The PDPC issued Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, building on its 2024 guidelines for AI recommendation and decision systems. They cover use of web-scraped personal data under the Publicly Available Exception, split data-protection responsibilities between model providers, system providers and system deployers, and set best practices for access and correction requests. For a bank deploying a generative AI system, the key line is that 'System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA'. MAS's Guidelines on AI Risk Management cite these Guidelines alongside the 2024 ones.
OFFICIAL TEXT: pdpc.gov.sg ↗ · IN FORCE · PDPC SINGAPORE
| Document | PDPC Advisory Guidelines on Personal Data in Generative AI — Advisory Guidelines on Use of Personal Data in Generative AI |
| Issued by | Personal Data Protection Commission (Singapore) — administers and enforces the Personal Data Protection Act 2012 |
| Type | Guidance |
| Status | In force |
| Published | Jul 20, 2026 |
| Applies to | Organisations in Singapore that develop, provide or deploy generative AI models and systems using personal data — model providers, system providers and system deployers — including banks deploying generative AI or agentic assistants; advisory guidance interpreting the binding Personal Data Protection Act 2012 |
| Official source | pdpc.gov.sg ↗ |
| Use cases | Data & privacy · Generative & agentic AI · Third-party & vendor AI · Customer-facing chatbots |
What are the key points of PDPC Advisory Guidelines on Personal Data in Generative AI?
- Three stakeholder roles (paragraph 6.2): Model Providers, System Providers and System Deployers; an organisation may be an 'organisation' in one context and a data intermediary in another.
- System Deployers 'bear primary responsibility' for the PDPA compliance of systems they choose and, when procuring, 'must therefore ensure that they have sufficient information on upstream safeguards to conduct a holistic assessment' (paragraph 9.1).
- Purpose Limitation: deployers should specify the intended purpose of processing and the amount of personal data required (paragraph 9.2).
- Model and system providers acting as data intermediaries must make reasonable security arrangements and are encouraged to document data access controls, residency, retention and breach procedures, and testing metrics such as likelihood of data leakage (paragraphs 7.4-8.3).
- Agentic AI: deployers should regularly review safeguards, especially where systems have agentic functionalities that 'can exacerbate data protection risks and complicate responsibility allocation', with a reference to IMDA's Model AI Governance Framework for Agentic AI (paragraph 9.5).
- Access and correction requests apply to personal data used for generative AI development or deployment; best practices include provenance records, removing inaccurate data before future training runs and acceding to requests for data in retrieval-augmented generation databases (paragraph 10.5).
- Development: organisations may consider the Publicly Available Exception for web-scraped datasets in lieu of consent (Part II).
- Advisory and not legally binding (paragraph 1.5).
What did PDPC Advisory Guidelines on Personal Data in Generative AI change for banks?
The 2024 PDPC guidelines addressed recommendation and decision systems; these extend the analysis to foundation models, generative AI applications and agentic assistants, and allocate responsibility along the vendor chain. For banks that buy rather than build generative AI, they make clear that procurement due diligence on upstream data safeguards is part of PDPA compliance.
Who is responsible under the PDPA when a bank uses a vendor's generative AI system?
The PDPC's 2026 Guidelines say System Deployers bear primary responsibility for ensuring the systems they choose can meet PDPA obligations, and must obtain enough information on upstream safeguards to assess them. Model and system providers that process data on the deployer's behalf are data intermediaries with their own protection and retention obligations.
Do the PDPC generative AI guidelines cover AI agents?
Yes. Paragraph 9.5 asks System Deployers to review safeguards regularly where systems have agentic functionalities, to consider privacy-utility trade-offs when scoping agentic use cases, and points to IMDA's Model AI Governance Framework for Agentic AI.
| Date | Document | Status |
|---|---|---|
| Mar 1, 2024 | PDPC Advisory Guidelines on AI Recommendation and Decision Systems — Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems | In force |
| Jan 21, 2020 | Model AI Governance Framework (Second Edition) — Model Artificial Intelligence Governance Framework, Second Edition | In force |
| Oct 15, 2026 | FSB AI sound practices (final report, Oct 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report | Final |
| Sep 30, 2026 | SB 947 — Employment: Automated Decision Systems (No Robo Bosses Act) | Final |
| Jun 10, 2026 | FSB AI sound practices consultation (June 2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report | Superseded |
| Mar 3, 2026 | Japan FSA AI Discussion Paper v1.1 — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector | Final |
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning