Organisations may collect and use publicly accessible personal data for GenAI development — including web scraping — without consent, provided the data is genuinely publicly available and its use is reasonable in the circumstances.
Data behind paywalls, login walls, or authentication is NOT automatically excluded from "publicly available." A case-by-case assessment is required considering:
Where collecting personal data from sources with digital barriers, organisations should notify the source organisation of the intended collection as a best practice.
When individuals provide personal data through products or services, organisations MUST obtain consent before using it for GenAI training — unless deemed consent or a PDPA exception applies.
General or broad notifications (e.g. "product improvement") are INSUFFICIENT. Organisations must provide clear, AI-specific notifications that explicitly state their data will be used to develop or train generative AI systems.
AI-specific notifications must include sufficient detail for meaningful consent:
Organisations must implement appropriate technical, organisational, and legal safeguards where personal data is used in GenAI development, and apply data minimisation principles.