What happened
On 2 June 2026 Singapore's Personal Data Protection Commission (PDPC) launched a public consultation on proposed advisory guidelines clarifying how the Personal Data Protection Act applies to the collection, processing, and disclosure of personal data in generative AI development and deployment. The guidelines address legal bases for using personal data in GenAI (including the 'publicly available' exception), the distribution of responsibilities among model providers, system providers, and developers, and how organisations must give effect to data-subject access and correction rights post-deployment. The consultation closes 1 July 2026.
Why it matters
This is the first formal PDPC guidance on GenAI data governance since the 2024 AI recommendation-systems guidelines and will set the enforceable baseline for how Singapore-based organisations — and their global service providers — justify personal data use across the GenAI lifecycle, including agentic pipelines that retrieve, transform, or generate outputs from personal data.
Action needed
Review all GenAI workflows involving personal data against the proposed guidelines before 1 July; prepare a formal response on consent bases, the publicly-available exception, and stakeholder-responsibility allocation, particularly for any agentic deployments that touch customer or employee data.