Singapore's PDPC Proposes Mandatory Notifications When Firms Use Personal Data for AI Training

Singapore's Personal Data Protection Commission (PDPC) has proposed mandatory AI-specific notifications that would require organisations to clearly inform users when their personal data is being used to train generative AI models. The proposed advisory guidelines, released for public consultation, mark a significant step in updating Singapore's data protection framework for the age of generative AI.

The new rules would replace broad privacy notices that bury AI training in generic language like "new product development." Instead, organisations would need to issue visible AI-specific notifications — through in-product pop-ups, dedicated webpages, or email — explaining exactly what the AI model does, what personal data it ingests, and how users can opt out. For example, a social media platform training an AI model on user-submitted text and images would need to disclose this clearly and provide a direct opt-out mechanism.

The proposal comes as Singapore-based businesses across banking, insurance, retail, and social media increasingly deploy their own generative AI models. PDPC Commissioner Denise Wong, who took office in April 2026, told The Straits Times that the authority is also studying whether to issue guidance on AI-enabled devices like smart glasses, which collect biometric data including facial features, fingerprints, and voice recordings. The consultation period closed on July 1, 2026.

Why it matters for Singapore: The PDPC's move positions Singapore at the forefront of AI data governance in Asia. As one of the first regulators in the region to propose AI-specific data use notifications, the PDPC is setting a precedent that balances innovation with consumer protection. For Singapore-based companies building AI products, these rules will require clearer data practices — but they also provide a regulatory framework that could build greater consumer trust in AI adoption across the city-state.