Working with me

• Who does the work and signs it off?
• Does this replace a lawyer?
• Is it fully remote?
• Who is outside your scope?

Scope

• What does the PDPA programme include?
• What does DPO support exclude?
• Can the AI review be booked on its own?
• What must our team provide and approve?

PDPA basics

• Does the PDPA apply to a very small business?
• Is a website privacy notice enough?
• How do the Do Not Call rules affect our marketing?
• What should we check before transferring data overseas?

DPO

• Must we appoint our own DPO?
• Can an existing employee be the DPO?
• Which decisions stay with us?
• How does your support help our DPO?

Breaches

• What do we do when we suspect a breach?
• Who decides whether it must be notified?
• Which deadlines apply, and when do they start?
• What help is there outside your working hours?

AI governance

• Which AI uses go in the register?
• How do you decide where human approval belongs?
• Does the review include AI Verify testing?
• How is ISO/IEC 42001 readiness different from certification?

Data handling

• Do you need customer records or system access?
• What goes into your AI drafting workflow?
• How are confidentiality and secure sharing agreed?
• What happens to working files after handover?

Pricing and process

• What happens in the free intro call?
• What decides the fixed quote?
• How are scope changes and revisions agreed?
• How long does each engagement take?

Toolkit

• Who is it for?
• What files does it contain?
• How do versions, updates and usage rights work?
• When should we get tailored support instead?

Who does the work and signs it off?

I do the work and personally review and sign off every deliverable; I do not hand it to junior staff. AI helps with the draft. I own the sign-off. How I work explains the review and acceptance process.

↑ Contents

Does this replace a lawyer?

No: I provide practical compliance support, not legal advice or representation. For legal advice, use a Singapore-qualified lawyer. The service scopes set out what I do and do not cover.

↑ Contents

Is it fully remote?

Yes, I deliver the work through video calls and shared documents. The free intro call or coffee chat is remote too, and the scope document records how we will share material and review the work.

↑ Contents

Who is outside your scope?

My services are for Singapore SMEs outside healthcare, so I do not take healthcare-sector engagements through this site. I also do not offer on-site delivery, legal representation or certification. Services explains the boundaries before you enquire.

↑ Contents

What does the PDPA programme include?

The PDPA programme includes a gap review, data inventory and flow map, notices, internal policy, request procedures, retention schedule, vendor and transfer checklists, breach plan, DNC process, staff briefing and DPO handover pack. I also include a DPIA template and basic staff AI-use rules; detailed AI assessments and agent governance belong in the separate AI review. The quote confirms the entities, processes and documents covered.

↑ Contents

What does DPO support exclude?

Monthly DPO support does not include acting as your DPO, legal representation, submitting regulatory notifications for you, forensic investigation or running your systems. It is not an emergency hotline or a substitute for your breach plan. A full programme rebuild or new AI governance review needs a separate scope and quote.

↑ Contents

Can the AI review be booked on its own?

Yes, the AI governance review is my lead service and can be booked independently. I agree the AI uses, deliverables and dependencies with you, including any data protection gaps that need separate attention.

↑ Contents

What must our team provide and approve?

I need a named contact, process owners, relevant system and vendor lists, existing documents and descriptions or de-identified samples. Your team confirms the facts, makes the business and risk decisions, approves the documents and accepts the deliverables. How I work separates those responsibilities from my personal review and sign-off.

↑ Contents

Does the PDPA apply to a very small business?

Yes. The PDPC states that the PDPA applies to all organisations in Singapore that handle personal data, regardless of size. Public agencies, and individuals acting in a personal or domestic capacity, are outside it.

I scope the PDPA programme around the information your business handles and its processes, not headcount alone.

↑ Contents

Is a website privacy notice enough?

No, a notice is only part of the work: the PDPA also covers matters such as consent, protection, retention, accountability, access and correction. A notice does not establish that staff follow the processes it describes. The PDPA programme connects the documents to responsibilities, procedures and evidence.

↑ Contents

How do the Do Not Call rules affect our marketing?

Before sending specified marketing messages to Singapore telephone numbers, you must hold valid confirmation that the number is not on the DNC Register unless you have clear and unambiguous consent in evidential form. The messages must also include clear, accurate sender identification and contact information. I help document the checks and records through the PDPA programme, without assuming one campaign's arrangements cover every use.

↑ Contents

What should we check before transferring data overseas?

The PDPA's transfer limitation requires a comparable standard of protection for personal data transferred overseas. I review the recipient, destination, purpose, access, supplier information and evidence of safeguards, and flag contractual questions for your lawyer. The PDPA programme includes an overseas transfer checklist; a supplier's reassurance is not the same as a completed review.

↑ Contents

Must we appoint our own DPO?

Yes: under the PDPA, your organisation must designate one or more individuals responsible for compliance and make at least one designated individual's business contact information public. Appointing a DPO does not remove the organisation's obligations. My DPO support supports the person you appoint; I do not act as your DPO.

↑ Contents

Can an existing employee be the DPO?

Yes, the DPO can be an employee; the role can also be held externally. You choose and appoint the person, while I provide the practical help agreed under Monthly DPO support. I help clarify their responsibilities and escalation routes, rather than take the appointment myself.

↑ Contents

Which decisions stay with us?

Your organisation retains its data protection obligations, and your DPO and management retain the decisions and approvals. That includes approving policies, accepting risks, selecting safeguards and deciding and submitting breach notifications. I prepare evidence, recommendations and drafts under DPO support; I do not approve the business's decisions for it.

↑ Contents

How does your support help our DPO?

I help turn the work into a maintained tracker, usable procedures and reviewed drafts, rather than leave your DPO to interpret a folder of templates alone. The agreed monthly scope can include request handling, policy upkeep, vendor questions, staff refreshers, breach drills and quarterly management reporting. Your DPO remains the owner of the role.

↑ Contents

What do we do when we suspect a breach?

Tell your appointed DPO and activate your own breach plan, containing further exposure and preserving evidence for the assessment. The PDPC's C.A.R.E. sequence is Contain, Assess, Report, Evaluate. Where agreed in DPO support, I help with the assessment record and draft notifications; do not wait for my reply to begin your response.

↑ Contents

Who decides whether it must be notified?

Your organisation makes and records the decision, led by your DPO with management and legal advice where needed. A breach is notifiable if it is likely to cause significant harm to affected individuals or is of significant scale, meaning 500 or more affected individuals. I can help organise the evidence and decision record under DPO support, but do not take over that decision or submit the notifications for you.

↑ Contents

Which deadlines apply, and when do they start?

The PDPA requires assessment in a reasonable and expeditious manner; PDPC's guidance expects the assessment within 30 calendar days of credible grounds to believe a breach has occurred. If a breach is notifiable, you must tell the PDPC as soon as practicable, and no later than 3 calendar days after you assess that it is notifiable. A breach is notifiable if it is likely to cause significant harm to the people affected, or affects 500 or more people. Where there is likely significant harm, you must also tell the affected people as soon as practicable. Do not treat the assessment guidance as a waiting period. I help your DPO record the triggers and decisions through the agreed DPO support.

↑ Contents

What help is there outside your working hours?

Help depends on what is agreed in your DPO support scope. Your own DPO and breach plan lead the response, and the arrangement is not an emergency hotline. For legal advice on a breach, use a Singapore-qualified lawyer.

↑ Contents

Which AI uses go in the register?

I include the uses agreed in scope, including staff assistants, customer-facing tools, scoring or recommendation features, AI built into vendor software and agents that can use other systems. Each entry records the purpose, owner, information handled, permissions, risks and human checks, rather than just the product name. The AI governance review also identifies review triggers when a use or its permissions change.

For agents, I also use IMDA's Model AI Governance Framework for Agentic AI (2026) as a reference for setting limits, human accountability and technical controls. It is voluntary guidance, not law.

↑ Contents

How do you decide where human approval belongs?

I consider potential harm, who may be affected, personal data, autonomy and how easily an action can be reversed. I then recommend where someone must approve before an action, monitor it or intervene, using the Model AI Governance Framework's human-in-the-loop, human-over-the-loop and human-out-of-the-loop terms where useful. The AI governance review records the decision, owner and proposed control; your organisation approves the arrangement.

↑ Contents

Does the review include AI Verify testing?

The AI governance review maps to AI Verify's principles and process checks. Running technical tests is not included unless separately scoped. I distinguish a document or process finding from a test result, rather than imply that the review has tested a model.

↑ Contents

How is ISO/IEC 42001 readiness different from certification?

ISO/IEC 42001:2023 is the international standard for AI management systems, and readiness work identifies gaps in the controls, documents and evidence against it. Certification is voluntary and carried out by an independent certification body, not ISO. An optional readiness check within the AI governance review is not certification or a promise of it.

↑ Contents

Do you need customer records or system access?

I start with descriptions, system lists and made-up or de-identified samples, not copies of customer databases. Any access needed for the agreed work is scoped in advance, kept to the minimum and used in your systems where possible. How I work explains the sharing arrangements, and client personal data does not go into my AI tools.

↑ Contents

What goes into your AI drafting workflow?

I use templates, process descriptions, system lists and made-up or de-identified examples; I do not put client personal data into AI tools. If a sample cannot be safely de-identified, I use a description or made-up example instead. I check, correct and personally sign off the drafts, as explained in How I work.

↑ Contents

How are confidentiality and secure sharing agreed?

I agree confidentiality, the sharing method, access and file handling before you share engagement material, and I am happy to sign an NDA. Where possible, I work in your systems to avoid extra copies. How I work covers engagement material; the website privacy notice covers this site and contact through X.

↑ Contents

What happens to working files after handover?

I return or delete working files in line with the handling arrangements we agreed, and confirm this in writing. The scope and handover process records the final deliverables, owners and open actions so your team can continue the work. How long this website keeps its own server logs is set out in the site privacy notice.

↑ Contents

What happens in the free intro call?

I ask what your business does, what prompted the enquiry, what you already have and what decision or outcome you need. We discuss the likely scope and whether one of my services fits; this is not a full assessment or legal consultation. To arrange the remote call or coffee chat, DM @alewyl1 on X; How I work explains what follows.

↑ Contents

What decides the fixed quote?

I consider organisation size, entities, systems, vendors, AI uses, existing documents, languages, deliverables, review requirements and timeline urgency. I quote a fixed price up front, after the intro conversation, before any work starts. How pricing is decided explains the factors without suggesting that every organisation needs the same scope.

↑ Contents

How are scope changes and revisions agreed?

A set number of review rounds is agreed in the quote. If you need extra rounds or a change to the scope, I explain the effect on deliverables and timing, then quote for the change before doing the extra work. You approve it, defer it or keep the original scope, as set out in How I work.

↑ Contents

How long does each engagement take?

Allow about two weeks for the AI governance review and about three to four weeks for the PDPA programme; DPO support runs monthly. The drivers include the systems, vendors and AI uses in scope, existing documents, supplier answers and your team's reviews and approvals. I confirm dependencies in the scope document, and each service page explains what affects its timeline.

↑ Contents

Who is it for?

The Singapore AI Governance & PDPA Toolkit is for Singapore SMEs outside healthcare that have someone to adapt the documents and own the follow-up work. It is a DIY starting point, not a completed review of your business. It is complete and available now. Get the toolkit: DM @alewyl1 on X. DM me on X to buy. Once payment is confirmed, I'll email you the toolkit ZIP.

↑ Contents

What files does it contain?

The formats are DOCX, PDF and XLSX, covering PDPA procedures and registers, AI policies and assessments, agent governance, staff slides and an ISO/IEC 42001 crosswalk. The files come packaged in a versioned ZIP with a change log. The toolkit page lists the full contents, and the previews use made-up data.

↑ Contents

How do versions, updates and usage rights work?

Each ZIP carries a version number and a change log. Each licence covers one organisation, for internal use only. You can edit and adapt the documents for your own organisation, but you can't resell, share or redistribute them outside it. A licence includes 12 months of updates from the date of purchase, delivered as new versioned ZIPs with a change log. The toolkit page has the details.

↑ Contents

When should we get tailored support instead?

Choose tailored support when you need someone to investigate the facts, assess risks or turn the templates into agreed business procedures. The AI governance review covers AI uses and controls, while the PDPA programme builds the broader foundation. Monthly DPO support helps your appointed DPO maintain that work; the kit-plus-call option offers a narrower discussion, not a full engagement.

↑ Contents