Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
REGULATORY WATCH BRIEF Moderate 48 🧭 Regulatory Guidance published

PDPC publishes Advisory Guidelines on Personal Data in Generative AI at Singapore Data Festival

The new PDPC guidance updates consent and notification requirements for AI, shaping how organizations handle personal and biometric data in Singapore.

ADTP Regulatory Watch · August 25, 2026 · Personal Data Protection Commission (PDPC)
ImpactModerate 48
Type🧭 Regulatory Guidance
Statuspublished enacted, check the effective date
JurisdictionSG

What happened

On July 20, 2026, Singapore’s Personal Data Protection Commission released its finalized Advisory Guidelines on the Use of Personal Data in Generative AI. The guidance clarifies the Publicly Available Exception for web‑scraping and requires AI‑specific notifications when seeking consent to train AI models. It is part of broader APAC regulator efforts to address agentic AI and biometric data challenges.

Why it matters for trust and compliance

  • Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
  • The new PDPC guidance updates consent and notification requirements for AI, shaping how organizations handle personal and biometric data in Singapore.
  • It relates to EU AI Act. The regulations library explains what that law requires.

Who is affected

technology controller processor

Recommended actions

  1. Check that privacy notices describe the practices this addresses.
  2. Review the transfer mechanisms relied on for affected data flows.
  3. Map the security requirements to existing controls and close gaps.
  4. Check breach-notification procedures and timelines against the requirement.
  5. Inventory AI or automated decision systems in scope and their assessments.
  6. Confirm handling of sensitive data categories meets the stricter rules.
Related law EU AI Act in the regulations library →