significant departure from past commercial activities that a reasonable person would not consider the collection, use and/or disclosure appropriate (for example, an apparel company rebrands itself as a developer of GenAI models).

The GenAI Guidelines also reiterates that individuals cannot be required to provide consent to the collection, use and disclosure of their personal data for the purposes of training or fine-tuning Generative AI models as a condition of providing the relevant product or service to the individual (beyond what is reasonable to provide the product or service to the relevant individual).

The GenAI Guidelines also encourages data minimisation and/or anonymisation of personal data as much as possible to minimise unnecessary risks when collecting, using and/or disclosing personal data for purposes related to the development of Generative AI models.

3. Clarification on obligations of Generative AI Stakeholders, i.e. Model Providers, System Providers and System Deployers

The GenAI Guidelines clarify the relevant data protection obligations in the PDPA which apply to the different stakeholders in the Generative AI technology stack, depending on whether they are acting as an organisation or a data intermediary under the PDPA. These are summarised below.

4. Access and Correction Requests in the context of Generative AI

The GenAI Guidelines recognise that there are challenges in facilitating access and correction requests relating to personal data under the PDPA in the context of Generative AI, possibly due to the massive amounts of data used to develop the models and/or due to technical limitations, amongst other reasons.

The GenAI Guidelines clarify that, notwithstanding these challenges, organisations are still required to comply with the access and correction obligations in the PDPA. Where reasonable and appropriate, best practices must be adopted to support compliance, such as:

(a) Adopting upstream measures such as verifying data accuracy at the point of collection, data cleaning techniques and maintaining data provenance records;

(b) Review access and correction requests on a case-by-case basis and accede to requests where reasonable to do so;

(c) Remove personal data, including inaccurate personal data, where possible from training datasets;

(d) Implementing output filters and other safeguards to minimise the likelihood of inaccurate data being produced as output; and

(e) Progressively adopting more appropriate technical measures to remove inaccurate personal data from Generative AI models and systems.

We are grateful to Eleanor Ong (NUS Law Class of 2028) for contributing to the first draft of this article.