Verify the conditions before relying on the Business Improvement Exception
Severity Highparas 5.1–5.2; First Schedule Part 5 para 1(2)
The Business Improvement Exception lets an organisation use, without consent, personal data it previously collected in accordance with the PDPA, for improving or enhancing existing goods and services or developing new ones; improving or developing methods or processes for business operations relating to those goods and services; learning or understanding individuals’ behaviour and preferences, including for segmented groups; and identifying, personalising or customising goods and services for individuals. Before relying on it, confirm and record that the purpose cannot reasonably be achieved without the data in individually identifiable form.
- Applies when
- Organisations training or tuning AI recommendation, scoring or risk models on user data lawfully collected by their Singapore entity.
- Evidence to retain
- · Written applicability assessment relying on the Business Improvement Exception
- · Traceability record of the lawfulness of the source collection
- · Technical justification that the purpose cannot be met with non-identifiable data
- · Statement linking the training purpose to the organisation’s goods and services
Estimated first-time effort: 4–10 person-days (estimate, not a commitment)
Meet the four conditions of the Research Exception and assess impracticability of consent
Severity Highparas 6.1–6.4
For R&D without immediate product application, the Research Exception is available only if all of the following hold: the research purpose cannot reasonably be accomplished unless the data is in individually identifiable form; there is a clear public benefit; the results will not be used to make any decision affecting the individual; and any published results do not identify the individual. Disclosure to another party under the exception — including joint development of new AI systems — additionally requires an assessment that obtaining consent would be impracticable.
- Applies when
- Chinese AI companies conducting joint model research with Singapore universities, hospitals or corporates involving exchange of personal data.
- Evidence to retain
- · Point-by-point assessment of the four Research Exception conditions
- · Public-benefit justification and research protocol
- · Internal undertaking and technical segregation ensuring results are not used in decisions affecting individuals
- · Data-use restriction clauses in the joint research agreement
Estimated first-time effort: 4–10 person-days (estimate, not a commitment)
Give individuals an intelligible notification of how the AI feature uses their personal data
Severity Highparas 9.5–9.6
When deploying a product with AI recommendation or decision features, explain so far as practicable: the product function requiring collection and processing of personal data; a general description of the types of personal data collected and processed; how that processing is relevant to the product feature; and the specific data features most likely to influence the feature’s output. Delivery may be through pop-up notifications or publicly accessible written policies, as the organisation judges appropriate.
- Applies when
- Chinese AI products offered to individuals in Singapore with personalisation, ranking, matching or automated scoring features.
- Evidence to retain
- · AI feature explanation text including the features influencing outputs
- · Screenshots and delivery logs of the notification surface
- · Consistency check between feature-importance analysis and public statements
- · Accessibility verification of the published policy page
Estimated first-time effort: 5–12 person-days (estimate, not a commitment)
Document AI governance practices and safeguards in written policies and publish them proactively
Severity Mediumparas 10.2–10.4; PDPA s. 12
Section 12 of the PDPA requires organisations to develop policies and practices to meet their obligations. Organisations using AI systems should set out in written policies the practices and safeguards adopted to achieve fairness and reasonableness, at a level of detail proportionate to the risk of the use case — potential harm to the individual and the AI system’s degree of autonomy. Section 12(d) requires disclosure on request, but the guidelines recommend proactive publication on the organisation’s website, including a short-form version.
- Applies when
- Organisations operating AI systems in Singapore, particularly higher-autonomy use cases or those capable of materially affecting individuals.
- Evidence to retain
- · Written AI governance policy covering fairness and reasonableness safeguards
- · Record of per-use-case risk tiering and the resulting level of disclosure
- · Public-facing page and short-form policy
- · Minutes of the annual policy review
Estimated first-time effort: 4–10 person-days (estimate, not a commitment)
As an AI service provider, maintain training-data mapping, labelling and provenance records
Severity Mediumparas 11.2–11.3
Service providers that build bespoke or fully customisable AI systems and thereby process personal data as data intermediaries should, at the pre-processing stage, use data mapping and labelling to track what enters the training dataset, and maintain provenance records identifying the source of training data and how it was transformed during data preparation. These records support assessment of unauthorised access or modification of the training set, and let the deploying organisation judge whether a notifiable data breach has occurred and the scope of impact of any change to the training set.
- Applies when
- Chinese AI vendors that customise models, perform data annotation or provide managed training services for Singapore customers.
- Evidence to retain
- · Training-data mapping and labelling inventory
- · Provenance records tracing source to transformation to inclusion
- · Training-set integrity checks and change audit logs
- · Records identifying sensitive personal data and the calibrated handling applied
Estimated first-time effort: 6–15 person-days (estimate, not a commitment)