# PDPC Advisory Guidelines on AI Recommendation and Decision Systems: Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems

Source: https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-ai-recommendation-decision-systems-2024
Last updated: Oct 24, 2026

The PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, published 1 March 2024, explain how Singapore's Personal Data Protection Act applies when organisations use personal data to build and deploy machine-learning systems. They say personal data can be used with meaningful consent or under the Business Improvement or Research Exceptions, treat bespoke AI developers as data intermediaries, and ask organisations to explain AI use in notifications and written policies — with a bank credit-scoring example. MAS's Guidelines on AI Risk Management (7 October 2026) cite them as the data-privacy guidance banks should follow when using personal data in AI.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [PDPC Singapore](https://www.bankingnewsai.com/ai-regulation/pdpc) |
| Type | Guidance |
| Status | In force |
| Published | Mar 1, 2024 |
| Applies to | Organisations in Singapore that use personal data to develop, test, monitor or deploy systems embedding machine learning models, including banks, and third-party developers of bespoke AI systems acting as data intermediaries; advisory and 'not legally binding', but they interpret the binding Personal Data Protection Act 2012 |
| Official text | https://www.pdpc.gov.sg/organisations/regulations-decisions/regulatory-guidance/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems |

## Key points

- Purpose (paragraph 1.2): to give organisations 'certainty on when they can use personal data to develop and deploy systems that embed machine learning models (“AI Systems")' and consumers assurance about that use.
- Development: organisations can rely on consent or on the Business Improvement Exception (for example, to enhance an existing product such as personalised recommendations) or the Research Exception; paragraphs 5.5-5.9 allow the Business Improvement Exception for testing AI systems and for bias assessment.
- Deployment: notifications should be proportionate to risk and may explain the product function, types of personal data, how processing relates to the feature and which data features most influence it (paragraph 9.5); paragraph 9.6 gives the example of a bank that provides a 'Bank’s Credit Assessment Policy Statement' on how AI processes applicants' data.
- Legitimate Interests Exception: using personal data as input to an AI system 'for the purposes of detecting or preventing illegal activities' is given as an example (paragraph 9.10) — the basis many fraud and AML models rely on.
- Accountability: organisations should include in written policies the practices and safeguards that achieve fairness and reasonableness (paragraph 10.3); footnote 18 cites Re HSBC [2021] SGPDPC 3, where HSBC met its obligations by explaining how it used personal data and AI in credit facility assessments.
- Procurement: bespoke AI developers ('Service Providers') are data intermediaries with Protection and Retention Obligations; good practices include data mapping, labelling and provenance records (paragraph 1.4).
- Paragraph 10.10 suggests using AI Verify test results — explainability, fairness, security and robustness checks — to support notifications and written policies.
- The Guidelines are advisory and 'not legally binding on the Commission or on any other party' (paragraph 2.2); the PDPA itself is binding.

## What changed for banks

Before 2024 Singapore firms applied general PDPA guidance to AI by analogy. These Guidelines set out when consent exceptions cover model training and bias testing, and what explanations organisations should give when AI drives recommendations or decisions. For banks, MAS's October 2026 AI Guidelines point to them for the data-privacy element of lifecycle controls, so they are now part of the supervisory picture.

## Use cases it governs

- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Credit scoring & underwriting](https://www.bankingnewsai.com/ai-regulation/by-use-case#credit-underwriting)
- [Fair lending & discrimination](https://www.bankingnewsai.com/ai-regulation/by-use-case#fair-lending)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [AML / KYC](https://www.bankingnewsai.com/ai-regulation/by-use-case#aml-kyc)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)

## FAQ

### Can a Singapore bank use customer data to train AI models without consent?

Under the PDPC Guidelines, possibly, if an exception applies: the Business Improvement Exception can cover developing or improving products and testing or bias-assessing AI systems, the Research Exception covers commercial research with public benefit, and the Legitimate Interests Exception can cover AI used to detect or prevent illegal activities. Otherwise meaningful consent is needed. MAS's AI Guidelines also mention obtaining consent where sensitive personal data is used to train models.

### What does the PDPC expect banks to tell customers about AI credit decisions?

Notifications and written policies should explain, proportionately to risk, what personal data is used and how the AI system processes it. The Guidelines' example is a bank that gives applicants who ask a 'Bank’s Credit Assessment Policy Statement' describing what data it collects and how AI processes it in credit card decisions.

### Are the PDPC AI advisory guidelines binding?

No. They are advisory and not legally binding, but they set out how the PDPC interprets the Personal Data Protection Act 2012, which is binding. MAS's Guidelines on AI Risk Management cite them in footnote 30.

## Related documents

- [PDPC Advisory Guidelines on Personal Data in Generative AI](https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-generative-ai-2026) — Advisory Guidelines on Use of Personal Data in Generative AI (Jul 20, 2026)
- [Model AI Governance Framework (Second Edition)](https://www.bankingnewsai.com/ai-regulation/documents/pdpc-model-ai-governance-framework-2020) — Model Artificial Intelligence Governance Framework, Second Edition (Jan 21, 2020)
- [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report (Oct 15, 2026)
- [SB 947](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-947-2026) — Employment: Automated Decision Systems (No Robo Bosses Act) (Sep 30, 2026)
- [FSB AI sound practices consultation (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-consultation-2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026)
- [Japan FSA AI Discussion Paper v1.1](https://www.bankingnewsai.com/ai-regulation/documents/japan-fsa-ai-discussion-paper-v1-1-2026) — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026)
- [BaFin guidance on ICT risks in the use of AI](https://www.bankingnewsai.com/ai-regulation/documents/bafin-ai-ict-risk-guidance-2025) — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025)
- [EO 14365](https://www.bankingnewsai.com/ai-regulation/documents/eo-14365) — Ensuring a National Policy Framework for Artificial Intelligence (Dec 11, 2025)

Last reviewed Oct 24, 2026. Cite the official text (https://www.pdpc.gov.sg/organisations/regulations-decisions/regulatory-guidance/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-ai-recommendation-decision-systems-2024
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 256 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.