Cybersecurity Policy Report, Singapore Privacy Agency Seeks Feedback on Personal Data Use in GenAI, (Jun 4, 2026)

By Tony Foley

The Singapore Personal Data Protection Commission (PDPC) has launched a public consultation seeking views from the public on how the country’s Personal Data Protection Act (PDPA) applies to the use of personal data in the context of generative artificial intelligence (GenAI).

In its cover letter outlining the scope of the consultation, the PDPC said the proposed guidelines would address several scenarios, including the collection and use of personal data to develop GenAI, the allocation of personal data protection responsibilities across the GenAI lifecycle, and the handling of individuals’ requests concerning the processing of their data for GenAI.

The proposed guidelines are organized across three stages of the lifecycle: development, deployment, and post-deployment. In the development stage, the guidelines cover available exceptions for publicly available information, notification and consent obligations, and the obligation to minimize data used and to establish appropriate data security controls. With respect to the deployment stage, where the GenAI model processes personal data, the guidelines cover issues such as data retention limitations, reasonable security arrangements, limitations on purpose of collection, and developing policies to demonstrate accountability in compliance with the PDPA. Finally, post-deployment, the guidelines specify how to address data subject requests concerning personal data, including fulfilling their obligations concerning access and correction.

Part V of the proposed guidelines lays out the public consultation questions for which the agency is seeking feedback, and part II sets forth the administrative details of comment submissions. The deadline for comments is July 1.

News: InternationalLegislation DataPrivacy AINews