PDPC AI advisory guidelines: requirements, deadlines and compliance actions
PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 9 sections
In brief
The PDPC AI advisory guidelines is a non-binding guidance of Singapore, issued by the Personal Data Protection Commission Singapore. Its current status is guidance. Organisations subject to the PDPA that use personal data in AI recommendation and decision systems, and service providers developing such systems for them. 2 obligations are recorded against it, each with its source reference.
- Jurisdiction
- Singapore
- Instrument type
- Guidance
- Status
- Guidance
- Legal force
- Non-binding (guidance, strategy or standard)
- Issuing body
- Personal Data Protection Commission Singapore
- Adopted
- 1 March 2024
- Published
- 1 March 2024
- Obligations recorded
- 2
- Official source
- Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems
- Verification
- Verified against the official source 26 Sep 2026
What is the PDPC AI advisory guidelines?
These advisory guidelines explain how the Personal Data Protection Act applies when organisations use personal data to develop, test and deploy AI systems that make recommendations, predictions or decisions. They clarify the consent obligation and relevant exceptions (business improvement and research), what to include in notifications to individuals, accountability practices such as documenting data provenance and model development, and expectations for service providers building bespoke AI systems.
Who does it apply to?
Organisations subject to the PDPA that use personal data in AI recommendation and decision systems, and service providers developing such systems for them. Advisory; not legally binding, but reflects how the PDPC interprets binding PDPA obligations.
PDPA-regulated organisations and their AI service providers.
When do the requirements apply?
Issued 1 March 2024 following a 2023 public consultation.
What must organisations do?
Identify the legal basis for using personal data in AI (consent or an exception), provide notification about the AI's use of personal data, and document data-protection and governance practices across the AI lifecycle.
Each duty is one line: open it for the summary, practical action and evidence, or go to its own page.
Legal requirement Identify consent or an applicable PDPA exception before using personal data in AI Provider / developer, Deployer / user organisation
Personal data used to train or operate AI systems requires consent unless an exception applies, such as the business improvement exception for improving products and services or the research exception for developing models, each subject to conditions.
Practical action: Map AI data uses to consent or a specific exception and record the conditions met.
Evidence examples: Legal basis assessment for AI personal data
Framework mapping (original, editorial): ISO/IEC 42001:2023 Annex A controls on data for AI systems
Open the obligation page →Advisory guidelines, sections on consent, business improvement and research exceptions Source-linked (a factual check against the official source, not a legal review)
Legal requirement Notify individuals about the use of personal data in AI recommendations and decisions Deployer / user organisation
Organisations should inform individuals that AI systems use their personal data, the purposes, the relevant features and how they influence decisions, proportionate to the impact on the individual.
Practical action: Add AI-specific disclosures to privacy notices and in-product notifications.
Evidence examples: AI notification wording
Framework mapping (original, editorial): NIST AI RMF 1.0 GOVERN 4.x
Open the obligation page →Advisory guidelines, section on notification obligation Source-linked (a factual check against the official source, not a legal review)
What are the penalties?
Underlying PDPA breaches can attract financial penalties up to 10 % of annual turnover in Singapore or SGD 1 million, whichever is higher.
Official sources
-
Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems
Personal Data Protection Commission Singapore · 1 Mar 2024 · Tier 2 source
Cite this record
AIPolicyTracker (2026). “PDPC AI advisory guidelines” [AIPT-POL-0171, record version 1, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-POL-0171 (accessed 27 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0171: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, Personal Data Protection Commission Singapore, https://www.pdpc.gov.sg/guidelines-and-consultation/2024/02/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems.
BibTeX
@misc{aipolicytracker2026_pdpcaiadvisoryguidelines,
author = {{AIPolicyTracker}},
title = {{PDPC AI advisory guidelines}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/singapore-pdpc-ai-advisory-guidelines}},
url = {https://aipolicytracker.org/policies/singapore-pdpc-ai-advisory-guidelines},
urldate = {2026-10-27},
note = {Data licensed CC BY 4.0. Accessed 27 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Add a status badge to your site or README
It shows the status and review state as recorded here and updates when the record does.
Markdown
[](https://aipolicytracker.org/id/AIPT-POL-0171)HTML
<a href="https://aipolicytracker.org/id/AIPT-POL-0171"><img src="https://aipolicytracker.org/badges/singapore-pdpc-ai-advisory-guidelines.svg" alt="AIPolicyTracker: PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, Guidance · verified 26 Sep 2026" height="20"></a>Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Initial structured record. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the PDPC AI advisory guidelines in force?
The PDPC AI advisory guidelines has the status "guidance"; it is not a binding law in force.
Is the PDPC AI advisory guidelines legally binding?
No. The PDPC AI advisory guidelines is a guidance; it sets expectations rather than legal requirements, unless another instrument gives it force.
Who does the PDPC AI advisory guidelines apply to?
Organisations subject to the PDPA that use personal data in AI recommendation and decision systems, and service providers developing such systems for them. Advisory; not legally binding, but reflects how the PDPC interprets binding PDPA obligations.
When does the PDPC AI advisory guidelines apply?
Issued 1 March 2024 following a 2023 public consultation.
What must organisations do under the PDPC AI advisory guidelines?
Identify the legal basis for using personal data in AI (consent or an exception), provide notification about the AI's use of personal data, and document data-protection and governance practices across the AI lifecycle.
What are the penalties under the PDPC AI advisory guidelines?
Underlying PDPA breaches can attract financial penalties up to 10 % of annual turnover in Singapore or SGD 1 million, whichever is higher.
Where is the official text of the PDPC AI advisory guidelines?
The official text is published by Personal Data Protection Commission Singapore at https://www.pdpc.gov.sg/guidelines-and-consultation/2024/02/advisory-guidelines-on-use-of-personal-data-in-ai-recommendation-and-decision-systems (Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.