When must firms inform customers about using their personal data for AI training?: ST Explains

Source: Straits Times
Article Date: 21 Jul 2026
Author: Lee Li Ying

Organisations need to issue AI notices, but are not required to provide ways to opt out.

Singapore has rolled out new rules mandating that organisations inform consumers if they use personal data to train artificial intelligence models.

When are AI notices applicable? Under what circumstances are organisations spared from notifying customers? Will consumers be allowed to opt out of AI training? The Straits Times answers these questions.

1. Banking

Banks may roll out AI assistants to accurately advise customers on everything from planning their monthly finances to what credit cards they should sign up for.

To generate pieces of advice, AI assistants will likely need to be trained on customer data including age, annual income, spending patterns and travel frequency. Records of customer service inquiries made via phone calls and e-mail may also be used as training data.

Under these circumstances, banks will need to issue AI notices to customers.

But it is not mandatory for banks to provide customers with ways to opt out of AI training.

The Personal Data Protection Commission (PDPC) did not specify what information the notification should carry, but it could be on the bank’s website or as an app pop-up. However, if only anonymised datasets are used to train a bank’s AI assistant, such notices are not required.

2. Insurance

Insurers may introduce AI assistants to advise customers on their medical insurance claims.

To process queries such as whether claims are covered and the amount claimable, the AI assistant will need to be trained on diagnostic reports, prescriptions, medical certificates, hospital invoices, receipts, previous claims, medical history and policy details.

The AI assistant also learns from other personal data – like photos or videos related to a claim – to offer more accurate insights tailored to a customer’s specific circumstances.

In this case, the insurer will need to provide AI notices. But it is not mandatory for the insurer to provide customers with ways to opt out of AI training.

According to the PDPC, organisations must not require individuals to consent to the use of their personal data for AI training as a condition of providing a product or service beyond what is reasonable.

Toh Ming Min, director at law firm BR Law Corporation, said the question is whether using a customer’s personal data to train the AI is genuinely necessary to deliver the service they signed up for.

“In this case, if the individual declines to allow his personal data to be used for AI training, the baseline service may have no real value,” said Toh.

3. E-commerce platforms

An e-commerce platform may have previously used customers’ purchase histories and browsing behaviour to recommend products to them, and decides to use the data to train an AI model. The AI model is meant to be a commercial product that will be licensed to other businesses.

Even if the e-commerce platform had notified users that it was using personal data for recommendation services, the training of AI for the development of a commercial product is a new purpose that will require a separate, AI-specific notification.

4. Social media platforms

A social media platform planning to use personal data to develop an AI model to help users create content by suggesting photo captions, enhancing images and stitching multiple videos will need to notify its users.

Personal data includes profile information, photos, videos, posting history, and interactions with other users.

The social media platform may update its privacy policy page with a statement that reads: “When you interact with our AI-enabled features, the text, images and video that you submit may be used for product improvement purposes, including the training and running of our AI models.

“This will enable us to provide enhanced AI-powered content creation features.”