Stage

Key Recommendations

Development: Collecting and using personal data to develop GenAI Models

Organisations developing GenAI models may rely on the "Publicly Available Exception" under the PDPA to web-scrape publicly accessible personal data without consent. However, where personal data sits behind digital barriers (e.g. paywalls, registration requirements), organisations must carefully assess whether it still qualifies as publicly available.

Where User Data is used for GenAI model development, and exceptions to consent do not apply, organisations must obtain consent by providing “AI-Specific Notifications” that articulate the purpose of use, what data will be used, how, and how individuals can decline or withdraw consent.

Deployment: Processing personal data in deployed GenAI Models and/or Systems

Three key stakeholders bear distinct PDPA responsibilities:

Model Providers must comply with all PDPA obligations when they process data to develop and deploy GenAI Models, paying particular attention to data retention issues. When processing data on behalf of downstream stakeholders, Model Providers are encouraged to document and share information on model-level safeguards; and

System Providers must periodically review Gen AI system-level security arrangements and, as best practice, share information on these safeguards with downstream deployers; and

System Deployers bear primary responsibility for PDPA compliance, including defining clear purposes for personal data processing, safeguarding data flowing through their systems, and regularly reviewing safeguards — especially for agentic AI systems.

Post-Deployment: Addressing individuals’ requests about personal data

Individuals can request to access and correct their personal data even after it has been used in GenAI development.

Despite the challenges in facilitating GenAI-related access and correction requests (e.g. due to massive amounts of data used to train GenAI, training data not being stored in a traditional repository), organisations are expected to adopt best practices like upstream data handling practices, reviewing requests on a case-by-case basis and tracking and adopting appropriate technical measures.