Learn with Phoebe · the governance on-ramp

Data & AI Governance, from scratch

Every headline about a data breach, a consent banner, a cookie pop-up, or the EU AI Act uses words most people were never taught. This is the plain-English door into all of it - no law degree, no acronym soup. In six short sessions you will learn what personal data is, what governance means and why it matters, the big regimes at a glance (PDPA, GDPR, the EU AI Act), what a breach is, and what a DPO actually does. It is the foundation the four deeper governance courses build on - start here, then go as deep as you need.

6short sessions
1"which regime touches me?" chooser
3regimes mapped
4deeper courses it feeds
🌱 The on-ramp, not the law library. Educational, not legal advice - it teaches the vocabulary and the map, then points you at the deeper courses (PDPA, GDPR, EU AI Act, data governance) for the detail.

The on-ramp 🧭 · for anyone new · 6 x 45 min · plain English

One track, laddered easy to a little harder. Everyone starts at Session 1. By the end you will read a privacy notice, a breach report, or an AI-regulation headline and know exactly what it means - and which deeper course to take next.

🧩Session 1 · easy

What is data, and why govern it

Personal data vs data, the one test to spot it, sensitive data, and the three reasons governance exists - trust, risk, and law.

▶ Start here 🔤Session 2 · easy

The vocabulary, in one breath

Consent, purpose, data subject, controller vs processor, and the rights people have - the words every regime shares, made plain.

The words 🗺️Session 3 · medium

The regime map + which touches me

PDPA, GDPR, and the EU AI Act at a glance - what each covers and who it reaches - plus a live chooser that tells you which apply to you.

The map + chooser 🚨Session 4 · medium

When it goes wrong: breaches

What a data breach actually is, why it matters, the first moves when one happens, and what "notify within 72 hours" means in plain terms.

The bad day 🧑‍⚖️Session 5 · deciding

Who owns this: the DPO + roles

What a Data Protection Officer does, controller vs processor responsibilities, and governance as an everyday habit, not a one-off project.

The people 🚀Session 6 · deciding

Your next steps

How the four deeper courses build on this, a personal five-step starting plan, and the regime chooser revisited now that you know the words.

Where next
easy - everyone medium deciding

The live chooser 🔎

"Which regime touches me?"

Session 3 gives you a small interactive chooser: answer four plain-English yes/no questions about who your data and AI touch, and it maps you to the regimes that likely apply - Singapore's PDPA, the Do Not Call rules, the EU's GDPR, and the EU AI Act - and points you at the deeper course for each. It is a teaching map of who-reaches-whom, not legal advice. Try it below.

Choose your pace 🧭

One door, three ways in. New to all of it? Take the whole thing. Just need the map? Jump to Session 3.

🌱 The full on-ramp (recommended) 1→ 2→ 3→ 4→ 5→ 6
🗺️ Just tell me which laws apply 1→ 3
🧑‍⚖️ I'm a new DPO, orient me fast 2→ 5→ 6

Where to go deeper 🎓 · the four courses this on-ramp feeds

Once you have the vocabulary and the map, pick the course that matches what touches you. Each is a full, hands-on treatment.

🛡️ Data Governance PDPA-first governance in depth - a DPO track and an exec track, built on the Himalaya case. Next · core 📵 PDPA + DNC (Singapore) The ten PDPA obligations, consent, the Do Not Call registers, and breach response - with a live checker. Next · core 🔏 GDPR for a Singapore org When the GDPR reaches you (Article 3), lawful bases, rights, and the 72-hour breach rule - mapped to the PDPA. Next · core ⚖️ AI Governance & the EU AI Act The Act's risk tiers, obligations, and penalties, plus NIST AI RMF and ISO 42001 - with a live risk-tier classifier. Then · advanced

The knowledge map 🧠

The whole on-ramp at a glance - hover a session to spotlight its concepts, click any node to jump in.