IMDA and PDPC publish guides relating to generative AI, digital twin technology, and privacy-enhancing technologies

27 August 2026

On 20 July 2026, the Info-communications Media Development Authority (“IMDA”) and the Personal Data Protection Commission (“PDPC”) announced the launch of the following publications to support businesses in the data-driven economy:

  • An updated Guide to Data Protection Practices for ICT Systems (“DPP Guide”)
  • New Advisory Guidelines on Use of Personal Data in Generative AI (“Advisory Guidelines”)
  • New Transparency Guidelines for Generative AI Chatbots (“Transparency Guidelines”)
  • A new Digital Twin for Enterprises Playbook (“Playbook”)
  • A new Guide on Federated Learning
  • An updated Guide on Synthetic Data Generation

Updated Guide to Data Protection Practices for ICT Systems

The DPP Guide is a compilation of data protection practices from past advisory guidelines and guides released by PDPC, and incorporates lessons learnt from past data breach cases that should be adopted by organisations in their infocomm technology (ICT) policies, systems, and processes to safeguard the personal data under their care.

The DPP Guide sets out data protection best practices across five areas:
(i) identifying and managing organisational assets; (ii) securing and protecting systems and assets; (iii) keeping software up to date; (iv) backing up essential data; and (v) detecting, responding to, and recovering from cyber incidents.

The DPP Guide has been updated with revised categorisations of best practices, illustrative case studies based on lessons learnt from past data breaches, and new practices for the adoption and use of artificial intelligence (“AI”) systems.

New Advisory Guidelines on Use of Personal Data in Generative AI and Transparency Guidelines for Generative AI Chatbots

PDPC’s new Advisory Guidelines clarify how data can be collected and used to develop generative AI models, allocate data protection responsibilities across the AI lifecycle (including the protection of new data sources such as end-user prompts), and recommend how individuals’ requests on personal data should be handled. Where user data is used for generative AI model development, and exceptions to consent do not apply, organisations must obtain consent by providing “AI-Specific Notifications” that articulate the purpose of use, what data will be used and how it will be used, and how individuals can decline or withdraw consent. For more on the new Advisory Guidelines, please refer to our article titled “PDPC issues Advisory Guidelines on Use of Personal Data in Generative AI”.

IMDA’s Transparency Guidelines complement the Advisory Guidelines by helping consumers better understand how generative AI chatbot deployers use their data, while also providing broader consumer-facing transparency on the chatbots they interact with. The Guidelines encourage chatbot deployers to provide relevant, accessible, and timely information through “Chatbot Info Cards”, covering a chatbot’s capabilities and limitations, safety and reliability practices, data use and protection, and reporting channels. This facilitates the safe and responsible use of generative AI chatbots by enabling consumers to make more informed decisions, including what types of data they choose to share with such services.

New Digital Twin for Enterprises Playbook

Digital twins allow businesses to monitor and optimise operations, anticipate problems before they occur, and safely test changes in a virtual environment before implementing them in physical operations. IMDA’s Playbook guides businesses through identifying the right use cases for digital twin technology, assessing data readiness, establishing safeguards, and implementing projects that deliver business value.

New Guide on Federated Learning and updated Guide on Synthetic Data Generation

For businesses that use data to drive business outcomes, the adoption of privacy-enhancing technologies can serve as a competitive differentiator by enabling greater data collaboration while addressing privacy risks and circumventing commercial sensitivities. PDPC’s new Guide on Federated Learning aims to equip organisations with practical knowledge to assess whether federated learning suits their context and how to implement it responsibly. PDPC has also updated the Guide on Synthetic Data Generation to reflect the latest use cases, best practices, and emerging developments in synthetic data adoption.

Reference materials

The following materials are available on the PDPC website www.pdpc.gov.sg: