Singapore PDPC finalises Advisory Guidelines on Use of Personal Data in Generative AI

Singapore's Personal Data Protection Commission (PDPC) issued its final Advisory Guidelines on Use of Personal Data in Generative AI (published on PDPC's site dated 20 July 2026, with extensive law-firm analysis and commentary continuing through 28-31 July 2026). The guidelines clarify when the 'Publicly Available Exception' under the PDPA applies to AI model training, mandate AI-specific notifications when personal data is used to train/fine-tune models, and apportion privacy obligations across the generative AI value chain (developers, fine-tuners, deployers).

This is Singapore's first authoritative, finalized guidance resolving significant uncertainty on how the Personal Data Protection Act 2012 applies to genAI development and deployment — directly affecting any organisation training, fine-tuning, or deploying generative AI systems that process Singapore personal data, including notification and governance-measure obligations.

Organisations training or fine-tuning generative AI models using personal data (or relying on the publicly-available-data exception) should review privacy notices, document DPIAs, and confirm AI-specific notification practices align with the finalized Guidelines.