What happened
At the inaugural Singapore Data Festival (20-24 July 2026), Singapore's PDPC issued finalized Advisory Guidelines on the Use of Personal Data in Generative AI (following a public consultation that drew input from Google, Meta, DBS, SIA, HSBC and others), clarifying when the PDPA 'publicly available' exception permits scraping personal data for GenAI training, mandating AI-specific consent notifications when repurposing personal data for model development, and apportioning data-protection responsibilities across model providers, system providers, and deployers (with heightened emphasis on agentic AI systems). Concurrently, IMDA released Transparency Guidelines for GenAI chatbots (recommending consumer-facing 'Chatbot Info Cards'), and PDPC signed a Memorandum of Cooperation with Japan's PPC on cross-border data transfer and AI/PET information-sharing.
Why it matters
This finalizes Singapore's regulatory position (beyond the July 16 draft proposal stage) on the thorniest question in enterprise AI: use of personal data for GenAI training. It creates concrete compliance obligations (consent notifications, lifecycle responsibility allocation) for any organization operating GenAI systems that process Singapore personal data, plus a new bilateral compliance-cost-reduction mechanism with Japan.
Action needed
Organizations developing or deploying GenAI/chatbot systems handling Singapore personal data should review data sourcing practices against the new 'publicly available' exception guidance, prepare AI-specific consent notifications where required, and assess chatbot transparency card readiness.