AI-specific notifications mandatory for firms using personal data to train AI models: PDPC

From July 20, organisations in Singapore will need to inform consumers when they use personal data to train generative artificial intelligence models, as the nation seeks to promote greater transparency and accountability.

“As more organisations develop, adapt or deploy generative AI tools, we must address the question of accountability,” said Minister for Digital Development and Information Josephine Teo, announcing the move at the Singapore Data Festival on July 20.

Singapore Data Festival was formerly known as Personal Data Protection Week, with the last run in 2025. The event has since been rebranded to reflect the broader role of data and AI in the digital economy.

The new measure, called AI-specific notifications, is set out in the advisory guidelines on the use of personal data in generative AI systems.

The guidelines were released by the Personal Data Protection Commission (PDPC) on July 20 following a month-long public consultation from June 2 to July 1.

The PDPC explained in the advisory guidelines that the AI-specific notifications are needed because there are risks that sensitive personal data – like children’s data, and health and credit records – could be exposed or reconstructed from generative AI models. It could be difficult to remove or correct information once it has been used to train a model.

Personal data comprises everything from names, phone numbers and e-mail addresses to voice recordings, photographs, biometric information, and financial and transaction records.

In the past, organisations could rely on broad privacy notices if they use personal data for “new product development” or “personalisation of services”.

Even though AI-specific notices are mandatory, the PDPC did not prescribe the content of such notices or where to place them, but recommended that companies explain the types of data used through in-app pop-ups or dedicated webpages. Channels for consumers to opt out or withdraw their consent are also not mandatory.

When call centres use call recordings to train AI models, a privacy policy or script update will suffice. AI-specific notifications are not required when anonymised personal data is used for AI training.

Organisations, including banks, insurers and social media platforms, are not allowed to decline services to consumers if they say no to AI training.

A separate set of voluntary guidelines released on July 20 also urges AI chatbot providers to disclose information such as their systems’ capabilities, limitations, reliability and safety measures.

These are AI assistants designed for public use, ranging from general-purpose chatbots developed by frontier AI companies to specialised assistants offered by businesses such as banks, airlines, insurers and retailers.

Such chatbots are the most commonly used generative AI application for users, but many may not know the chatbots’ limitations or what happens to the data they input.

“The information usually exists. But it is scattered across terms of service, privacy notices and other documents, and is often either too simplistic or too technical for ordinary users,” said Teo.

Thus, the guidelines recommend a “chatbot information card” – akin to a medicinal product label – that provides users with key information about an AI chatbot in a single place. It can take different forms, such as a dedicated information page or a disclosure document.

Teo pointed out that medicinal product labels do not list every scientific detail but tell people the essentials of what the drug is for, how to take it, how much is recommended, the side effects to watch for and when not to use it.

“The information card is meant to work the same way. It sets out in plain language what the chatbot is for, what it is not for, how data may be handled and how users can report issues,” said Teo.

Big tech companies like Google and Meta, as well as local giants like DBS Bank, OCBC Bank, Singapore Airlines and Synapxe, will be rolling out their own versions of the chatbot information cards over the next 12 months.

DBS has two chatbots – Joy, which provides 24/7 support for corporate clients, and digibot, which handles banking queries like checking account balances and loan enquiries. Both clearly inform users they are interacting with a generative AI-powered service and provide the option to speak to a human operator.

“We welcome IMDA’s pragmatic approach to balancing transparency with implementation flexibility that will help strengthen trust in AI across the ecosystem and advance Singapore’s ambition to be a trusted AI financial hub,” said Derrick Goh, group chief operating officer at DBS.

Teo said that for Google, the company will be consolidating key information about its flagship AI chatbot Gemini, while Meta will provide clear and accessible information about its AI-powered products.

Public sector agencies like the National Library Board and Health Promotion Board will also be adopting the guidelines.

“The companies I mentioned are early adopters who are demonstrating leadership in data and AI governance. We hope many more will follow,” said Teo.

The data protection conference takes place from July 20 to 24 at the Sands Expo and Convention Centre.

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

When must firms inform customers about using their personal data for AI training?: ST Explains Decoding the Law: Career Navigation Guides Lawyers Out of Professional Fog