What the regulator has said

The Personal Data Protection Commission opened a public consultation on advisory guidelines on the use of personal data in generative AI on 2 June 2026, with feedback closing on 1 July. One policy tracker reports final guidelines were issued on 20 July 2026, but that date is not confirmed from a primary source here, so check the PDPC website. Earlier, in 2024, the PDPC had already published advisory guidelines on using personal data in AI recommendation and decision systems.

On enforcement, a privacy-focused analysis notes that in January 2026 the PDPC released four separate decisions, all involving breaches of the protection obligation. Read together, the signal is that data protection basics are being enforced in 2026, and AI features add new places to get them wrong.

Singapore's guidance is advisory, but the underlying PDPA obligations are not. The obligations on consent, purpose, protection, retention, and breach notification all apply to AI features that handle personal data.

Practical controls for AI features

Decide what personal data an AI feature actually needs and remove the rest before it reaches a prompt or a training set. Know which exceptions and bases for use you rely on and document them. Establish retention for prompts, outputs, and logs, and be able to delete or correct data when required.

Treat your model and tooling providers as part of your data protection arrangements. Understand where data is processed, whether it is used to improve their models, and what security they provide. Keep contracts and records that show you asked.

Minimize before the prompt

Strip or mask identifiers that the task does not need, and avoid sending sensitive data to tools that do not require it.

Document your basis and retention

Record why you use the data, how long you keep prompts and logs, and how you delete them.

Prepare for incidents

AI systems add new incident types: a prompt that exposes another user's data, a log store that collects more than intended, an integration that sends information to the wrong place. Extend your breach response plan to cover them, with clear roles, assessment steps, and notification decisions.

Our earlier article on chatbot data handling under the PDPA covers consent and purpose in more depth; this one is about the operating discipline behind it.

Building AI features for Singapore users? Talk to us about a PDPA-aware design review.

Key takeaways

  • The PDPC consulted on generative AI personal data guidance in June 2026; a final version is reported but should be confirmed on the PDPC site.
  • January 2026 enforcement decisions on the protection obligation show basics are being enforced.
  • Minimize data before it reaches prompts, document your basis and retention, and understand where providers process data.
  • Extend breach response to AI-specific incident types.
This is general information, not legal advice. It reflects public commentary and trackers as of October 2026; check the PDPC website for the authoritative guidelines and status.