A map, not a deep dive
You do not need to read three rulebooks to govern well. You need to know which ones are in the room and roughly what each is for - the same way you can navigate a city with a subway map without knowing every street. This session draws that map. We name the three regimes, give each a one-line job description, then answer the question everyone actually has: "which of these touches me?" The deeper courses handle the how; today is about the shape and the reach.
Three regimes at a glance 8 min live
Here are the three, each in one line. Singapore's PDPA is the baseline for handling personal data in Singapore (plus the Do Not Call rules for marketing). The EU's GDPR is the world's most influential privacy law, built around the rights of people in the EU. The EU AI Act is the first big law aimed squarely at AI systems, sorting them by how risky their use is. Read the table across, not down.
LiveSingapore's PDPA - the home baseline3 min▶
The Personal Data Protection Act is Singapore's baseline for handling personal data. If your organisation collects, uses, or discloses data about people in Singapore - and almost every one does, if only staff records - the PDPA's core promises apply: notice, consent, purpose limitation, protection, access and correction, and telling people when a serious breach happens. Bundled alongside it are the Do Not Call (DNC) rules, which govern marketing to Singapore phone numbers. Think of the PDPA as the floor you are almost certainly standing on already.
LiveThe EU's GDPR - the influential one3 min▶
The General Data Protection Regulation is the EU's privacy law and the template much of the world now copies. It covers personal data much as the PDPA does, but with stronger, more detailed rights (including the erasure and portability we met in Session 2) and heavier duties - a lawful basis for every use, and reporting serious breaches fast. The headline for a Singapore reader is its reach: the GDPR protects people in the EU, wherever the organisation sits. We unpack that in Part 2.
LiveThe EU AI Act - the new one for AI2 min▶
The EU AI Act is the first major law written specifically for AI systems. Instead of treating all AI the same, it sorts uses by risk: a few uses are banned, some "high-risk" uses (like AI in hiring or credit decisions) carry heavy duties, and most everyday AI carries light or no extra obligations. It is about what the AI does to people - its output and effect - which is why, like the GDPR, it can reach beyond Europe. You do not need the tiers memorised today; just know it exists and that risk is its organising idea.
The laws follow the person, not your office 7 min live
Here is the idea that surprises most founders: a European law can bind a company that has never set foot in Europe. The GDPR protects people in the EU - so if you offer goods or services to them, or track their behaviour, you are in scope even from a desk in Singapore. The EU AI Act works the same way for AI: if your system's output is used to make decisions about people in the EU, it reaches you. The PDPA is more homebound - it is about your handling of Singapore people's data. The rule to remember: these laws follow the person (or the AI's effect), not your address.
LiveWhy the GDPR can reach Singapore3 min▶
The GDPR sets out its own reach (this is Article 3, and that is the only number worth knowing today): it applies not just to organisations based in the EU, but to any organisation, anywhere, that offers goods or services to people in the EU or monitors their behaviour. So a Singapore online shop that ships to Berlin, prices in euros, or runs analytics on EU visitors can be in scope. It is not about a signup for every foreign visitor who stumbles across your site - it is about whether you are aiming at or tracking people in the EU. When in doubt, that is a "get advice" moment.
LiveHow the EU AI Act reaches you2 min▶
The EU AI Act follows the AI's effect. If you build or use an AI system whose output is used to make decisions about people in the EU - screening EU job applicants, scoring EU customers - the Act can apply, even if your servers and staff are entirely in Singapore. The obligations scale with the risk tier of that use, but the reach principle is the same as the GDPR's: it follows the people affected, not the flag on your building.
The Singapore SaaS that grew into scope. A small Singapore analytics startup sold only locally - PDPA, and that was that. Then it landed a customer in the Netherlands and started processing that customer's EU users' data. Overnight the GDPR was in the picture, not because the startup moved, but because the people it now touched were in the EU. Nothing about the office changed; the reach did. That is exactly the pattern this session trains you to spot early.
Self-studyWhat "in scope" does and does not mean2 min read▶
Being "in scope" of a law means its duties can apply to you - not that you are automatically in trouble. It is the signal to learn that regime's basics and, for anything material, get proper advice. Two calming truths: first, most Singapore small businesses live mainly under the PDPA and only meet the GDPR when they deliberately go after EU customers. Second, scope is about facts you control - who you sell to, whom you track, where your AI's decisions land - so you can often choose your exposure. The chooser in Part 3 is built to surface those facts, not to scare you.
Which regime touches you? ★ 8 min · interactive
Answer four plain-English questions about who your data and AI touch, and the chooser lights up the regimes that likely apply - each with the deeper course that teaches it. It is a teaching map of who-reaches-whom, not a legal determination, and your answers never leave your browser.
Run the chooser on your own org ★ 10 min · pen and paper
Use the chooser above with your real organisation in mind, then write down what it tells you. This turns the map into your map.
Answer the four questions honestly for your organisation - not the version you wish were true.
Write down which regimes lit up: PDPA, DNC, GDPR, the EU AI Act - or the ones marked "likely not" for now.
For each that applies, note the one deeper course it points to, so you know where to go next.
Flag any answer that was a "not sure". Those are the facts to pin down - they decide your real exposure.
Three questions that set your scope ★ 8 min · your next team chat
These are the same facts the chooser turns on. Get your team to answer them out loud and you will know your governance footprint.
EU people: "Do we offer goods or services to, or track the behaviour of, anyone in the EU?" A yes brings the GDPR into the room.
AI on people: "Do we use AI whose output helps decide something about people - especially people in the EU?" A yes puts the EU AI Act on the watch list.
SG marketing: "Do we call, text, or fax marketing to Singapore numbers?" A yes means the Do Not Call rules sit on top of the PDPA.
Before Session 4 ◐ 20 min total
- Save your chooser result - the list of regimes that apply to you. Sessions 4 onward build on knowing your footprint.
- Check where your data lives: do any of your vendors or servers sit in, or serve, the EU? That answer often decides GDPR reach.
- List any AI tools you use that make or shape decisions about people (screening, scoring, recommending). Note who those decisions affect.
- Optional: skim the "go deeper" course linked for whichever regime matters most to you - just the homepage, to see what is coming.
- Whose people do we actually touch - only Singapore, or the EU too?
- If we won an EU customer tomorrow, would we know the GDPR just arrived?
- Is any AI we use making decisions about people, and where do those people live?
- Do we market to Singapore phone numbers - and have we ever checked the Do Not Call registers?
Where this fits on the shelf
This on-ramp maps three regimes so you know which deeper course to open next. This session covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · Your company sits entirely in Singapore but sells a subscription to customers in Germany. Which is true?
The GDPR sets its own reach: offering goods or services to people in the EU (or tracking them) pulls you in, wherever you are based. It follows the person, not the address.
2 · What does Singapore's PDPA primarily govern?
The PDPA is Singapore's baseline for collecting, using, and disclosing personal data, and it carries the Do Not Call rules for marketing to Singapore numbers.
3 · The EU AI Act is best described as a law about...
The EU AI Act is the first big law aimed at AI systems, organised around risk tiers: banned uses, high-risk uses with heavy duties, and lighter obligations for the rest.