In this guide · 8 sections
- 01What PDPC published and when
- 02Which role are you: model provider, system provider or deployer?
- 03What changed from the June 2026 draft
- 04Using customer data to train or fine-tune AI
- 05What deployers must do: chatbots, assistants and AI agents
- 06Access and correction requests about AI
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
If your business uses an AI chatbot or assistant with customer data, the PDPC treats you as a System Deployer with primary responsibility for PDPA compliance. Define what the tool is for, limit the personal data it sees, protect prompts and outputs, and write it down.
What PDPC published and when
The Advisory Guidelines on Use of Personal Data in Generative AI were published on 20 July 2026. They are advisory: they explain how the PDPC reads the existing PDPA, rather than creating a new law. They should be read with the earlier guidelines on AI recommendation and decision systems and on key concepts in the PDPA.
- 2 June 2026: proposed guidelines issued for public consultation.
- 1 July 2026: consultation closed with 40 responses from organisations and three individuals.
- 20 July 2026: final guidelines published, with a closing note responding to feedback.
The guidelines cover three areas: collecting and using personal data to develop AI models, splitting responsibility between the companies in the AI supply chain, and handling people's access and correction requests.
Which role are you: model provider, system provider or deployer?
The guidelines name three types of organisation. Knowing which one you are tells you which parts apply.
| Role | What it means | Typical example |
|---|---|---|
| Model Provider | Develops and makes available AI models | OpenAI, Anthropic, Google |
| System Provider | Builds AI systems or products on top of models | A chatbot vendor or agency that builds your assistant |
| System Deployer | Uses, or lets its staff and customers use, an AI system | Most SMEs using a website chatbot or AI assistant |
A business can hold more than one role. If you hire a developer to build a chatbot for you, the developer is usually a System Provider acting as your data intermediary, and you are the Deployer. The PDPC says System Deployers 'bear primary responsibility' for making sure the systems they choose can meet PDPA obligations, so you cannot hand the whole problem to the vendor.
What changed from the June 2026 draft
PDPC's closing note on the consultation lists the main changes. Three matter most to SMEs:
- RAG and everyday use are not 'training'. PDPC clarified that training and fine-tuning mean only activities that change a model's parameters or capabilities. Inference and retrieval-augmented generation (RAG), where a chatbot looks up your documents to answer, are not training.
- No fixed notice template. 'AI-Specific Notifications' are shorthand for giving enough information for meaningful consent. You can use your existing privacy policy or terms, as long as people can understand what data is used and how.
- Consent rules only bite when exceptions do not apply. PDPC made clearer that you only need consent and notification when deemed consent and exceptions, such as business improvement or research, do not apply.
For organisations scraping public websites to train models, PDPC dropped a draft suggestion to notify website owners first. Instead, where it is arguable that data behind a barrier such as a login or paywall is not public, the organisation must document its reasoning in a Data Protection Impact Assessment or other written record.
Using customer data to train or fine-tune AI
Most SMEs will not train their own model, but some vendors offer to 'improve the AI with your conversations'. If customer data will be used to train or fine-tune a model, PDPC says a general notice such as 'we use your data to improve our services' is not enough. You need an AI-specific notification, and the guidelines encourage it to cover:
What an AI-specific notification should cover
PDPC also reminds organisations that they must not make consent to AI training a condition of providing a product or service, beyond what is reasonable. Check your chatbot vendor's settings: if it trains on your conversations by default, either switch that off or update your notice.
What deployers must do: chatbots, assistants and AI agents
Section 9 of the guidelines sets out deployer duties. In plain terms:
Define the purpose
Write down what the AI tool is for and what personal data it needs. The PDPC asks deployers to be 'disciplined' about purpose and the amount of data.
Get information from your vendor
Ask for their safeguards: access controls, data location, retention, input and output filters, and breach notification timelines.
Protect prompts, outputs and logs
These are new data sources. Assign someone responsible, limit who can read logs, and consider scanning prompts for identifiers such as NRIC numbers.
Tell users what not to enter
Educate staff and customers on what personal data may go into the system.
Write and publish your policy
PDPC encourages written policies and says making them available, for example on your website, shows accountability.
Review regularly, especially agents
If the AI can plan and take actions across tools, review safeguards more often and consider role-based access and human escalation for high-risk tasks.
Access and correction requests about AI
The PDPA lets people ask what personal data you hold about them and to correct it. The guidelines confirm this applies to data used for AI development or deployment, including data held by your vendor as data intermediary. PDPC accepts that removing data from a trained model is technically hard, but expects reasonable best practices, such as checking data accuracy when you collect it, removing inaccurate personal data from datasets where feasible, and using output filters.
For an SME with a website chatbot, the practical step is simple: know where conversation logs are kept, how long, and how to find and delete a person's chats if asked. Our PDPA checklist for small businesses covers the request process in general.
Do it yourself or get help?
If you use a chatbot or AI assistant, a short written note covering purpose, data, vendor safeguards, log retention and who is responsible goes a long way. Add a line about AI use to your website privacy policy, and read our guides on AI chatbots for websites and the IMDA AI governance framework for the wider picture.
Our PDPA Compliance Pack (S$690) includes a data inventory, privacy policy and internal policies, with AI tools covered. Our AI Website Assistant (S$790) is set up with a defined purpose, limited data, log retention settings and no training on your conversations by default.
Frequently asked questions
PDPC published the final Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026. A draft was released for public consultation on 2 June 2026, and the consultation closed on 1 July 2026 with 40 responses from organisations and three from individuals. A closing note explaining the changes was published on the same day.
Yes, if personal data is involved. A business that uses an AI system, or lets staff and customers use it, is a System Deployer. PDPC says deployers bear primary responsibility for ensuring the systems they choose can meet PDPA obligations, including purpose limits and protecting prompts, outputs and logs.
No. PDPC clarified that training and fine-tuning refer only to activities that develop or modify a model's parameters or capabilities. Inference and retrieval-augmented generation, where a chatbot retrieves your documents to answer a question, are not training. Normal PDPA obligations still apply to the personal data the chatbot processes.
Possibly. You first check whether deemed consent or an exception, such as business improvement or research, applies. If not, you need consent, and PDPC says a generic service improvement notice is insufficient for training or fine-tuning. You should explain the AI function, the data types, how they are used and how to opt out.
They are advisory guidelines, which explain how PDPC interprets and will apply the PDPA. They do not create a new law, but the PDPA obligations they describe are binding. Following the guidelines is the best way to show PDPC that your organisation has taken reasonable steps when using generative AI with personal data.