I help your appointed DPO keep an established data protection programme working. This is an ongoing add-on for Singapore SMEs outside healthcare, delivered fully remotely, with a fixed monthly price quoted up front.

Under the PDPA, your organisation must designate one or more individuals responsible for compliance and make at least one designated individual's business contact information public. That appointment does not remove the organisation's obligations. I do not act as your DPO or take that title for your business.

AI helps with the draft. I own the sign-off.

I personally review and sign off every deliverable before handing it to your DPO.

• How to handle a request, complaint or proposed change to a process.
• What needs updating when you add a vendor, system or data use.
• Which open actions need management attention.
• What your DPO needs to escalate, and to whom.
• What to record when assessing and responding to a suspected breach.

The scope document sets out the recurring work and its boundaries. It can cover:

• A monthly DPO check-in and shared action tracker. Decisions, owners, dependencies and unresolved questions in one place.
• Access and correction support. Help with the procedure, request log and draft responses for your organisation to approve.
• Policy and notice upkeep. Updates reflecting the business and process changes in scope.
• Vendor and data intermediary checks. Due diligence questions, evidence gaps and contract points to raise with your lawyer.
• Staff refreshers and breach drills. Materials and exercises on the schedule agreed in the scope.
• Breach support. Help with C.A.R.E., the assessment record and notification drafts for your organisation to approve and submit.
• A quarterly management report. Work completed, incidents and requests reviewed, outstanding risks and decisions needed.

I support the work; your DPO and management retain the decisions and approvals. Your own breach plan must lead a response, rather than depend on receiving a reply from me.

• Acting as, being named as or replacing your DPO.
• Legal advice, legal representation or submitting regulatory notifications on your behalf.
• An emergency hotline or a substitute for your own incident-response arrangements.
• Forensic investigation, penetration testing, security engineering or administering your systems.
• Holding your customer database or making changes to live systems.
• Rebuilding the whole PDPA programme, a new AI governance review or a major new project. These need a separate scope and quote.
• Healthcare-sector work or on-site delivery.

I need an appointed DPO, a management approver, current policies and registers, and an agreed tracker and sharing arrangement. Your team needs to flag proposed changes, provide the relevant facts and approve responses and actions.

I work from descriptions, system lists and de-identified samples. Client personal data does not go into my AI tools.

If the foundations need substantial work, I will identify that in scoping rather than treat monthly upkeep as a replacement for the PDPA programme.

This is a monthly arrangement. The sequence of work depends on the requests and changes raised, the evidence needed, supplier answers, the condition of existing documents and decisions from your team.

I agree the support arrangements and exclusions in writing. The quote does not replace your organisation's breach plan or the assessment and notification requirements explained in the breach FAQ.

Review rounds: a set number agreed in the quote.