--- title: "Singapore — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/singapore/algorithmic-biometric-and-surveillance-governance/ source_html: /jurisdictions/singapore/algorithmic-biometric-and-surveillance-governance/index.html description: "Singapore — Algorithmic, Biometric & Surveillance Governance: algorithmic_biometric_and_surveillance_governance Algorithmic, Biometric & Surveillance Governance 6 sub-modules 7 claims Amber ▾ # AI governance relies on voluntary frameworks (Mo" generated_at: 2026-10-25T04:46:50Z content_sha256: 2be28fe7c02c9c253d57eb60337de42bbcf42e1e75b882475a9bcbefeeae42a8 generator: "fe-fleet/md-twin@1.0" --- # Singapore — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor ### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules7 claimsAmber▾# AI governance relies on voluntary frameworks (Model AI Governance Framework, Agentic AI MGF, ISAGO, AI Verify) rather than binding statute; no dedicated biometric or genetic-data law was confirmed, and national-security carve-outs are largely undocumented in general legislation. Primary framework Model AI Governance Framework (voluntary); PDPA as general personal-data backstop Supervisory authority [Personal Data Protection Commission (PDPC) / Infocomm Media Development Authority (IMDA)](https://www.pdpc.gov.sg/) Traffic-light rationale — Amber AI governance relies on voluntary frameworks (Model AI Governance Framework, Agentic AI MGF, ISAGO, AI Verify) rather than binding statute; no dedicated biometric or genetic-data law was confirmed, and national-security carve-outs are largely undocumented in general legislation. #### Sub-modules (6) #### Profiling RestrictionsRed No general Art 22-style profiling restriction was located in the PDPA; profiling limits appear only in children-specific guidance. Absence provenance: unavailable . Searched: Singapore PDPA profiling restrictions automated decision-making adults, PDPC Article 22 equivalent. #### Automated Decision Making TransparencyAmber Transparency/explainability are addressed through the voluntary Model AI Governance Framework rather than a binding ADM transparency right. Claims (1): - Singapore's Model AI Governance Framework, a voluntary framework rather than binding law, promotes principles of transparency and explainability for AI systems' decision-making processes. #### Ai Risk AssessmentsAmber AI risk assessment tools (ISAGO, AI Verify) and the new Agentic AI Model Governance Framework are voluntary; MAS is separately consulting on binding-adjacent AI risk guidance for financial institutions. Claims (3): - PDPC and IMDA's Model AI Governance Framework is supported by the voluntary Implementation and Self-Assessment Guide for Organisations (ISAGO) and the AI Verify testing toolkit, which help organisations assess AI systems against the Framework's principles. - In January 2026, Singapore unveiled a Model AI Governance Framework for Agentic AI, the first governance model specifically addressing agentic AI systems, emphasising human oversight and accountability for agentic AI risks. - MAS opened a consultation on AI risk management guidelines for financial institutions covering governance, oversight and lifecycle controls. #### Biometric RegimeAmber No dedicated biometric-data statute was confirmed; biometric data is treated as personal data under the PDPA, supplemented by ad hoc device-specific guidance (e.g., smart glasses). Claims (1): - Singapore's media regulator (MDDI) has issued guidance advising organisations on PDPA compliance obligations for AI-equipped smart glasses, addressing privacy and safety considerations, rather than through a dedicated biometric-specific statute. #### Genetic DataRed No dedicated genetic-data regime was identified in this research pass. Absence provenance: unavailable . Searched: Singapore PDPA genetic data regulation, PDPC genetic data guidance. #### State Surveillance CarveoutsAmber Public agencies sit outside the PDPA and are governed by their own internal data rules; no general public-authority surveillance statute over private-sector-held data was confirmed. Claims (2): - Singapore public sector agencies are not subject to the PDPA's data protection provisions, being instead governed by their own public-sector data protection rules. - There is no general legislation in Singapore specifically governing surveillance by public authorities of personal data held by private organisations, beyond specific statutory powers to access and seize data. Category narrative 186 words Singapore's AI governance is predominantly voluntary/soft-law rather than binding. The Model AI Governance Framework's 11 guiding principles include transparency, explainability, repeatability/reproducibility and safety, aiming to improve public understanding and trust in AI. AI Verify is a testing framework/toolkit and the Implementation and Self-Assessment Guide for Organizations (ISAGO) offers practical implementation advice, though AI Verify cannot test Generative AI/LLMs and does not guarantee safety. Singapore's Agentic AI Model Governance Framework was unveiled in January 2026, the first governance model in the world specifically addressing agentic AI. MAS opened a consultation on AI risk management guidelines for financial institutions, covering governance, oversight, and lifecycle controls. Biometric-specific statutory regimes were not confirmed; MDDI advises organizations on compliance with the PDPA for AI-equipped smart glasses, addressing privacy, safety and related considerations, functioning as sector guidance rather than a dedicated biometric law. On surveillance, there is no general legislation in Singapore that specifically relates to surveillance conducted by public authorities of personal data held by private organisations, and Singapore public agencies are not subject to the PDPA's data protection provisions, having their own separate rules. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance The Personal Data Protection Commission finalised its Advisory Guidelines on Use of Personal Data in Generative AI on 20 July 2026, following a public consultation held from 2 June to 1 July 2026. The Guidelines are non-binding advisory guidance that interprets how existing obligations under the Personal Data Protection Act 2012 apply to the development and deployment of generative AI systems; they are not a statutory amendment to the PDPA itself, and organisations remain bound by the underlying PDPA obligations the Guidelines interpret rather than by a new freestanding set of rules. The final Guidelines broaden the scope of accountability expectations set out in the June 2026 draft. Where the draft named three stakeholder categories, the finalised version extends data-protection accountability expectations across the fuller generative AI supply chain, reaching organisations that collect, curate and supply the datasets used to train or fine-tune generative AI models — not only the developers and deployers of the models themselves. Model providers are expected, as a matter of good practice under the Guidelines, to document incident-response and data-breach procedures, extending established breach-management expectations into the generative AI development context specifically. Because the Guidelines are advisory rather than binding, PDPC's enforcement powers under the Protection Obligation and other PDPA provisions remain the operative mechanism for any compliance failure connected to personal data used in generative AI; the Guidelines function as PDPC's statement of how it will interpret those existing powers in this context; it is not a new source of statutory liability in its own right. #### Outlook Whether PDPC moves from non-binding advisory guidance toward a more formal regulatory instrument for generative AI and personal data remains an open question; the finalisation of the Guidelines following a dedicated public consultation suggests sustained regulatory attention to this area, and future developments may test how PDPC applies the Guidelines' interpretive framework in an actual enforcement context. 1 earlier distinct update(s) Periodic update · new data 2026-10-05 #### Algorithmic, Biometric & Surveillance Governance The PDPC issued Proposed Advisory Guidelines on Use of Personal Data in Generative AI for consultation on 2 June 2026, with the consultation closing 1 July 2026. The draft guidelines would require express consent for using personal data to develop generative AI models, consistent with the PDPC's stated position that general privacy notices should not be considered sufficient for obtaining consent for this specific use. The draft would also require AI-specific notices distinct from an organisation's general privacy notices, and would apply a layered accountability model spreading compliance responsibility across model providers, system providers and deployers, rather than concentrating it on a single party in the generative AI supply chain. Whether the PDPC has finalised these guidelines since the 1 July 2026 consultation close, and if so on what date, remains unconfirmed as at this record; the draft therefore represents the regulator's stated direction rather than a settled rule as matters currently stand. #### Outlook If the PDPC finalises the generative AI guidelines along lines consistent with its 2024 Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, organisations using personal data to train or operate generative AI models in Singapore should expect a materially higher consent and notice bar than applies under general PDPA processing rules. The date of finalisation, and whether the layered-accountability structure survives into the final text, are the two developments to watch for next. Evidence 7 Sources and claims (7) - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework) — Singapore's Model AI Governance Framework, a voluntary framework rather than binding law, promotes principles of transparency and explainability for AI systems' decision-making processes.observed 2026-07-29 - Probable[Personal Data Protection Commission](https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework) — PDPC and IMDA's Model AI Governance Framework is supported by the voluntary Implementation and Self-Assessment Guide for Organisations (ISAGO) and the AI Verify testing toolkit, which help organisations assess AI systems against the Framework's principles.observed 2026-07-29 - Probable[arXiv](https://arxiv.org/pdf/2607.07612) — In January 2026, Singapore unveiled a Model AI Governance Framework for Agentic AI, the first governance model specifically addressing agentic AI systems, emphasising human oversight and accountability for agentic AI risks.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/singapore) — MAS opened a consultation on AI risk management guidelines for financial institutions covering governance, oversight and lifecycle controls.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/singapore) — Singapore's media regulator (MDDI) has issued guidance advising organisations on PDPA compliance obligations for AI-equipped smart glasses, addressing privacy and safety considerations, rather than through a dedicated biometric-specific statute.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/singapore_-_third_country_assessment_guidance_note_dataguidance.pdf) — Singapore public sector agencies are not subject to the PDPA's data protection provisions, being instead governed by their own public-sector data protection rules.observed 2026-07-29 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/singapore_-_third_country_assessment_guidance_note_dataguidance.pdf) — There is no general legislation in Singapore specifically governing surveillance by public authorities of personal data held by private organisations, beyond specific statutory powers to access and seize data.observed 2026-07-29