#
AI governance relies on voluntary frameworks (Model AI Governance Framework, Agentic AI MGF, ISAGO, AI Verify) rather than binding statute; no dedicated biometric or genetic-data law was confirmed, and national-security carve-outs are largely undocumented in general legislation.
Sub-modules (6)
Profiling RestrictionsRed
No general Art 22-style profiling restriction was located in the PDPA; profiling limits appear only in children-specific guidance.
Absence provenance: unavailable. Searched: Singapore PDPA profiling restrictions automated decision-making adults, PDPC Article 22 equivalent.
Automated Decision Making TransparencyAmber
Transparency/explainability are addressed through the voluntary Model AI Governance Framework rather than a binding ADM transparency right.
Claims (1):
- Singapore's Model AI Governance Framework, a voluntary framework rather than binding law, promotes principles of transparency and explainability for AI systems' decision-making processes.
Ai Risk AssessmentsAmber
AI risk assessment tools (ISAGO, AI Verify) and the new Agentic AI Model Governance Framework are voluntary; MAS is separately consulting on binding-adjacent AI risk guidance for financial institutions.
Claims (3):
- PDPC and IMDA's Model AI Governance Framework is supported by the voluntary Implementation and Self-Assessment Guide for Organisations (ISAGO) and the AI Verify testing toolkit, which help organisations assess AI systems against the Framework's principles.
- In January 2026, Singapore unveiled a Model AI Governance Framework for Agentic AI, the first governance model specifically addressing agentic AI systems, emphasising human oversight and accountability for agentic AI risks.
- MAS opened a consultation on AI risk management guidelines for financial institutions covering governance, oversight and lifecycle controls.
Biometric RegimeAmber
No dedicated biometric-data statute was confirmed; biometric data is treated as personal data under the PDPA, supplemented by ad hoc device-specific guidance (e.g., smart glasses).
Claims (1):
- Singapore's media regulator (MDDI) has issued guidance advising organisations on PDPA compliance obligations for AI-equipped smart glasses, addressing privacy and safety considerations, rather than through a dedicated biometric-specific statute.
Genetic DataRed
No dedicated genetic-data regime was identified in this research pass.
Absence provenance: unavailable. Searched: Singapore PDPA genetic data regulation, PDPC genetic data guidance.
State Surveillance CarveoutsAmber
Public agencies sit outside the PDPA and are governed by their own internal data rules; no general public-authority surveillance statute over private-sector-held data was confirmed.
Claims (2):
- Singapore public sector agencies are not subject to the PDPA's data protection provisions, being instead governed by their own public-sector data protection rules.
- There is no general legislation in Singapore specifically governing surveillance by public authorities of personal data held by private organisations, beyond specific statutory powers to access and seize data.
Algorithmic, Biometric & Surveillance Governance
The Personal Data Protection Commission finalised its Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, following a public consultation held from 2 June to 1 July 2026. The Guidelines are non-binding advisory guidance that interprets how existing obligations under the Personal Data Protection Act 2012 apply to the development and deployment of generative AI systems; they are not a statutory amendment to the PDPA itself, and organisations remain bound by the underlying PDPA obligations the Guidelines interpret rather than by a new freestanding set of rules.
The final Guidelines broaden the scope of accountability expectations set out in the June 2026 draft. Where the draft named three stakeholder categories, the finalised version extends data-protection accountability expectations across the fuller generative AI supply chain, reaching organisations that collect, curate and supply the datasets used to train or fine-tune generative AI models — not only the developers and deployers of the models themselves. Model providers are expected, as a matter of good practice under the Guidelines, to document incident-response and data-breach procedures, extending established breach-management expectations into the generative AI development context specifically.
Because the Guidelines are advisory rather than binding, PDPC's enforcement powers under the Protection Obligation and other PDPA provisions remain the operative mechanism for any compliance failure connected to personal data used in generative AI; the Guidelines function as PDPC's statement of how it will interpret those existing powers in this context; it is not a new source of statutory liability in its own right.
Outlook
Whether PDPC moves from non-binding advisory guidance toward a more formal regulatory instrument for generative AI and personal data remains an open question; the finalisation of the Guidelines following a dedicated public consultation suggests sustained regulatory attention to this area, and future developments may test how PDPC applies the Guidelines' interpretive framework in an actual enforcement context.
1 earlier distinct update(s)
Algorithmic, Biometric & Surveillance Governance
The PDPC issued Proposed Advisory Guidelines on Use of Personal Data in Generative AI for consultation on 2 June 2026, with the consultation closing 1 July 2026. The draft guidelines would require express consent for using personal data to develop generative AI models, consistent with the PDPC's stated position that general privacy notices should not be considered sufficient for obtaining consent for this specific use. The draft would also require AI-specific notices distinct from an organisation's general privacy notices, and would apply a layered accountability model spreading compliance responsibility across model providers, system providers and deployers, rather than concentrating it on a single party in the generative AI supply chain. Whether the PDPC has finalised these guidelines since the 1 July 2026 consultation close, and if so on what date, remains unconfirmed as at this record; the draft therefore represents the regulator's stated direction rather than a settled rule as matters currently stand.
Outlook
If the PDPC finalises the generative AI guidelines along lines consistent with its 2024 Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, organisations using personal data to train or operate generative AI models in Singapore should expect a materially higher consent and notice bar than applies under general PDPA processing rules. The date of finalisation, and whether the layered-accountability structure survives into the final text, are the two developments to watch for next.
Sources and claims (7)
- ProbablePersonal Data Protection Commission — Singapore's Model AI Governance Framework, a voluntary framework rather than binding law, promotes principles of transparency and explainability for AI systems' decision-making processes.observed
- ProbablePersonal Data Protection Commission — PDPC and IMDA's Model AI Governance Framework is supported by the voluntary Implementation and Self-Assessment Guide for Organisations (ISAGO) and the AI Verify testing toolkit, which help organisations assess AI systems against the Framework's principles.observed
- ProbablearXiv — In January 2026, Singapore unveiled a Model AI Governance Framework for Agentic AI, the first governance model specifically addressing agentic AI systems, emphasising human oversight and accountability for agentic AI risks.observed
- ProbableOneTrust DataGuidance — MAS opened a consultation on AI risk management guidelines for financial institutions covering governance, oversight and lifecycle controls.observed
- ProbableOneTrust DataGuidance — Singapore's media regulator (MDDI) has issued guidance advising organisations on PDPA compliance obligations for AI-equipped smart glasses, addressing privacy and safety considerations, rather than through a dedicated biometric-specific statute.observed
- ProbableOneTrust DataGuidance — Singapore public sector agencies are not subject to the PDPA's data protection provisions, being instead governed by their own public-sector data protection rules.observed
- ProbableOneTrust DataGuidance — There is no general legislation in Singapore specifically governing surveillance by public authorities of personal data held by private organisations, beyond specific statutory powers to access and seize data.observed