Singapore has clarified when and how organisations can use personal data to build and improve generative AI models, including when publicly available data may be scraped from the web without consent.
The advisory guidelines from the Personal Data Protection Commission headlined the inaugural Singapore Data Festival, which opened on 20 July 2026. The festival also delivered a voluntary transparency framework for GenAI chatbots and a cross-border data agreement with Japan.
Under the guidelines, organisations developing models may rely on a "publicly available exception" in the Personal Data Protection Act. They must still assess whether data behind paywalls or registration barriers still qualifies as publicly available.
Where personal data collected for other purposes is reused to develop a model, organisations must issue AI-specific notifications. These set out what data is used, for what purpose, and how individuals can decline or withdraw consent.
"Without good data, even the best systems will struggle to produce useful outcomes," Singapore's minister for digital development and information, Josephine Teo, told the festival. "That is why data governance matters more, not less, in the age of AI."
The guidelines drew on feedback from 40 organisations including Google, Meta, DBS, Singapore Airlines, HSBC and WeChat. They apportion responsibilities across the AI supply chain, placing primary compliance duties on system deployers, especially for agentic AI.
The Infocomm Media Development Authority also released transparency guidelines for GenAI chatbots. It called on deployers to publish plain-language "info cards" modelled on food and medicine labels, setting out what a chatbot is for and how user data is handled.