Identify consent or an applicable PDPA exception before using personal data in AI

Practical action

Map AI data uses to consent or a specific exception and record the conditions met.

Who does it apply to?

PDPA-regulated organisations using personal data in AI systems.

Actors

Provider / developerDeployer / user organisation

Sectors

Cross-sector / all sectors

Use cases

AI in finance, credit and insuranceCustomer service and chatbots

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  Maps each AI data use to consent or a named exception and records the conditions.

• supportsProcessData governance lead · once per ai system
  Data governance and dataset documentation

  Serves 8 recorded duties · evidence: Dataset documentation sheet, Data quality and bias check report, Dataset approval for use

  Dataset sheets record the legal basis alongside provenance.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v3

• AI Data Governance Register

  Register · XLSX and DOCX · v3

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 5 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every Singapore duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Identify consent or an applicable PDPA exception before using personal data in AI (PDPC AI advisory guidelines)” [AIPT-OBL-0058, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0058 (accessed 27 October 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0058: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, Personal Data Protection Commission Singapore, https://www.pdpc.gov.sg/guidelines-and-consultation/2024/02/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems.

@misc{aipolicytracker2026_identifyconsentoranappli,
  author       = {{AIPolicyTracker}},
  title        = {{Identify consent or an applicable PDPA exception before using personal data in AI (PDPC AI advisory guidelines)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data}},
  url          = {https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data},
  urldate      = {2026-10-27},
  note         = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}

Change history

Similar obligations in other instruments

• Deployers must use the provider's transparency information in their data protection impact assessment — EU AI Act, European Union
• Collect and use personal information only with consent and for the stated purpose — Nepal Privacy Act 2075, Nepal
• Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India
• Employers and employment agencies must disclose the data collected and their retention policy for the tool — NYC Local Law 144 (automated employment decision tools), New York (United States)