Singapore has taken a measured step toward governing the relationship between personal data and artificial intelligence, requiring organisations in banking, insurance, e-commerce, and social media to notify consumers when their information is used to train AI systems. The Personal Data Protection Commission's new rules, effective this year, establish transparency as the governing principle — but stop short of granting individuals the power to refuse. In the broader human story of technology and consent, this moment reflects a society still negotiating where individual autonomy ends and collect
Singapore mandates AI training notices, but opt-outs remain optional
Transparency without the ability to refuse is being informed before something happens to you.
Mark
So Singapore is requiring companies to tell people when they're using their data for AI training. That sounds like a win for privacy.
Mimi
It's transparency, which matters. But transparency without the ability to refuse is more like being informed before something happens to you rather than having control over it.
Mark
Can't people just opt out?
Mimi
Not necessarily. The rules don't mandate opt-outs. A bank can tell you it's training an AI on your financial data and then do it anyway. You can refuse, but then you might lose access to the AI feature entirely.
Mark
What if the data is anonymised?
Mimi
Then the company doesn't even have to tell you. No notice required. It's a clean exemption, which creates an incentive to anonymise if you can.
Mark
Is there any protection against companies being unreasonable about this?
Mimi
The PDPC says organisations can't condition a service on AI training consent unless it's genuinely necessary. But that's vague. If an insurer's AI claims assistant actually needs your medical history to work, refusing means losing the feature.
Mark
So the rules are more about disclosure than actual choice.
Mimi
Exactly. You'll know what's happening. Whether you can stop it depends on how essential the company claims the data is to the service.
The Pulse
- Consumers across Singapore's most data-intensive industries will now receive notices when their personal information feeds AI training — but notification is not the same as permission.
- The absence of a mandatory opt-out creates a quiet tension: individuals are informed, yet largely powerless to refuse without potentially losing access to the very services they depend on.
- Organisations face a new compliance burden to demonstrate that AI training is genuinely necessary to the service offered, not merely convenient — a standard whose edges remain contested.
- Anonymised data carries a clean exemption from all notification requirements, creating a structural incentive for organisations to invest in anonymisation over transparency.
- The PDPC positions itself as a backstop against coercion rather than an active guardian of consent, intervening only when the balance tips too far — leaving individuals to weigh each notice on their own.
Singapore has taken a measured step toward governing the relationship between personal data and artificial intelligence, requiring organisations in banking, insurance, e-commerce, and social media to notify consumers when their information is used to train AI systems. The Personal Data Protection Commission's new rules, effective this year, establish transparency as the governing principle — but stop short of granting individuals the power to refuse. In the broader human story of technology and consent, this moment reflects a society still negotiating where individual autonomy ends and collective digital progress begins.
Singapore has established new rules requiring organisations in banking, insurance, e-commerce, and social media to notify customers when their personal data is used to train AI systems. A bank building an AI financial advisor on your income and spending history must tell you. An insurer training a claims assistant on your medical records must do the same. An e-commerce platform repurposing your browsing behaviour for a commercial AI product must issue a fresh notice, even if earlier consent existed for related uses. The notification can appear in a privacy policy update, an app pop-up, or a website statement — but it must happen.
What the rules do not require is an opt-out. Organisations may notify and then proceed regardless of a customer's preference. The only constraint is reasonableness: a service cannot be conditioned on data consent that goes beyond what is genuinely necessary to deliver it. But that boundary is elastic. If an AI claims assistant truly cannot function without your medical history, declining consent may simply mean losing the feature — making the choice more formal than real.
One exemption stands apart cleanly: organisations using only anonymised datasets face no notification obligation at all, creating a quiet incentive to invest in anonymisation rather than transparency. For those whose AI systems require identifiable data to function, disclosure is mandatory but refusal remains largely symbolic.
The framework reflects a deliberate philosophy — transparency without veto power. Consumers receive information; organisations retain flexibility; the regulator steps in only when coercion becomes evident. As AI-powered features become standard across everyday services, the burden of weighing each notice falls on individuals navigating an increasingly narrow set of choices.
Singapore has drawn a line in the sand around artificial intelligence and personal data, but the line is thinner than many consumers might hope. Starting this year, organisations across banking, insurance, e-commerce, and social media must tell their customers when they're using personal information to train AI systems. What they don't have to do—in most cases—is let those customers say no.
The Personal Data Protection Commission has issued new rules that sound protective on the surface. A bank planning to launch an AI financial advisor, trained on your age, income, spending patterns, and service call records, must notify you. An insurer building an AI claims assistant that learns from your medical history, prescriptions, and previous claims must do the same. An e-commerce platform repurposing your purchase history and browsing behaviour to train a commercial AI product must issue a separate notice, even if you already consented to that data being used for recommendations. A social media platform teaching its AI to suggest photo captions and enhance images using your profile, photos, videos, and interaction history must inform you of the shift. The notification itself can appear anywhere—a website statement, an app pop-up, a privacy policy update—but it must happen.
What's missing from this picture is the opt-out. The PDPC has not mandated that organisations provide customers with a way to refuse AI training. This is the crucial gap. A bank or insurer can notify you and then proceed regardless of your preference. The only real constraint is reasonableness: organisations cannot condition access to a service on your agreement to let them use your data for AI training if that condition goes beyond what's necessary to deliver what you signed up for. But that bar is slippery. If you want the bank's AI financial advisor and the insurer's AI claims assistant, and those systems genuinely require your personal data to function, declining consent might mean losing the service altogether.
Toh Ming Min, a director at law firm BR Law Corporation, frames the tension clearly. The question becomes whether using your data to train the AI is truly essential to the service you purchased. If an insurer's AI claims assistant has no real value without your medical history, then your choice to opt out is hollow—you either consent or you forgo the feature. The PDPC's language around reasonableness is meant to prevent overreach, but it leaves interpretation to the organisations themselves, at least until a complaint surfaces.
There is one clean exemption: if an organisation uses only anonymised datasets to train its AI, no notice is required at all. A bank or insurer working with data stripped of identifying information can proceed silently. This creates an incentive structure worth noting. Organisations that can anonymise effectively face no notification burden. Those that cannot—because the AI genuinely needs to know who you are to serve you well—must at least tell you what's happening.
The rules reflect a particular philosophy: transparency without veto power. Consumers get information. Organisations get flexibility. The PDPC acts as referee only if the balance tips too far toward coercion. For now, the burden falls on individuals to read the notices, understand what's at stake, and decide whether the service is worth the data cost. In a landscape where AI-powered features are becoming standard, that's a narrower choice than it might appear.
Notable Quotes
If an individual declines to allow personal data to be used for AI training, the baseline service may have no real value— Toh Ming Min, director at BR Law Corporation
Want the full story?
Read the original at The Straits Times ↗
Technology