In brief
On 20 July 2026, the Personal Data Protection Commission (PDPC) issued its Advisory Guidelines on Use of Personal Data in Generative AI ("Guidelines"). The Guidelines clarify how the Personal Data Protection Act 2012 (PDPA) applies across the generative AI lifecycle, including the use of personal data to develop generative AI models.
The Guidelines are advisory in nature, but interpret binding obligations under the PDPA. One key clarification is that general notifications, such as statements that personal data may be used for "new product development", are insufficient to obtain consent to use personal data for large-scale generative AI model training or fine-tuning. Where consent is required for this purpose, organisations must provide notifications that expressly address the use of personal data for AI model development ("AI-Specific Notifications").
In more detail
When are AI-Specific Notifications required?
Organisations may use "User Data", being personal data provided by an individual to an organisation, or personal data about an individual created in the course of or as a result of the individual's use of the organisation's products or services, to develop generative AI models. Before doing so, an organisation should first consider whether it may rely on deemed consent or an exception to the Consent Obligation, such as the business improvement or research exception. Where no alternative to consent applies, the organisation must obtain consent and notify the individual of the relevant purpose.
For large-scale model training or fine-tuning, meaning activities that develop or modify a model's parameters or underlying capabilities, the PDPC considers general statements that do not identify AI or generative AI model development to be insufficient for obtaining consent. AI-Specific Notifications must enable individuals to understand the types of personal data affected, how that data will be used to train or fine-tune the model, and the functions of the model.
What should an AI-Specific Notification contain?
Organisations retain discretion over the form and manner of notification, but the PDPC encourages them, to the extent practicable, to include:
- The functions of the generative AI model that require the use of personal data
- A clear description of the types of personal data that will be used to develop the model
- How the personal data will be used to train or fine-tune the model
- How individuals can decline or withdraw consent, for example through step-by-step instructions or an easily accessible opt-out mechanism.
AI-Specific Notifications may be provided through mechanisms such as privacy policies, terms of service, in-product notices and centralised resource hubs. Organisations may use layered notifications that display the most relevant information prominently while providing fuller details elsewhere, and may use a single notification to cover the training of multiple models where it sufficiently captures the different processing contexts.
Limitations on requiring consent
Organisations must not, as a condition of providing a product or service, require individuals to consent to the use of User Data for generative AI model development beyond what is reasonable to provide the product or service to that individual.
The Guidelines also encourage organisations to anonymise datasets as far as possible and to practise data minimisation. Anonymised data is not personal data and therefore falls outside the PDPA.
Key takeaways
Organisations that use User Data to train or fine-tune generative AI models should review their notification and consent mechanisms. Broad references to product improvement or new product development will not suffice where consent is required for large-scale model training or fine-tuning, and organisations must instead provide AI-Specific Notifications.
Organisations should also document the basis relied upon for using personal data in generative AI development. An AI-Specific Notification is required only where the organisation relies on consent, so the analysis will depend on whether deemed consent or an exception under the PDPA applies, the nature of the personal data, the proposed use, and whether that use would be considered appropriate in the circumstances.
© 2026 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.