Singapore: privacy laws and AI data licensing

Which consent route covers reusing Singapore records for AI work?#

Consent is the default under the PDPA, and any other route has to fit one of the Act's specific alternatives. For records a business already holds, four routes come up most often: deemed consent by notification, the legitimate interests exception, the business improvement exception and the research exception. Each has its own conditions, and none of them is a general permission to hand records to an outside company.

Deemed consent by notification under section 15A applies when people were notified of the purpose and have not taken action to opt out. The organisation must assess the purpose first and cannot rely on it where the use is likely to have an adverse effect on the individual. The legitimate interests exception likewise requires an assessment of adverse effects and a balancing test showing the organisation's legitimate interests outweigh them.

The business improvement exception covers using personal data, without fresh consent, to improve or develop goods, services or business methods. The PDPC's AI guidelines say it can apply when a business develops AI to enhance an existing product or service. Two tests apply: the purpose cannot reasonably be achieved without identifiable data, and a reasonable person would consider the use appropriate. Sharing under it is limited to related corporations in the same group, subject to conditions.

The research exception can cover commercial research to develop AI with a clear public benefit, such as precision medicine. It also requires that identifiable data is necessary, that results are not used to make decisions about the individual and that published results do not identify anyone.

Do anonymised records avoid these rules?#

Yes, if the anonymisation holds: the PDPC treats anonymised data as no longer personal data for PDPA purposes, and treats anonymisation as a risk-based process that combines technique with safeguards against re-identification.

For AI development, the PDPC's guidelines ask organisations to use only the attributes needed to train and test, and encourage pseudonymising or de-identifying personal data where possible as a basic control. The Commission also recognises trade-offs with anonymised data, such as effects on model accuracy, so the choice is documented rather than assumed.

What does the Transfer Limitation Obligation require when records leave Singapore?#

Personal data can be transferred out of Singapore only under the requirements in the Personal Data Protection Regulations, which aim for protection comparable to the PDPA. The transferring organisation must take appropriate steps to ensure the recipient is bound by legally enforceable obligations providing at least that standard of protection.

The Regulations list the forms those obligations can take. A contract qualifies if it requires the recipient to provide a comparable standard of protection and names the countries and territories the data may be transferred to. Binding corporate rules are a separate route within a group and must name the recipients they cover. Properly anonymised data is outside the obligation, because it is no longer personal data.

• 1Confirm whether any personal data remains after preparation
• 2Identify the recipient and every country where the data will be stored or accessed
• 3Put a contract or binding corporate rules in place that require comparable protection
• 4Keep the transfer assessment with the deal file

How does Singapore's computational data analysis exception affect AI training?#

Section 244 of the Copyright Act 2021 lets a person copy a work or recording for computational data analysis, or to prepare it for that analysis, without the owner's permission, if the conditions are met. The user needs lawful access to the material, which the Ministry of Law described as accessing it without, for example, circumventing paywalls. The copy cannot be used for any other purpose and may be supplied to others only within the section's limits. The Act took effect on 21 November 2021.

Section 187 makes a contract term void to the extent it excludes or restricts this permitted use. Two limits matter for anyone licensing records. The exception concerns copyright only, so it does not satisfy the PDPA where records contain personal data. And it does not give an AI developer lawful access to a company's internal records; access to non-public business data still comes from an agreement with the company that holds it.

SourceX can consider companies in Singapore when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.