Announced at the inaugural Singapore Data Festival on 20 July 2026, the Personal Data Protection Commission (PDPC) and Infocomm Media Development Authority (IMDA) initiatives address two sides of responsible AI: how organisations use personal data to develop generative AI (GenAI), and how consumers get clearer information about the chatbots they use. The package also offers businesses practical resources for data security, digital twins and privacy-enhancing technologies (PETs).
17
21
Personal data in GenAI: clarify the use and the consent basis
The PDPC’s advisory guidelines explain how personal data may be used in GenAI models and systems under Singapore’s existing data-protection framework. They clarify organisations’ responsibilities across the AI lifecycle, including when data is used to develop or improve a model.
6
21
44
A key practical point is transparency when seeking consent: people should be told clearly when their personal data will be used for GenAI model development or improvement, rather than having that purpose obscured in broad wording. The guidance explains how an existing PDPA consent requirement applies; it should not be read as a rule that every use of every dataset automatically requires consent. Reporting on the guidelines notes that an exception for publicly available data may be relevant in some cases, but organisations still need to assess whether it applies.
4
21
The available summaries do not set out every condition or provide a complete allocation of duties among all parties in the AI supply chain. Organisations should consult the full advisory guidelines before deciding how the rules apply to a particular dataset or activity.
6
Chatbot Info Cards aim to make disclosures easier to use
IMDA’s separate chatbot transparency guidelines are voluntary and focus on the consumer-facing application, rather than the underlying model. They recommend a consolidated “Chatbot Info Card” so users can find essential information in one place instead of piecing it together from scattered notices.
3
12
31
The card is intended to describe a chatbot’s capabilities and limitations, safety and reliability, data use and protection, and ways to report concerns. The aim is to help people make more informed decisions about using a chatbot—not to imply that a card guarantees the system is safe or accurate.
12
31
Security and adoption resources for organisations
The initiatives extend beyond GenAI. An updated Guide to Data Protection Practices for ICT Systems refreshes practical advice for protecting personal data in ICT environments. The announcement materials describe it as informed by lessons from recent breaches and cyber-essential measures.
1
2
For digital twins, IMDA introduced a Digital Twin for Enterprises Playbook intended as a practical guide for Singapore businesses considering the technology. The package also includes a federated-learning guide and updated synthetic-data guidance, alongside an expansion of the PET Sandbox with proof-of-concept support, access to demonstrations of PET tools and published use cases involving Singapore General Hospital and Ant International.
2
7
16
17
What businesses should take away
The package combines data-use guidance with consumer-facing transparency and practical technology resources. For organisations, the immediate priority is to identify whether personal data is involved in GenAI development or improvement, make the purpose clear when seeking consent, and check the full PDPC guidance for the applicable conditions. For chatbot providers, the voluntary info-card approach offers a structured way to disclose capabilities, limitations and data practices.
6
12
21
These initiatives clarify and support responsible data use; they do not replace the need to assess each organisation’s activities against the full guidance and applicable PDPA requirements.