I help Singapore SMEs outside healthcare understand their PDPA gaps and put working documents and processes in place. The aim is a programme your team can use, with clear responsibilities and a practical handover to your appointed DPO.

All work is remote. Allow about three to four weeks, depending on the scope and review process, with a fixed price agreed before work starts.

AI helps with the draft. I own the sign-off.

I personally review and sign off every deliverable.

• What personal data you need, why you need it and where it goes.
• Which gaps need attention first and who owns the action.
• What staff should do when someone withdraws consent, asks for access or correction, or raises a complaint.
• What to check before appointing a vendor or transferring data overseas.
• How your team escalates a suspected breach and records its decisions.
• What management and your appointed DPO need to approve and maintain.

• Gap review and action plan. Findings against the relevant PDPA obligations, with priorities, owners and evidence needed to close each gap.
• Personal data inventory and data flow map. Information categories, purposes, systems, access, recipients, vendors and overseas flows.
• Privacy notices. Notices tailored to the groups and collection points agreed in scope, rather than a single statement copied everywhere.
• Internal data protection policy. Responsibilities and staff rules for everyday handling of personal data.
• Consent and withdrawal procedures. How consent is obtained and recorded, and how withdrawal requests and their likely consequences are handled.
• Access and correction procedure and log. Steps, ownership, request records and draft response templates.
• Retention schedule. Documented retention decisions, review triggers, owners and disposal steps.
• Vendor and data intermediary checklist. Due diligence questions and contract points to raise with suppliers and your lawyer.
• Overseas transfer checklist. Destinations, recipients, safeguards and evidence to review before a transfer.
• Data breach management plan. The PDPC's C.A.R.E. sequence: Contain, Assess, Report, Evaluate, with roles, a decision log and notification templates.
• DNC checklist and process. Register checks, consent evidence, sender details and campaign records.
• DPIA template. A starting point for data protection impact assessments. The PDPC recommends DPIAs as a practice; they are not a stand-alone statutory duty.
• Basic AI-use policy. Staff rules for approved tools, keeping personal data out of AI tools and checking drafts. A detailed AI register, impact assessments and agent review belong in the separate AI governance review.
• Remote staff briefing and slides. A walkthrough of the agreed procedures and escalation routes.
• DPO handover pack. Final documents, responsibilities, outstanding actions and a maintenance checklist.

I work through consent, purpose limitation, notification, access and correction, accuracy, protection, retention, overseas transfers, accountability and breach notification. I also review the DNC process where marketing to Singapore telephone numbers is in scope.

Under the PDPA, your organisation must designate one or more individuals responsible for compliance and make at least one designated individual's business contact information public. Appointing a DPO does not remove the organisation's obligations.

I check how purposes are communicated, how consent is handled where required, and how staff put policies into practice. The programme also covers complaints handling and communicating the policies to staff.

If a breach is notifiable, you must tell the PDPC as soon as practicable, and no later than 3 calendar days after you assess that it is notifiable. A breach is notifiable if it is likely to cause significant harm to the people affected, or affects 500 or more people. Where there is likely significant harm, you must also tell the affected people as soon as practicable.

For a breach, the plan addresses significant harm and significant scale, including the threshold of 500 or more affected individuals. It separates the assessment from the decision about notifying the PDPC and affected individuals; the FAQ explains the different triggers and deadlines.

For specified marketing messages to Singapore telephone numbers, the DNC process covers a valid, recent register check unless there is clear and unambiguous consent in evidential form. It also covers clear, accurate sender identification and contact information.

• Acting as your DPO. You appoint your own DPO; I prepare the handover and can support them separately.
• Legal advice, legal contract drafting, representation or a guarantee of compliance.
• Forensic investigation, penetration testing, security engineering or implementing changes in live systems.
• A detailed AI governance review or ISO/IEC 42001 readiness check unless separately scoped.
• Ongoing document upkeep after handover, unless agreed through Monthly DPO support.
• Healthcare-sector work or on-site delivery.

I need a named contact, your appointed DPO, management approvers and the people who understand your processes. I also need lists of relevant systems and vendors, existing notices and policies, relevant contract information and descriptions of how personal data moves through the business.

Your team confirms the facts, makes the business decisions and approves the final documents. I do not need your customer database: descriptions and de-identified samples are the starting point, and client personal data stays out of my AI drafting workflow.

The programme usually takes about three to four weeks. The drivers are the number of systems, vendors, entities, collection points and languages; the state of your documents; unresolved supplier questions; and how quickly your team reviews drafts and makes decisions.

I agree the sequence, dependencies and review rounds in the quote. If new work changes the scope, I quote for it before proceeding.

Review rounds: a set number agreed in the quote.