Learn GDPR with Phoebe

Two tracks on EU privacy, for an organisation that is not in the EU

The GDPR does not stop at Europe's border. Sell to, or track, people in the EU and it reaches your Singapore company - with fines up to 4% of global turnover. A leader track teaches what the GDPR requires and when it applies to you, mapped to the PDPA you already know. A practitioner track makes it operational: pick a lawful basis, write a compliant notice, handle a data-subject request, move data across borders, and answer a breach in 72 hours. The running case is Lumina, a Singapore SaaS with EU customers.

2tracks
14sessions
1live GDPR checker
6lawful bases
⚖️ Educational, not legal advice. The GDPR is enforced by EU supervisory authorities and interpreted through case law - verify against the Regulation text and your data protection authority, and get proper advice before acting.

The leader track 🤝 · for C-level, managers & DPOs · 6 x 45 min · no jargon

What the GDPR requires, when it reaches a non-EU company, and how each piece maps to the PDPA you already run - each session ends with questions to ask your DPO and legal counsel.

🌍Leader 1 · easy

Why GDPR reaches a Singapore company

The Article 3 territorial-scope test - offer to or monitor people in the EU and you are in scope, no EU office required. And how that differs from the PDPA.

▶ Leaders start here 📜Leader 2 · easy

Seven principles, six lawful bases

The principles every processing must satisfy, and the six lawful bases - why consent is only one of them, unlike the PDPA's consent-first model.

Art 5-6 🙋Leader 3 · medium

Data-subject rights vs PDPA

Access, erasure, portability, objection and more - a broader set than the PDPA's access + correction. Which rights have no PDPA equivalent.

Art 12-22 🔗Leader 4 · medium

Controller, processor, DPO, DPIA

Who is responsible for what, when a DPO is mandatory (narrower than the PDPA), and when a high-risk project needs an impact assessment.

Accountability 🚨Leader 5 · deciding

Breach (72h) + penalties

The 72-hour clock, the two-tier fines (up to 4% of global turnover), and the billion-euro cases - versus the PDPA's own regime.

Real fines 🌐Leader 6 · deciding

International transfers

Adequacy, Standard Contractual Clauses, and the post-Schrems II duty to assess the destination - the rules that govern moving EU data to Singapore.

Chapter V

The practitioner track 🛠️ · for DPOs, marketers & ops · 8 x 45 min · Lumina case

The operational half: how to comply in practice. Every session moves Lumina, a Singapore SaaS serving EU customers, one step closer to defensible GDPR compliance.

🧭Practitioner 1 · easy

Does GDPR apply? the checker

A live Article 3 checker - answer three questions and see whether the GDPR reaches you, which article, and what to do next.

▶ Practitioners start here ⚖️Practitioner 2 · easy

Picking a lawful basis

Choose and document one of the six bases - consent vs legitimate interest, the consent standard, and the balancing test (LIA).

Lumina picks a basis 📄Practitioner 3 · medium

Privacy notices + transparency

What Articles 13 and 14 require you to tell people, when, and how - the notice that turns "we process data" into informed consent.

Lumina writes a notice 🙋Practitioner 4 · medium

Handling a DSAR

A data-subject access request end to end - verify, locate, respond within one month, and the permitted extensions and refusals.

Lumina answers a request 🗂️Practitioner 5 · hands-on

Records + DPIA

The Article 30 record of processing (and why the small-org exemption rarely helps), and when a project needs an impact assessment.

Lumina documents 🌐Practitioner 6 · hands-on

Transfers in practice

Put Standard Contractual Clauses in place and run a transfer impact assessment - the real work of moving EU data to a Singapore server.

Lumina moves data 🚨Practitioner 7 · hardest

Breach response (72 hours)

The clock starts when you become aware. Assess the risk, notify the authority within 72 hours, and tell individuals when the risk is high.

When it goes wrong 🏛️Practitioner 8 · hardest

The GDPR program + PDPA harmony

Assemble the artifacts into one programme - and run GDPR and PDPA together so one operation satisfies both. Lumina graduates.

Dual compliance
easy - everyone medium hands-on / deciding hardest

The running case + the live checker 🧭

Lumina, and a GDPR checker you can poke

The practitioner track follows Lumina, a fictional Singapore SaaS with EU customers - the exact situation where the GDPR reaches a company that has never set foot in Europe. Session b1 gives you a live checker: answer the three Article 3 questions and it tells you whether the GDPR applies and which limb catches you; a second mode suggests which of the six lawful bases fits a purpose. It encodes Articles 3 and 6 (educational, not legal advice).

Choose your path 🗺️

Two doors, one course. Leaders get the law and the risk; practitioners get the moves that make an EU-facing operation defensible.

🤝 Leader (the law + the risk) a1→ a2→ a3→ a4→ a5→ a6
🛠️ Practitioner (comply in practice) b1→ b2→ b3→ b4→ b5→ b6→ b7→ b8
🌱 Just tell me if it applies a1→ b1
🚀 Already know PDPA? (the deltas) a1→ a3→ a6→ b8

The knowledge map 🧠

Both tracks at a glance - hover a session to spotlight its concepts, click any node to jump in.

The whole course on one sheet 📐

Seven modules: both tracks, the Article 3 test that decides whether the GDPR reaches you at all, the three lists everything else sits on, the practitioner ladder, who carries the legal duty, where Singapore teams get caught, and the 72-hour breach clock.

Download for print (2800px) Every word here is real selectable text, so it stays sharp however far you zoom.

learn GDPR
with phoebe

EU privacy, for an organisation that is not in the EU
14 sessions - two tracks - one running company, Lumina - mapped to the PDPA you already run

SEC-01 TWO TRACKS

LEADER TRACK
what it requires, and when it reaches you

  1. a1Why GDPR reaches a Singapore company
  2. a2Seven principles, six lawful bases
  3. a3Data-subject rights vs the PDPA
  4. a4Controller, processor, DPO, DPIA
  5. a5Breach and penalties
  6. a6International transfers

PRACTITIONER TRACK
make it operational

  1. b1Does GDPR apply? Run the checker
  2. b2Picking a lawful basis
  3. b3Privacy notices and transparency
  4. b4Handling a DSAR end to end
  5. b5Records and the DPIA
  6. b6Transfers in practice
  7. b7Breach response against the clock
  8. b8The GDPR program + PDPA harmony
14sessions
6leader
8practitioner
45min each

SEC-02 DOES IT REACH YOU?

Article 3 is short, and it is the whole applicability question. Any one of three triggers is enough, and two of them catch companies with no EU presence at all.
3(1)
EstablishmentYou have an EU office or branch.
3(2)(a)
OfferingYou offer goods or services to people in the EU.
3(2)(b)
MonitoringYou track the behaviour of people in the EU.
No EU office required. That is exactly how a Singapore business gets pulled in.
The two numbers that focus the mind

72 hours to tell a regulator after you become aware of a breach. 4 percent of global turnover as the ceiling on a fine. Everything else on this sheet is work done so those two numbers never arrive as a surprise.

SEC-03 WHO CARRIES THE DUTY

Every vendor you sign either takes instructions from you or gives them. That one distinction decides who answers when something goes wrong.
role
ControllerDecides why and how data is processed. Carries the duty.
role
ProcessorActs on the controller's instructions, under contract.
when
DPOA data protection officer, required in defined cases rather than always.
when
DPIAArticle 35. The pre-flight check before anything high-risk.
Why roles come before paperwork

Place your own company first, then each vendor. The contract you owe, and the question you must answer in a breach, both follow from that placement.

SEC-04 THE THREE LISTS EVERYTHING ELSE SITS ON

7 principlesArt 5

  • 1 lawful, fair, transparent
  • 2 purpose limitation
  • 3 data minimisation
  • 4 accuracy
  • 5 storage limitation
  • 6 integrity + confidentiality
  • 7 accountability

6 lawful basesArt 6

  • (a) consent
  • (b) contract
  • (c) legal obligation
  • (d) vital interests
  • (e) public task
  • (f) legitimate interests
  • you need at least ONE

8 rightsArt 12-22

  • be informed (13/14)
  • access (15)
  • rectification (16)
  • erasure (17)
  • restriction (18)
  • portability (20)
  • object (21)
  • automated decisions (22)
Accountability is the one that changes everything: Article 5(2) says it is not enough to comply, you must be able to demonstrate that you comply.
The mindset shift for a PDPA-trained leader

The six bases are co-equal doors, not a hierarchy with consent at the top. Consent is one door of six, and often the flimsiest. For most business uses contract or legitimate interests fits better, and does not evaporate when someone changes their mind.

Most of the eight rights have no equivalent under the PDPA. If your process only does access and correction, it was built for the wrong regime.

SEC-05 THE PRACTITIONER LADDER

1
applicability run Article 3 in thirty seconds
b1
2
lawful basis match a basis to each purpose, and document it
b2
3
notices Articles 13 and 14, in language people can read
b3
4
DSAR intake, identity, search, respond, in one month
b4
5
records, DPIA Article 30 inventory, Article 35 pre-flight
b5
6
transfers SCCs, then the assessment on Singapore
b6
7
breach contain, assess, notify against the clock
b7
8
the programme seven capabilities become one standing operation
b8
How to climb it

Rung 1 gates everything above it. Rung 5 is where the paperwork becomes an asset: the record of processing is the inventory every other obligation reads from.

SEC-06 WHERE SINGAPORE TEAMS GET CAUGHT

"It is Europe's problem"The most common mistake a Singapore leader makes. Ask: do we offer to, or track, anyone in the EU?
Consent for everythingThe weakest and most fragile of the six doors, chosen by default. Ask: would contract or legitimate interests fit this purpose better?
A notice that hides the basisIt lists cookies, but not the lawful basis or the retention period. Ask: could a reader tell why we hold this, and for how long?
Access and correction onlyA request process built for the PDPA meets maybe two of eight rights. Ask: what happens when someone asks for erasure or portability?
No adequacy decisionSingapore has none, so every transfer out needs a mechanism, and since Schrems II an assessment too. Ask: which mechanism covers this flow?
Starting the clock lateThe 72 hours run from when you become aware, not from when the investigation finishes. Ask: who can start the clock, at 2am?
The insight that makes running both regimes manageable

On almost every point one regime is stricter than the other. Build to the stricter of the two and one operation satisfies both the GDPR and the PDPA, which is the whole argument of session b8.

SEC-07 THE 72-HOUR CLOCK

The two numbers, plainly
notify the regulator within 72 hours maximum fine 4% of global turnover respond to a DSAR within one month
1
CONTAINstop it spreading before anything else
2
ASSESSis this notifiable at all, and to whom
3
NOTIFY THE AUTHORITYwithin 72 hours of becoming aware
4
NOTIFY INDIVIDUALSwhere the risk to them is high
5
LEARNthe record that proves you handled it
learn GDPR with phoebe 3 triggers - 7 principles - 6 bases - 8 rights - 72 hours - 4% by Phoebe Fu