Singapore's data protection commission adopts agile, collaborative approach to enable trusted AI innovations

In January, Singapore launched its first model artificial intelligence (AI) governance framework for agentic AI. 

Within six months, the framework was updated and published alongside industry feedback and case studies, offering more granular guidance and best practices for organisations to deploy agentic AI responsibly. 

"That gives you an example of the policy cycle in this environment," says Denise Wong, Assistant Chief Executive, Data Protection and Innovation Group, Infocomm Media Development Authority (IMDA). 

Wong is also the Commissioner at the Personal Data Protection Commission (PDPC).  

She explains to GovInsider how an agile, collaborative approach helps Singapore to regulate a quickly evolving technology like AI, while keeping trust at its core. 

At IMDA, she leads the data protection and AI governance and safety policy for Singapore. 

The AI life cycle "very much starts with the data," she says.  

While PDPC operates as a standalone regulator with its own mandate, Wong says holding both roles has helped her to connect the dots between data protection and AI governance. 

As the work is as technical as it is regulatory, her role requires her to draw on the expertise across different teams at IMDA, other public agencies, as well as its overseas counterparts.  

"As it is an integrated life cycle, the different policy pieces and interventions have to cohere together." 

Agile in approach, collaborative by design 

With AI evolving so quickly, how does Singapore decide when to put its foot forward, or follow someone else's lead? 

Wong says that PDPC starts with assessing the domestic situation, by balancing the need to maintain an innovation-first approach for businesses while building trust and confidence among consumers to use the solutions.  

"Where we see gaps [in existing laws and principles] and where we see opportunities to clarify, that's what we seek to do," she says. 

An agile and collaborative approach is also necessary for tech policy, as regulators may not know what they don't know. 

"We think we can offer some guidance, but it might change and update soon after, so the voluntary guidelines are a good way for us to put something out, co-create with industry, test the reactions, and adjust as we go along," she explains.  

In a fast-moving field, this means being upfront about the limits of current knowledge, while trying to find "the right interventions at the right points."  

Bridging gaps through collaborations 

To bridge these knowledge gaps, the PDPC collaborates with the industry and government agencies. 

Before issuing its advisory guidelines on the use of personal data in generative AI, Wong says her team consulted extensively with industry and members of the public to understand their different concerns. 

This allowed the PDPC to identify the priority areas to be dealt with by regulations, providing clarity and certainty for businesses to operate in the space. 

To pool resources among typically lean data protection teams, PDPC organises Communities of Practice (CoPs) as well as shares e-learning resources, intel about data breaches, and regulatory perspectives to a database of data protection officers (DPOs). 

Wong observes that other regulators elsewhere also tap into such communities to "exchange notes" with the industry on rising data threats, say data breaches caused by ransomware and cybersecurity attacks. 

The close partnership between regulator and the industry was recently covered in GovInsider's interview with Ghana's data commissioner where he talks about how this approach supports enforcement and adapt the regulations accordingly. 

Cross-border collaboration 

"Data is a cross-border issue by its fundamental nature," she says, highlighting the need for PDPC to engage in cross-border conversations across the spectrum of policymaking, governance to enforcement.  

"Countries are navigating similar challenges when it comes to data protection, and sharing experiences across jurisdictions, both best practises and the ones that did not work, is informative and useful," she notes. 

She highlighted the AI Playbook for Small States developed in collaboration with Rwanda as an example, which compiles the best practices across Digital Forum of Small States (FOSS) on the implementation of AI and policies in their countries. 
 

"The value of the playbook comes from the diversity of national experiences rather than any single authority's model," she says. 
 
According to Wong, global cooperations for data protection tend to centre around cross-border data flows, data breaches, and enforcement. 
 
The first is legal and regulatory. Under Singapore's transfer limitation obligation, organisations must ensure that personal data sent overseas stays protected, so the regulators discuss what legal obligations apply to companies on both sides.  
 

The second is knowledge sharing and capacity building around how companies handle security and protection issues that come with moving data. 

The third is tools, where Wong points to ASEAN's focus on developing data governance capabilities among its member countries for over a decade now. 

She cites the the ASEAN Data Management Framework (DMF) and ASEAN Model Contractual Clauses (MCCs) as examples. 

While the former is a voluntary guide to help businesses to build internal data governance and compliance systems, the latter consists of ready-made contractual templates that businesses can include in legal agreements when transferring personal data across ASEAN borders. 

"These are mechanisms that allow companies to quickly and easily do their business of transferring data while minimising costs," she says. 

Singapore is part of the ASEAN working group on data as the Chair, and PDPC is also involved in the Asia-Pacific Privacy Authorities Forum and Global Privacy Assembly to shape these conversations. 

"Our ASEAN chairmanship next year is an opportunity to deepen that partnership and build upon the strong foundation developed over the last few years," she adds. 

While cultural and social context may shape how countries view data protection, there remains a "a very strong sense" that data protection principles need to be aligned globally, Wong notes. 

Sovereignty from the data regulator’s seat 

As the largest, commercial models are not built in Singapore, Wong says digital sovereignty from her perspective is governing the personal data of users and AI systems. 

“That is an aspect of making sure that we still preserve the way that Singaporeans want to live and act and transact,” she notes. 

Along these lines she also mentions the cultural dimension of sovereignty, citing SEA-LION LLM built for Southeast Asian languages.  

“It’s also about making sure that the languages, the social context, and our understanding of how we want our society to be represented can find its way into these technologies,” she explains. 

Asked about the legacy of Wong’s work, she hopes to leave behind a set of principles, tools and instruments that help companies apply data protection in a changing environment. 

She acknowledges that PDPA is still universal and have “withstood the test of time,” but they need to be interpreted to meet modern challenges across new technologies, operating models and a shifting geopolitical landscape. 

She also wants Singapore to keep plugging into international conversations. “The question of data and AI is by nature cross border,” she says.