PDPC Advisory Guidelines on Use of Personal Data in Generative AI

On 20 July 2026, the Personal Data Protection Commission (PDPC) issued its Advisory Guidelines on the Use of Personal Data in Generative AI at the Singapore Data Festival. The guidelines add no new legal obligation — they explain how the PDPA's long-standing requirement to obtain consent from the data subject applies concretely in a generative-AI setting.

The core requirement: notice must be specific, not vague. The example Minister Josephine Teo gave at the launch makes the point best. A customer service team wants to improve a generative AI model using call recordings so it can answer queries faster and more accurately. We have all been on the receiving end of such calls, told that "this call may be recorded for quality checks and improvement" — but those recordings contain personal data: names, addresses, billing details. What obligations does that team owe the customer before using the data for model training?

The guidelines' answer is: say so plainly. Organisations should update the privacy policy to state that call recordings of consenting customers will be used to train and improve AI models, and update the scripts staff use when seeking consent, so customers understand the purpose and make an informed choice before consenting. Relying on broad descriptions users will not notice or understand is not enough.

Two things beyond the notice duty. PDPC notes explicitly that "many organisations already provide such AI-specific notices today, therefore the Guidelines go further": (1) roles and responsibilities across the AI value chain — what model developers, fine-tuners and application deployers each carry; and (2) due diligence when relying on publicly available data — public does not mean free to use however you like.

Relationship to the 2024 guidelines. PDPC issued Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems in March 2024, covering discriminative AI (recommendation, scoring, decisions). These 2026 guidelines address the training and improvement of generative AI. The two run in parallel; the newer does not replace the older.

The same day, IMDA launched Generative AI Chatbot Transparency Guidelines calling for a Chatbot Information Card — like the label on a medicine package, disclosing purpose, limitations, data handling and user recourse in one place rather than scattered across terms of service and privacy notices. Together the two documents form Singapore's two-layer accountability design for generative AI: one at the data layer, one at the application layer.