Navigating the collection and use of personal data in generative AI development – PDPC issues advisory guidelines

1

© RAJAH & TANN SINGAPORE LLP

TECHNOLOGY, MEDIA & TELECOMMUNICATIONS

Navigating the Collection and Use of

Personal Data in Generative AI

Development – PDPC Issues Advisory

Guidelines

Introduction

Generative artificial intelligence ("GenAI") has steadily found its way into the work processes of commercial organisations, bringing with it a host of questions about how it interacts with existing laws.

In particular, as GenAI requires the input of large amounts of data, businesses are concerned about how to navigate the collection and use of personal data in GenAI development.

To address this, the Personal Data Protection Commission ("PDPC") has issued its "Advisory

Guidelines on Use of Personal Data in Generative AI" ("Guidelines"). The Guidelines clarify how the

Personal Data Protection Act 2012 ("PDPA") applies in the context of GenAI and seeks to support organisations in GenAI development and deployment. The Guidelines cover the following main areas:

1. How to responsibly collect and use personal data for GenAI development, especially in web-scraping and the re-use of data provided for non-GenAI purposes ("User Data").

2. The allocation of data protection responsibilities across the GenAI lifecycle.

3. How organisations should handle individuals' requests concerning the processing of their data for

GenAI.

The Guidelines incorporate feedback from a public consultation conducted by PDPC from 2 June 2026

to 1 July 2026. The response received was generally positive, with requests for further clarifications and guidance that were addressed in the finalised Guidelines. For more information, please refer to our June 2026 Legal Update titled "PDPC Proposes New Advisory Guidelines on Use of Personal

Data in Generative AI".

This Update provides an overview of the finalised Guidelines and the key points that organisations looking to utilise GenAI solutions should be aware of.

2

Overview

The guidance and recommendations in the Guidelines are organised according to the typical stages of the GenAI lifecycle:

1. Development: Collecting and using personal data to develop GenAI models.

•

Applicability of the "Publicly Available Exception" ("Publicly Available Exception").

•

Requirements of the "Notification Obligation" ("Notification Obligation") and the "Consent

Obligation" ("Consent Obligation").

2. Deployment: Processing personal data in deployed GenAI models and/or systems.

•

Responsibilities of key stakeholders: (i) model providers ("Model Providers"); (ii) system providers ("System Providers"); and (iii) system deployers ("System Deployers").

3. Post-Deployment: Addressing individuals' requests about personal data.

•

Requirements of the "Access Obligation" ("Access Obligation") and the "Correction

Obligation" ("Correction Obligation").

Development Stage

Applicability of Publicly Available Exception

The development of GenAI models requires large amounts of data, which may involve web-scraping.

Where such data includes personal data, organisations may consider relying on the Publicly Available

Exception under the PDPA rather than seeking consent. The Publicly Available Exception allows organisations to collect, use or disclose, without consent, personal data about an individual that is publicly available.

How should an organisation assess if the Publicly Available Exception applies?

1. Where personal data forms part of publicly accessible online data, organisations may rely on the

Publicly Available Exception to collect the data.

2. Where the online data is behind a digital barrier (e.g. paywalls, registration, authentication, location or eligibility-based access controls, or tools, systems and configurations that detect and prevent automated programs), additional considerations will apply, including:

•

The purpose and effect of the digital barrier.

•

The steps needed to access the personal data.

•

Whether the personal data can be accessed without any restrictions from other online sources.

3. Where it is reasonably arguable that data behind a digital barrier is not publicly available, but an organisation nevertheless relies on the Publicly Available Exception, it must explain its assessment and reasoning in a "Data Protection Impact Assessment" or other written record.

Following the public consultation, PDPC has enhanced its guidance for organisations by: (i) expanding its list of examples of digital barriers; and (ii) including illustrations for organisations on assessing if the

Publicly Available Exception applies.

3

Consent Obligation and Notification Obligation

Another key source of data used to develop GenAI models is User Data. This engages the Consent

Obligation (i.e. consent for the use of User Data for the development of GenAI models) and the

Notification Obligation (i.e. notifying individuals of the purpose of the intended use of their personal data).

To obtain consent to use User Data for GenAI development, organisations must provide an "AI-Specific Notification" ("AI-Specific Notification"), which is an explicit statement that the purpose of processing includes AI and/or GenAI model development.

What constitutes sufficient notification?

1. Organisations are encouraged to provide the following information in their AI-Specific Notifications:

2. In its response to the public consultation, PDPC has clarified that it does not require organisations to abide by a list-style template or standard notification format for AI-Specific Notifications, as long as the notification enables meaningful consent.

3. AI-Specific Notifications are most critical in cases of training or fine-tuning GenAI models, but

PDPC supports organisations that choose to provide AI-Specific Notifications in respect of their downstream use cases to enhance transparency for end-users.

Deployment Stage

The Guidelines identify the following three classes of stakeholders in the GenAI lifecycle:

1. Model Providers who develop and make available GenAI models for distribution and use.

2. System Providers who develop and make available GenAI systems for distribution and use.

3. System Deployers who use or enable the use of GenAI systems under their authority.

The Guidelines set out the respective responsibilities of these stakeholders in protecting personal data:

1. Model Providers

•

Model Providers must comply with all PDPA obligations when they process data to develop and deploy GenAI models.

•

Model Providers should pay particular attention to the "Retention Limitation Obligation" under the PDPA, which requires an organisation to cease to retain its documents containing personal data once its purpose is served. If data needs to be retained to develop or enhance future models, Model Providers should: (i) develop and make available a data retention policy that includes the rationale for longer retention periods; and (ii) regularly review whether the retained personal data remains necessary.

4

•

When processing data on behalf of downstream stakeholders, the "Protection Obligation"

("Protection Obligation") (i.e. protecting personal data by making reasonable security arrangements) is engaged. Model Providers should document and make available the measures they have taken to safeguard personal data from downstream sources.

2. System Providers

•

System Providers that process personal data as part of their own datasets are considered as organisations and must comply with all obligations under the PDPA.

•

System Providers that process data on behalf of downstream deployers are considered as data intermediaries. Accordingly, to comply with the Protection Obligation, System Providers are expected to periodically review the need for additional security arrangements and share information on system-level safeguards with downstream deployers, such as: (i) data security and protection measures around the development environment; (ii) testing and performance metrics; and (iii) incident response and data breach procedures.

3. System Developers

•

System Deployers bear primary responsibility for ensuring that the GenAI systems they have chosen to use can meet their obligations under the PDPA.

•

When procuring systems, System Deployers must ensure that they have sufficient information on upstream safeguards to conduct a holistic assessment.

•

Under the "Purpose Limitation Obligation", System Developers should be disciplined about specifying the intended purpose of processing and amount of personal data required. They are also reminded that personal data should not be processed for illegal or harmful purposes.

•

Under the Protection Obligation, System Developers must: (i) safeguard personal data in their possession or under their control; and (ii) track and designate responsibilities over new data sources and implement corresponding safeguards.

•

System Deployers are encouraged to develop clear written policies and document processes in relation to the safeguards undertaken, and to make such policies pre-emptively available.

•

System Deployers should regularly review the sufficiency of their safeguards, particularly where their GenAI systems have agentic functionalities.

PDPC has further clarified that GenAI stakeholders can hold multiple roles and that, in such cases, stakeholders must have policies and practices as necessary to meet their various obligations.

Post-Deployment Stage

Organisations must comply with the Access Obligation and the Correction Obligation under the PDPA, which require them to accede to individuals' requests for access to, and correction of, their personal data in the organisation's possession or control, unless an exception applies.

Where reasonable and appropriate in the circumstances, organisations are expected to adopt the following best practices:

1. Adopt upstream data handling measures such as: (i) verifying data accuracy at the point of collection; (ii) implementing data cleaning techniques like de-duplication and outlier detection; and

2. Review access and correction requests on a case-by-case basis and accede where reasonable.

5

3. Ensure that personal data is removed from training datasets before they undertake future AI training runs.

4. Track the maturity of and progressively adopt appropriate technical measures to remove inaccurate personal data. In the interim, organisations can consider output filters and other safeguards to minimise the likelihood of models or systems producing inaccurate data as outputs.

Concluding Words

The Guidelines provide comprehensive guidance on how the data protection framework applies to personal data in GenAI development and deployment. With GenAI presenting a unique set of challenges with regard to the protection of personal data, the Guidelines are thus a welcome clarification of the applicable obligations and exceptions.

Although the Guidelines are advisory in nature, they will play a key role in an assessment of whether an organisation is in breach of its PDPA obligations. Organisations looking to utilise GenAI models and systems should thus ensure compliance with the Guidelines, taking into consideration the following matters:

1. The relevant stage of the GenAI lifecycle.

2. The relevant stakeholder role(s) applicable to the manner in which Gen AI is present in your organisation.

3. The applicable obligations and the recommended best practices on how to comply with such obligations.

4. Conducting an assessment of whether the organisation's policies and practices are in line with the approach set out in the Guidelines.

Our team will be glad to assist with further queries on the Guidelines, assessments on compliance, and any other related matters.

Click on the following links for more information (available on the PDPC website at www.pdpc.gov.sg):

•

PDPC's press release titled "PDPC Issues Guidance for Organisations on Responsible Use of

Personal Data in Generative AI"

•

PDPC's "Advisory Guidelines on Use of Personal Data in Generative AI"

•

PDPC's "Closing Note to the Public Consultation on Proposed Advisory Guidelines on Use of

Personal Data in Generative AI"

For regional technology law matters, please see Rajah & Tann Asia's Regional Data & Digital

Economy Practice for more information.

6

Contacts

TECHNOLOGY, MEDIA & TELECOMMUNICATIONS

Rajesh Sreenivasan

HEAD

D +65 6232 0751

rajesh@rajahtann.com

Steve Tan

DEPUTY HEAD

D +65 6232 0786

steve.tan@rajahtann.com

Benjamin Cheong 张汶权

DEPUTY HEAD

D +65 6232 0738

benjamin.cheong@rajahtann.com

7

Regional Contacts

Cambodia

Rajah & Tann Sok & Heng Law Office

T +855 23 963 112 | +855 23 963 113

kh.rajahtannasia.com

Myanmar

Rajah & Tann Myanmar Company Limited

T +951 9253750

mm.rajahtannasia.com

China

Rajah & Tann Singapore LLP

Representative Offices

Shanghai Representative Office

T +86 21 6120 8818

F +86 21 6120 8820

Shenzhen Representative Office

T +86 755 8898 0230

cn.rajahtannasia.com

Philippines

Gatmaytan Yap Patacsil Gutierrez & Protacio

(C&G Law)

T +632 8248 5250

www.cagatlaw.com

Singapore

Rajah & Tann Singapore LLP

T +65 6535 3600

sg.rajahtannasia.com

Indonesia

Assegaf Hamzah & Partners

Jakarta Office

T +62 21 2555 7800

F +62 21 2555 7899

Surabaya Office

T +62 31 5116 4550

F +62 31 5116 4560

www.ahp.co.id

Thailand

Rajah & Tann (Thailand) Limited

T +66 2656 1991

th.rajahtannasia.com

Vietnam

Rajah & Tann LCT Lawyers

Ho Chi Minh City Office

T +84 28 3821 2673 | +84 28 3521 2832

Hanoi Office

T +84 24 3267 6127 | +84 24 3267 6128

vn.rajahtannasia.com

Lao PDR

Rajah & Tann (Laos) Co., Ltd.

T +856 21 454 239

la.rajahtannasia.com

Malaysia

Christopher & Lee Ong

T +603 2273 1919

F +603 2273 8310

www.christopherleeong.com

Rajah & Tann Asia is a network of legal practices based in Asia.

Member firms are independently constituted and regulated in accordance with relevant local legal requirements. Services provided by a member firm are governed by the terms of engagement between the member firm and the client.

This Update is solely intended to provide general information and does not provide any advice or create any relationship, whether legally binding or otherwise.

Rajah & Tann Asia and its member firms do not accept, and fully disclaim, responsibility for any loss or damage which may result from accessing or relying on this Update.

8

Our Regional Presence

Rajah & Tann Singapore LLP is one of the largest full-service law firms in Singapore, providing high quality advice to an impressive list of clients. We place strong emphasis on promptness, accessibility and reliability in dealing with clients. At the same time, the firm strives towards a practical yet creative approach in dealing with business and commercial problems. As the Singapore member firm of the Lex Mundi Network, we are able to offer access to excellent legal expertise in more than 100 countries.

Rajah & Tann Singapore LLP is part of Rajah & Tann Asia, a network of local law firms in Cambodia, China, Indonesia, Lao PDR, Malaysia, Myanmar, the Philippines,

Singapore, Thailand and Vietnam. Our Asian network also includes regional desks focused on Brunei, Japan and South Asia.

The contents of this Update are owned by Rajah & Tann Singapore LLP and subject to copyright protection under the laws of Singapore and, through international treaties, other countries. No part of this Update may be reproduced, licensed, sold, published, transmitted, modified, adapted, publicly displayed, broadcast (including storage in any medium by electronic means whether or not transiently for any purpose save as permitted herein) without the prior written permission of Rajah & Tann

Singapore LLP.

Please note also that whilst the information in this Update is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as a substitute for specific professional advice for any particular course of action as such information may not suit your specific business and operational requirements. It is to your advantage to seek legal advice for your specific situation. In this regard, you may contact the lawyer you normally deal with in Rajah & Tann Singapore LLP or email Knowledge Management at RTApublications@rajahtann.com.