Identify consent or an applicable PDPA exception before using personal data in AI
Under PDPC AI advisory guidelines, Advisory guidelines, sections on consent, business improvement and research exceptions
What does it require?
Personal data used to train or operate AI systems requires consent unless an exception applies, such as the business improvement exception for improving products and services or the research exception for developing models, each subject to conditions.
Practical action
Map AI data uses to consent or a specific exception and record the conditions met.
Who does it apply to?
PDPA-regulated organisations using personal data in AI systems.
- Sectors
- Cross-sector / all sectors
Evidence examples
- Legal basis assessment for AI personal data (record)
Framework mappings
Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.
| Framework | Reference | Note | Confidence |
|---|---|---|---|
| ISO/IEC 42001:2023 | Annex A controls on data for AI systems | Original editorial mapping. | medium |
Similar obligations in other instruments
- Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India
- Collect and use personal information only with consent and for the stated purpose — Nepal Privacy Act 2075, Nepal
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.