# PDPC Advisory Guidelines on Personal Data in Generative AI: Advisory Guidelines on Use of Personal Data in Generative AI

Source: https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-generative-ai-2026
Last updated: Oct 24, 2026

The PDPC issued Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, building on its 2024 guidelines for AI recommendation and decision systems. They cover use of web-scraped personal data under the Publicly Available Exception, split data-protection responsibilities between model providers, system providers and system deployers, and set best practices for access and correction requests. For a bank deploying a generative AI system, the key line is that 'System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA'. MAS's Guidelines on AI Risk Management cite these Guidelines alongside the 2024 ones.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [PDPC Singapore](https://www.bankingnewsai.com/ai-regulation/pdpc) |
| Type | Guidance |
| Status | In force |
| Published | Jul 20, 2026 |
| Applies to | Organisations in Singapore that develop, provide or deploy generative AI models and systems using personal data — model providers, system providers and system deployers — including banks deploying generative AI or agentic assistants; advisory guidance interpreting the binding Personal Data Protection Act 2012 |
| Official text | https://www.pdpc.gov.sg/organisations/regulations-decisions/regulatory-guidance/advisory-guidelines-on-use-of-personal-data-in-generative-ai |

## Key points

- Three stakeholder roles (paragraph 6.2): Model Providers, System Providers and System Deployers; an organisation may be an 'organisation' in one context and a data intermediary in another.
- System Deployers 'bear primary responsibility' for the PDPA compliance of systems they choose and, when procuring, 'must therefore ensure that they have sufficient information on upstream safeguards to conduct a holistic assessment' (paragraph 9.1).
- Purpose Limitation: deployers should specify the intended purpose of processing and the amount of personal data required (paragraph 9.2).
- Model and system providers acting as data intermediaries must make reasonable security arrangements and are encouraged to document data access controls, residency, retention and breach procedures, and testing metrics such as likelihood of data leakage (paragraphs 7.4-8.3).
- Agentic AI: deployers should regularly review safeguards, especially where systems have agentic functionalities that 'can exacerbate data protection risks and complicate responsibility allocation', with a reference to IMDA's Model AI Governance Framework for Agentic AI (paragraph 9.5).
- Access and correction requests apply to personal data used for generative AI development or deployment; best practices include provenance records, removing inaccurate data before future training runs and acceding to requests for data in retrieval-augmented generation databases (paragraph 10.5).
- Development: organisations may consider the Publicly Available Exception for web-scraped datasets in lieu of consent (Part II).
- Advisory and not legally binding (paragraph 1.5).

## What changed for banks

The 2024 PDPC guidelines addressed recommendation and decision systems; these extend the analysis to foundation models, generative AI applications and agentic assistants, and allocate responsibility along the vendor chain. For banks that buy rather than build generative AI, they make clear that procurement due diligence on upstream data safeguards is part of PDPA compliance.

## Use cases it governs

- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)

## FAQ

### Who is responsible under the PDPA when a bank uses a vendor's generative AI system?

The PDPC's 2026 Guidelines say System Deployers bear primary responsibility for ensuring the systems they choose can meet PDPA obligations, and must obtain enough information on upstream safeguards to assess them. Model and system providers that process data on the deployer's behalf are data intermediaries with their own protection and retention obligations.

### Do the PDPC generative AI guidelines cover AI agents?

Yes. Paragraph 9.5 asks System Deployers to review safeguards regularly where systems have agentic functionalities, to consider privacy-utility trade-offs when scoping agentic use cases, and points to IMDA's Model AI Governance Framework for Agentic AI.

## Related documents

- [PDPC Advisory Guidelines on AI Recommendation and Decision Systems](https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-ai-recommendation-decision-systems-2024) — Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (Mar 1, 2024)
- [Model AI Governance Framework (Second Edition)](https://www.bankingnewsai.com/ai-regulation/documents/pdpc-model-ai-governance-framework-2020) — Model Artificial Intelligence Governance Framework, Second Edition (Jan 21, 2020)
- [FSB AI sound practices (final report, Oct 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Final report (Oct 15, 2026)
- [SB 947](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-947-2026) — Employment: Automated Decision Systems (No Robo Bosses Act) (Sep 30, 2026)
- [FSB AI sound practices consultation (June 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-ai-sound-practices-consultation-2026) — Sound Practices for Responsible Adoption of Artificial Intelligence (AI): Consultation report (Jun 10, 2026)
- [Japan FSA AI Discussion Paper v1.1](https://www.bankingnewsai.com/ai-regulation/documents/japan-fsa-ai-discussion-paper-v1-1-2026) — AI Discussion Paper (Version 1.1): Preliminary Discussion Points for Promoting the Sound Utilization of AI in the Financial Sector (Mar 3, 2026)
- [BaFin guidance on ICT risks in the use of AI](https://www.bankingnewsai.com/ai-regulation/documents/bafin-ai-ict-risk-guidance-2025) — Guidance on ICT Risks in the Use of AI at Financial Entities (Dec 18, 2025)
- [EO 14365](https://www.bankingnewsai.com/ai-regulation/documents/eo-14365) — Ensuring a National Policy Framework for Artificial Intelligence (Dec 11, 2025)

Last reviewed Oct 24, 2026. Cite the official text (https://www.pdpc.gov.sg/organisations/regulations-decisions/regulatory-guidance/advisory-guidelines-on-use-of-personal-data-in-generative-ai) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/pdpc-advisory-guidelines-generative-ai-2026
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 256 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.