Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems
Singapore · Guideline · Personal Data Protection Commission
High impact. A reviewer confirms each change before it is listed here.
Our summary
This guideline clarifies how Singapore's Personal Data Protection Act applies when organisations collect and use personal data to develop, test, and deploy AI systems for recommendations and automated decisions. It outlines when organisations can use personal data without consent through business improvement or research exceptions, and sets baseline requirements for transparency, accountability, and data protection practices. The guideline addresses three implementation stages: AI system development and testing, deployment in consumer-facing applications, and procurement of AI systems from service providers.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
5 sections
Jump to a chapter
Part I Executive summary
The PDPA governs how organisations collect, use and disclose personal data while recognising individuals' rights to protect it and organisations' needs to use it for appropriate purposes. These guidelines clarify when organisations can use personal data to develop AI systems that make autonomous decisions or provide recommendations, and when they can rely on exceptions such as business improvement or research without consent. Service providers developing bespoke AI systems are data intermediaries with duties to protect and retain personal data safely.
Part II Legal effect and scope
Part III Using personal data in AI system development, testing and
AI developers may use personal data without consent under a business improvement exception when they cannot reasonably achieve their purposes with non-identifiable data and a reasonable person would find the use appropriate, including for improving goods or services, enhancing operations, understanding behaviour and preferences, personalising offerings, testing system performance, and bias assessments of protected characteristics; and under a research exception when research cannot reasonably proceed in identifiable form, has clear public benefit, will not affect individuals' decisions, and published results will not identify individuals, with impracticality of seeking consent considered when disclosing to other organisations. Organisations must implement appropriate technical, process and legal controls, pseudonymise or de-identify data where possible, and if using raw personal data must meet their Protection Obligation under the PDPA and conduct a Data Protection Impact Assessment considering disclosure, theft, sensitivity and volume risks, establish documented policies on when to use anonymised versus identifiable data, and assess and mitigate privacy attack risks such as model inversion. Organisations may use personal data over anonymised data when training AI systems if they weigh trade-offs, document reasons, and obtain appropriate senior management approval, with effectively anonymised data having no serious possibility of re-identification based on factors including reversibility of the anonymisation method, dataset circulation and recipients, whether individuals could re-identify using public or available information, and controls to prevent re-identification.
Part IV Deployment, collection and use of personal data in AI
Organisations should provide information about personal data collection and AI processing through notification pop-ups, written policies, or other formats, using layered information with key details prominent and additional details elsewhere, and may use model cards and system cards for this purpose. Organisations may limit or omit sensitive information if necessary to protect commercially sensitive, proprietary or security information provided such decisions are justified and documented, and may process personal data without consent under legitimate interests (such as detecting illegal activities) if these interests outweigh adverse effects and individuals are informed of this reliance. Organisations must develop written policies describing practices and safeguards for fairness, data quality and governance during model development, technical safeguards, and for higher-impact outcomes human oversight and AI System safety, and should make these policies available on their website proactively in simple, clear form; they should consider providing information about training data quality, pseudonymisation, restricted access safeguards, bias assessment, testing environment security, and data minimisation practices unless doing so compromises security, safety or commercial confidentiality, and may use AI Verify testing results to demonstrate explainability, fairness across demographic groups, security, accountability, human oversight and robustness.
Part V Procurement of AI systems, best practices for how service
Service providers developing customised AI systems that process personal data on behalf of customers become data intermediaries subject to PDPA obligations and should document training data sources and transformations through data mapping, labelling and records of training data lineage to help detect unauthorised access or modification, enable breach impact assessment and identify sensitive data. Service providers are encouraged to help customers meet notification, consent and accountability obligations by understanding their information needs, designing AI systems using privacy-by-design principles that enable extraction of PDPA compliance information, and providing understandable explanations of system outcomes and sufficient training to human decision-makers. Organisations retain primary responsibility for ensuring their chosen AI system meets PDPA obligations, though service providers may support them in meeting consent, notification and accountability requirements.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.