Navigating the Collection and Use of Personal Data in Generative AI Development – PDPC Issues Advisory Guidelines

Introduction

Generative artificial intelligence (“GenAI“) has steadily found its way into the work processes of commercial organisations, bringing with it a host of questions about how it interacts with existing laws. In particular, as GenAI requires the input of large amounts of data, businesses are concerned about how to navigate the collection and use of personal data in GenAI development.

To address this, the Personal Data Protection Commission (“PDPC“) has issued its “Advisory Guidelines on Use of Personal Data in Generative AI” (“Guidelines“). The Guidelines clarify how the Personal Data Protection Act 2012 (“PDPA“) applies in the context of GenAI and seeks to support organisations in GenAI development and deployment. The Guidelines cover the following main areas:

1. How to responsibly collect and use personal data for GenAI development, especially in web-scraping and the re-use of data provided for non-GenAI purposes (“User Data“).

2. The allocation of data protection responsibilities across the GenAI lifecycle.

3. How organisations should handle individuals’ requests concerning the processing of their data for GenAI.

The Guidelines incorporate feedback from a public consultation conducted by PDPC from 2 June 2026 to 1 July 2026. The response received was generally positive, with requests for further clarifications and guidance that were addressed in the finalised Guidelines. For more information, please refer to our June 2026 Legal Update titled “PDPC Proposes New Advisory Guidelines on Use of Personal Data in Generative AI”.

This Update provides an overview of the finalised Guidelines and the key points that organisations looking to utilise GenAI solutions should be aware of. 

Overview

The guidance and recommendations in the Guidelines are organised according to the typical stages of the GenAI lifecycle:

1. Development: Collecting and using personal data to develop GenAI models.

• • Applicability of the “Publicly Available Exception” (“Publicly Available Exception“).
  • Requirements of the “Notification Obligation” (“Notification Obligation“) and the “Consent Obligation” (“Consent Obligation“).

2. Deployment: Processing personal data in deployed GenAI models and/or systems.

• • Responsibilities of key stakeholders: (i) model providers (“Model Providers“); (ii) system providers (“System Providers“); and (iii) system deployers (“System Deployers“).

3. Post-Deployment: Addressing individuals’ requests about personal data.

• • Requirements of the “Access Obligation” (“Access Obligation“) and the “Correction Obligation” (“Correction Obligation“).

Development Stage

Applicability of Publicly Available Exception

The development of GenAI models requires large amounts of data, which may involve web-scraping. Where such data includes personal data, organisations may consider relying on the Publicly Available Exception under the PDPA rather than seeking consent. The Publicly Available Exception allows organisations to collect, use or disclose, without consent, personal data about an individual that is publicly available.

How should an organisation assess if the Publicly Available Exception applies?

1. Where personal data forms part of publicly accessible online data, organisations may rely on the Publicly Available Exception to collect the data.

2. Where the online data is behind a digital barrier (e.g. paywalls, registration, authentication, location or eligibility-based access controls, or tools, systems and configurations that detect and prevent automated programs), additional considerations will apply, including:

• • The purpose and effect of the digital barrier.
  • The steps needed to access the personal data.
  • Whether the personal data can be accessed without any restrictions from other online sources.

3. Where it is reasonably arguable that data behind a digital barrier is not publicly available, but an organisation nevertheless relies on the Publicly Available Exception, it must explain its assessment and reasoning in a “Data Protection Impact Assessment” or other written record.

Following the public consultation, PDPC has enhanced its guidance for organisations by: (i) expanding its list of examples of digital barriers; and (ii) including illustrations for organisations on assessing if the Publicly Available Exception applies.

Consent Obligation and Notification Obligation

Another key source of data used to develop GenAI models is User Data. This engages the Consent Obligation (i.e. consent for the use of User Data for the development of GenAI models) and the Notification Obligation (i.e. notifying individuals of the purpose of the intended use of their personal data).

To obtain consent to use User Data for GenAI development, organisations must provide an “AI-Specific Notification” (“AI-Specific Notification“), which is an explicit statement that the purpose of processing includes AI and/or GenAI model development.

What constitutes sufficient notification?

1. Organisations are encouraged to provide the following information in their AI-Specific Notifications: (i) the functions of the GenAI model; (ii) a clear description of the types of personal data to be used; (iii) how the data will be used to develop the GenAI model; and (iv) how individuals can decline or withdraw consent.

2. In its response to the public consultation, PDPC has clarified that it does not require organisations to abide by a list-style template or standard notification format for AI-Specific Notifications, as long as the notification enables meaningful consent.

3. AI-Specific Notifications are most critical in cases of training or fine-tuning GenAI models, but PDPC supports organisations that choose to provide AI-Specific Notifications in respect of their downstream use cases to enhance transparency for end-users.

Deployment Stage

The Guidelines identify the following three classes of stakeholders in the GenAI lifecycle: 

1. Model Providers who develop and make available GenAI models for distribution and use.

2. System Providers who develop and make available GenAI systems for distribution and use.

3. System Deployers who use or enable the use of GenAI systems under their authority.

The Guidelines set out the respective responsibilities of these stakeholders in protecting personal data: 

1. Model Providers

• • imitation Obligation” under the PDPA, which requires an organisation to cease to retain its documents containing personal data once its purpose is served. If data needs to be retained to develop or enhance future models, Model Providers should: (i) develop and make available a data retention policy that includes the rationale for longer retention periods; and (ii) regularly review whether the retained personal data remains necessary.
  • When processing data on behalf of downstream stakeholders, the “Protection Obligation” (“Protection Obligation“) (i.e. protecting personal data by making reasonable security arrangements) is engaged. Model Providers should document and make available the measures they have taken to safeguard personal data from downstream sources.

2. System Providers

• • System Providers that process personal data as part of their own datasets are considered as organisations and must comply with all obligations under the PDPA.
  • System Providers that process data on behalf of downstream deployers are considered as data intermediaries. Accordingly, to comply with the Protection Obligation, System Providers are expected to periodically review the need for additional security arrangements and share information on system-level safeguards with downstream deployers, such as: (i) data security and protection measures around the development environment; (ii) testing and performance metrics; and (iii) incident response and data breach procedures.

3. System Developers

• • System Deployers bear primary responsibility for ensuring that the GenAI systems they have chosen to use can meet their obligations under the PDPA.
  • When procuring systems, System Deployers must ensure that they have sufficient information on upstream safeguards to conduct a holistic assessment.
  • Under the “Purpose Limitation Obligation“, System Developers should be disciplined about specifying the intended purpose of processing and amount of personal data required. They are also reminded that personal data should not be processed for illegal or harmful purposes.
  • Under the Protection Obligation, System Developers must: (i) safeguard personal data in their possession or under their control; and (ii) track and designate responsibilities over new data sources and implement corresponding safeguards.
  • System Deployers are encouraged to develop clear written policies and document processes in relation to the safeguards undertaken, and to make such policies pre-emptively available.
  • System Deployers should regularly review the sufficiency of their safeguards, particularly where their GenAI systems have agentic functionalities.

PDPC has further clarified that GenAI stakeholders can hold multiple roles and that, in such cases, stakeholders must have policies and practices as necessary to meet their various obligations.

Post-Deployment Stage

Organisations must comply with the Access Obligation and the Correction Obligation under the PDPA, which require them to accede to individuals’ requests for access to, and correction of, their personal data in the organisation’s possession or control, unless an exception applies.

Where reasonable and appropriate in the circumstances, organisations are expected to adopt the following best practices:

1. Adopt upstream data handling measures such as: (i) verifying data accuracy at the point of collection; (ii) implementing data cleaning techniques like de-duplication and outlier detection; and (iii) maintaining data provenance records to document the lineage of training data.

2. Review access and correction requests on a case-by-case basis and accede where reasonable.

3. Ensure that personal data is removed from training datasets before they undertake future AI training runs.

4. Track the maturity of and progressively adopt appropriate technical measures to remove inaccurate personal data. In the interim, organisations can consider output filters and other safeguards to minimise the likelihood of models or systems producing inaccurate data as outputs.

Concluding Words

The Guidelines provide comprehensive guidance on how the data protection framework applies to personal data in GenAI development and deployment. With GenAI presenting a unique set of challenges with regard to the protection of personal data, the Guidelines are thus a welcome clarification of the applicable obligations and exceptions.

Although the Guidelines are advisory in nature, they will play a key role in an assessment of whether an organisation is in breach of its PDPA obligations. Organisations looking to utilise GenAI models and systems should thus ensure compliance with the Guidelines, taking into consideration the following  matters:

1. The relevant stage of the GenAI lifecycle.

2. The relevant stakeholder role(s) applicable to the manner in which Gen AI is present in your organisation.

3. The applicable obligations and the recommended best practices on how to comply with such obligations.

4. Conducting an assessment of whether the organisation’s policies and practices are in line with the approach set out in the Guidelines.

Our team will be glad to assist with further queries on the Guidelines, assessments on compliance, and any other related matters.  

Click on the following links for more information (available on the PDPC website at www.pdpc.gov.sg):

• • PDPC’s press release titled “PDPC Issues Guidance for Organisations on Responsible Use of Personal Data in Generative AI”
  • PDPC’s “Advisory Guidelines on Use of Personal Data in Generative AI”

• • PDPC’s “Closing Note to the Public Consultation on Proposed Advisory Guidelines on Use of Personal Data in Generative AI”

For regional technology law matters, please see Rajah & Tann Asia’s Regional Data & Digital Economy Practice for more information.