|
SERVICES
AI governance first. PDPA foundations underneath.
AI and data governance from someone who builds the controls, not just the policies.
An AI policy should tell your team what to do when a tool asks for data, suggests a decision or tries to take an action. I help turn those questions into permissions, approval gates and responsibilities people can follow.
I work with Singapore SMEs outside healthcare. Engagements are fully remote, through video calls and shared documents.
My background is in AI governance, product and tech delivery in payments, fintech and healthtech. My services are for businesses outside the healthcare sector.
I personally review and sign off every deliverable.
|
|
|
|
| Decisions this supports |
- Which AI uses can continue, which need controls and which should stop pending review.
- Where your data protection arrangements need attention before you add more tools or vendors.
- What your appointed DPO can manage internally and where practical support would help.
|
|
| What you get |
|
1. AI governance review
My lead service, available on its own. I review your AI uses and deliver an AI use register, AI-use policy, agreed impact assessments, human oversight decisions, vendor questions and a prioritised management report. For agents, I examine permissions, approval gates and audit trails.
Allow about two weeks, depending on the scope and the information needed. An ISO/IEC 42001 readiness check can be scoped separately; it is not certification.
AI governance review: scope and deliverables →
2. PDPA programme
The foundation for handling personal data. I review the gaps, map your data flows and prepare notices, policies, procedures, checklists and a handover pack for your appointed DPO.
Allow about three to four weeks, depending on your systems, existing documents and review process.
PDPA programme: scope and deliverables →
3. Monthly DPO support
An ongoing add-on to keep an established programme working. I support your appointed DPO with the agreed requests, policy changes, vendor reviews, staff refreshers and management reporting.
You appoint your own DPO. I support them; I do not take on that role.
Monthly DPO support: scope and exclusions →
|
|
| What's not included |
|
What's not included: legal advice, legal representation, certification or a compliance guarantee, AI Verify technical testing, penetration testing or security engineering, and changes to your live systems, unless separately scoped. I don't take healthcare-sector work or deliver on site.
Each quote sets out the specific exclusions. A review identifies and documents controls; implementing technical changes is a separate responsibility.
|
|
| What I need from you |
|
I need a named contact, a clear description of the work, lists of relevant systems and vendors, existing documents and the people who can approve decisions. I work from descriptions, system lists and de-identified samples, not customer databases.
Please keep personal records, credentials and confidential documents out of your first X DM.
|
|
| What affects the timeline |
|
The main drivers are the number of systems, vendors, entities and AI uses; the state of your documents; unanswered supplier questions; and how quickly your team can review and approve the work. I agree the sequence and dependencies in the scope document.
Review rounds: a set number agreed in the quote.
|
|
| Choose a starting point |
|
If AI use is the immediate concern, start with the review. If the basic data protection processes are missing, start with the PDPA programme. Monthly DPO support is for ongoing upkeep, not a substitute for putting the foundations in place.
|
|
|
|
|
|
| ✉ Start with a DM |
|
DM @alewyl1 on X for a free intro call or remote coffee chat. I agree the scope and quote a fixed price up front; any changes are quoted before the extra work starts.
▶ DM @alewyl1 on X
|
|
|
This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer.
|
|
|
|
|
|