Singapore’s Personal Data Protection Commission unveils AI-specific notifications for when personal data is used to train generative AI, moving away from broad privacy notices to more targeted alerts.

A one-month public consultation on the proposed guidelines closed on July 1, 2026, with ongoing work to apply the rules to AI-enabled devices and biometric data.

The rules aim to curb misuse of data for unforeseen services like financial profiling and to improve transparency for sensitive data, including names, emails, video and voice recordings, transaction histories, and location data.

There is still ambiguity about whether explicit consent is required for AI training or if opt-out suffices, and whether anonymised data triggers the same obligations, as well as whether services can be declined if users opt out.

PDPC highlights risks from AI-enabled devices such as smart glasses and wearables, citing incidents of hidden recording and AI-assisted cheating to stress the need for meaningful consent frameworks.

Proposed notification delivery methods include in-product pop-ups or dedicated webpages, with clear opt-out or consent withdrawal instructions.

Notifications should be visible and explain the AI model’s functions and the personal data ingested, with concrete examples like voice recordings used to train text-to-speech features.

The guidelines are a priority for PDPC Commissioner Denise Wong as she leads the agency since April 2026, amid rising use of AI-enabled devices collecting biometric data.