Singapore's Personal Data Protection Commission regulates AI through the Personal Data Protection Act 2012 and advisory guidance rather than an AI law. Its Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (1 March 2024) and on Use of Personal Data in Generative AI (20 July 2026) explain when personal data can be used to train and run AI systems, how to tell customers about AI-driven decisions, and how responsibility splits between banks and AI vendors. The PDPC also released the Model AI Governance Framework (second edition, 21 January 2020) with IMDA. MAS's Guidelines on AI Risk Management (7 October 2026) cite both advisory guidelines as the data-privacy reference for financial institutions.
| Full name | Personal Data Protection Commission (Singapore) — administers and enforces the Personal Data Protection Act 2012 |
| Role | Data protection authority whose AI position is advisory guidelines on how the PDPA applies to AI systems, and the original issuer of Singapore's Model AI Governance Framework |
| Force on banks | Binding law |
| Applies to | Organisations in Singapore that process personal data, including banks and their AI vendors acting as data intermediaries. The Personal Data Protection Act 2012 is binding; the PDPC's AI advisory guidelines and the Model AI Governance Framework are not legally binding |
| Key document | Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (1 March 2024), supplemented by the Advisory Guidelines on Use of Personal Data in Generative AI (20 July 2026) |
| Latest move | 20 July 2026: the PDPC issued Advisory Guidelines on Use of Personal Data in Generative AI, allocating PDPA responsibilities between model providers, system providers and system deployers. |
| Documents tracked | 3 · all documents → |
The PDPA is the binding layer: consent and notification, purpose limitation, protection, retention, accountability, and access and correction obligations apply to personal data used in AI as anywhere else. The 2024 advisory guidelines set out when the Business Improvement, Research and Legitimate Interests exceptions can stand in for consent when developing, testing, bias-assessing or deploying machine-learning systems, and use a bank's credit-assessment policy statement as an example of transparent notification; a footnote cites the PDPC's 2021 HSBC decision on explaining AI use in credit assessments.
The 2026 generative AI guidelines extend that analysis to model providers, system providers and system deployers, placing primary responsibility on the deployer — usually the bank — to obtain enough information about upstream safeguards when it procures a generative AI system, and asking deployers of agentic systems to review safeguards regularly. MAS's AI Risk Management Guidelines point banks to both documents for data-privacy controls, so for Singapore banks PDPC guidance is part of the AI supervisory picture.
What has the PDPC Singapore actually published on AI?
| Date | Document | Status |
|---|---|---|
| Jul 20, 2026 | PDPC Advisory Guidelines on Personal Data in Generative AI — Advisory Guidelines on Use of Personal Data in Generative AI | In force |
| Mar 1, 2024 | PDPC Advisory Guidelines on AI Recommendation and Decision Systems — Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems | In force |
| Jan 21, 2020 | Model AI Governance Framework (Second Edition) — Model Artificial Intelligence Governance Framework, Second Edition | In force |
| Date | Type | Document / event |
|---|---|---|
| Jul 20, 2026 | Guidance | PDPC Advisory Guidelines on Personal Data in Generative AI — Advisory Guidelines on Use of Personal Data in Generative AI. The PDPC issued Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, building on its 2024 guidelines for AI recommendation and decision systems. source ↗ |
| Mar 1, 2024 | Guidance | PDPC Advisory Guidelines on AI Recommendation and Decision Systems — Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems. The PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, published 1 March 2024, explain how Singapore's Personal Data Protection Act applies when organisations use personal data to build and deploy machine-learning systems. source ↗ |
| Jan 21, 2020 | Framework | Model AI Governance Framework (Second Edition) — Model Artificial Intelligence Governance Framework, Second Edition. Singapore's Model AI Governance Framework, second edition, was released by the Personal Data Protection Commission with IMDA on 21 January 2020 as a voluntary guide for organisations deploying AI at scale. source ↗ |
- Enforcement decisions applying the PDPA to AI systems, particularly in financial services, building on the 2021 HSBC decision cited in the 2024 guidelines.
- Further PDPC guidance or updates on agentic AI, which the 2026 generative AI guidelines flag as exacerbating data-protection risks.
- How MAS supervisors use the PDPC guidelines when assessing banks' data-privacy controls under the AI Risk Management Guidelines, whose Sections 5-6 apply from 7 October 2028.
Does Singapore's PDPA apply to bank AI models?
Yes. The PDPC's 2024 advisory guidelines say the PDPA applies to collection and use of personal data to develop, test, monitor and deploy AI systems. Banks need consent or an applicable exception, must notify customers of purposes, and remain accountable for vendors that process data on their behalf.
Are the PDPC's AI guidelines binding?
No. Both the 2024 and 2026 advisory guidelines say they are not legally binding. They explain how the PDPC interprets the PDPA, which is binding, and MAS's AI Risk Management Guidelines cite them as data-privacy guidance for financial institutions.
Follow every move these regulators make
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning