Singapore’s Guidelines On Personal Data In Generative AI: Key Compliance Takeaways For Companies

Companies that train or deploy generative artificial intelligence (AI) models must walk a tightrope between innovation and business efficiency on the one hand and the need to handle personal data in accordance with the applicable personal data protection regimes on the other. Failing to do this might attract regulatory action and significant financial penalties for the company. Across 2025 and 2026 alone, Singapore’s Personal Data Protection Commission (PDPC) imposed financial penalties worth $405,750 across 5 high-profile cases of failures to protect the personal data under the companies’ control¹²³⁴⁵. This is in addition to stringent compliance directions issued in those and other cases.

To provide greater clarity on how Singapore’s data protection framework applies to the use of personal data across the development, deployment and post-deployment stages of generative AI models and systems, the PDPC issued the Advisory Guidelines on Use of Personal Data in Generative AI on 20 July