Singapore makes AI training on personal data more visible

What this is about

Singapore's Personal Data Protection Commission is tightening how generative AI and personal data are handled. From July 20, 2026, organizations are expected to tell people specifically when their data is used to train or fine-tune generative AI models. The measure was explained publicly the same day at the Singapore Data Festival.

This is not only a legal story. Many people still do not know whether a chat message, voice recording, photo, location history, or transaction record later ends up in an AI system. Singapore is trying to make that invisible data journey more visible without immediately forcing every company into one rigid form.

What the new AI data notices actually do

The new notices require organizations to name the AI use clearly. A generic sentence such as “we use data for product improvement” is no longer enough under the logic of the guidance if personal data is used for generative AI models. Companies should explain which categories of data are involved, why the data is being used, and what function the model is meant to provide.

The rule is deliberately practical. According to reports, the regulator does not prescribe exactly whether the notice must appear as a pop-up, dedicated webpage, email, or call-center script. Anonymized data is also treated differently. In parallel, Singapore is recommending voluntary information cards for public chatbots: users should be able to see in one place what a bot can do, what it cannot do, how reliable it is, how data is handled, and how issues can be reported.

Why it matters

Generative AI changes privacy because training is not like a normal database lookup. Once sensitive data has flowed into model training, it can be hard to delete, correct, or reliably exclude later. Children's data, health records, credit records, biometric information, voice recordings, and photos are especially sensitive.

For consumers, the impact is direct: someone using a banking app, insurance portal, social network, or airline chatbot should be better able to see when personal input is not only used for the current answer but also for model improvement. For companies, this creates a new baseline for clear communication. For other regulators, Singapore is interesting because it is not building an EU-style list of bans; it is working at the junction of data protection, product labeling, and practical AI governance.

In plain language

Imagine giving a bakery your family recipe so it can bake you one cake. Later, you discover the bakery also used that recipe to train its new cake-making machine. The new notice is the sign at the counter: “If you give us this recipe, it may also be used in our training.”

The sign does not solve every problem. But it makes clear that more is happening than the single service in front of you.

A practical example

An insurer runs a chatbot for claims. Each month, 80,000 customers use the system. Around 12,000 conversations include photos, invoices, names, addresses, or health details. If the insurer uses those conversations for its own generative model, it would now need to state clearly which data categories enter training and what the model is used for.

A clean process could work like this: when the chat starts, a short notice appears. A linked page explains that text and uploaded images may be used to improve the claims assistant. Health data is excluded or handled separately. A support team reviews 200 samples each month to check whether the notice is understandable and whether the technical data pipeline matches the explanation.

Scope and limits

First, transparency is not complete protection. If a notice is vague, too long, or hidden, people still will not understand what happens to their data.

Second, the rule does not replace strong technical controls. Companies still need data minimization, access controls, deletion processes, tests against data reconstruction, and human review.

Third, it remains unclear how strongly consumers can object in practice. According to reports, opt-out channels are not mandatory in every case, and anonymized data is treated differently. That makes the measure useful, but not automatically sufficient.

SEO & GEO keywords

Singapore PDPC, generative AI, personal data, AI training, data protection, Chatbot Information Card, Personal Data Protection Act, Singapore Data Festival, AI governance, consumer transparency