I have built a complete, practical set of documents for Singapore SMEs outside healthcare that want to do the work themselves. The aim is to make the decisions and responsibilities visible, not just fill a folder with policies.

Get the toolkit: DM @alewyl1 on X. Access is arranged by DM.

• What personal data and AI uses to record.
• Who should own a procedure, risk or approval.
• What questions to ask an AI vendor or data processor.
• Where an agent needs limits, human approval and an audit trail.
• Which gaps your team can work through and which need tailored help.

The toolkit comes in three options.

1. Individual documents

A specific template or document for a defined task, such as starting an AI use register or documenting a breach procedure. Your team supplies the facts and adapts it to the business.

2. The full kit

The complete PDPA and AI governance document set, with an ISO/IEC 42001 crosswalk and made-up examples. The formats are DOCX, PDF and XLSX, packaged in a versioned ZIP with a change log.

3. The full kit plus a review call with Alex

The full kit with a remote review call with me to work through your questions and adaptation choices. The call's scope is agreed with you by DM; it is not a full AI governance review, PDPA programme or certification assessment.

• Personal data inventory.
• Privacy notice templates.
• Internal data protection policy.
• Consent and withdrawal procedures.
• Access and correction request procedure and log.
• Retention schedule.
• Data breach management plan using the PDPC's C.A.R.E. sequence: Contain, Assess, Report, Evaluate.
• Vendor and data intermediary checklist.
• Overseas transfer checklist.
• DNC checklist.
• DPO handover pack.
• Staff training slides.

• AI-use policy.
• AI use register.
• AI risk-tiering worksheet.
• AI impact assessment.
• Human oversight decision matrix.
• Vendor and model due-diligence questionnaire.
• Agent governance checklist covering permissions, approval gates and audit trails.
• AI incident log.

The crosswalk references clause numbers and shows where the kit's documents can help organise your evidence. It does not reproduce the standard's text or claim that completing the templates makes you certified.

Each ZIP is versioned and comes with a change log, so you can tell which edition you have and what changed. Each licence covers one organisation, for internal use only. You can edit and adapt the documents for your own organisation, but you can't resell, share or redistribute them outside it. A licence includes 12 months of updates from the date of purchase, delivered as new versioned ZIPs with a change log.

The documents do not assess your business, implement controls or make your organisation's decisions for it. The kit does not include legal advice, technical testing, certification or a compliance guarantee.

Tailoring and ongoing support are separate services. Your organisation appoints its own DPO; the kit does not appoint one or make me your DPO.

To get the toolkit, DM @alewyl1 on X with the document or problem you are interested in. Do not send personal records, credentials or confidential documents.

To use the kit, your team will need to supply the facts, adapt the documents, approve decisions and maintain the resulting procedures. I wrote and personally reviewed every document in the toolkit. That is not a sign-off of your completed programme.

AI helps with the draft. I own the sign-off.

The templates are complete, the references checked, the examples reviewed and the usage rights and update policy settled. Access is arranged by DM, and timing then depends on how quickly your team adapts the documents.

• DIY: individual documents or the full kit.
• Done with you: the full kit plus a review call, or the more detailed AI governance review.
• Done for you: the PDPA programme, with your team providing the facts and approvals.
• Ongoing upkeep: Monthly DPO support for your appointed DPO.