PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems

What it is

The Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems are the Personal Data Protection Commission’s explanation of how Singapore’s Personal Data Protection Act 2012 (PDPA) applies to AI. They cover systems that embed machine learning models and that make autonomous decisions or assist a human decision-maker through recommendations and predictions.

The PDPC issued a draft for public consultation on 18 July 2023 and the final guidelines on 1 March 2024. They have two aims. To give organisations certainty about when they can use personal data to develop and train AI systems. And to give consumers assurance by setting baseline guidance on how organisations should be transparent about the way their AI systems use personal data.

The guidelines are advisory and not legally binding. The PDPA prevails over them, and they do not limit the PDPC’s enforcement of the Act.

Who it applies to

Any organisation subject to the PDPA that uses personal data to design, train, test, monitor or deploy an AI system, and the service providers that build bespoke AI systems for them. The guidelines are organised by the stages of AI implementation.

What it requires

Development, testing and monitoring. Organisations can use personal data with meaningful consent, or rely on exceptions to consent. The business improvement exception can apply when developing AI to enhance an existing product or service. The research exception can apply to commercial research into AI with public benefit, such as precision medicine. The guidelines set criteria for both. They also encourage data minimisation, pseudonymisation or de-identification as basic controls, anonymised data where practicable, a data protection impact assessment where raw personal data must be used, and an internal record of why personal data was chosen over anonymised data.

Deployment. The PDPA’s consent and notification obligations apply when personal data is collected and used to make recommendations, predictions or decisions. Notifications should help people understand how their data is processed, without being overly technical, and should be proportionate to the risk, taking into account potential harm and the level of autonomy of the system. Organisations are encouraged to describe the product feature, the types of personal data used, why it is relevant and which features most influence the outcome. Information can be layered, and model cards or system cards can carry it. Where commercially sensitive detail is withheld, the decision should be justified and documented internally. The legitimate interests exception can also apply, for example to AI that detects or prevents illegal activity, and organisations relying on it must tell individuals.

Accountability. Section 12 of the PDPA requires policies and practices to meet the Act. Organisations using AI should include in their written policies the practices and safeguards they use for fairness and reasonableness, with detail proportionate to risk. Those can include bias assessment, training data quality, reproducibility, pseudonymisation and security measures, and for higher-impact outcomes, information on accountability mechanisms, human oversight, safety and robustness. The PDPC encourages publishing these policies proactively rather than only on request.

Procurement. Service providers that develop bespoke AI systems are generally data intermediaries with protection and retention obligations. The guidelines recommend good practice such as data mapping, labelling and provenance records, designing systems so the information customers need for notifications and policies can be extracted, and training for the people who will use the system. The deploying organisation keeps primary responsibility for meeting its PDPA obligations.

Key dates

• 18 July 2023. Draft guidelines issued for consultation.
• 31 August 2023. Consultation closed.
• 1 March 2024. Final guidelines issued.

How it relates to other frameworks

The guidelines are the data protection layer under Singapore’s Model AI Governance Frameworks, and they point organisations to the PDPC’s and IMDA’s other resources, including data protection impact assessments and AI Verify. Financial institutions will apply them alongside the MAS AI Risk Management Guidelines, which take effect on 7 October 2027.

Elsewhere, they cover similar ground to GDPR Article 22 and its transparency duties, and to Australia’s Privacy Act ADM transparency obligations, though Singapore’s approach is framed around consent, notification and written policies rather than a specific right not to be subject to automated decisions.

A note on this page

This is Aicura’s reading of the guidelines, written to help you understand them. It is not legal advice and it is not the guidelines themselves. Read the primary source from the PDPC, and take advice on how the PDPA bears on your organisation.