You have the words and the map - now the plan
Five sessions ago, governance was a wall of acronyms. Now it is a mental model: personal data is information that points to a person, you govern it for trust, risk, and law, and a handful of regimes set the rules depending on who you serve and what you build. That is genuinely most of the battle. What is left is not more theory - it is deciding where to go deeper and taking the first small action. This session hands you both: a shelf of four deeper courses, and a five-step starting plan you can begin before the week is out.
The governance shelf, and where you go next 10 min live
Governance 101 was the ground floor. Above it sit four deeper courses, and you do not take all of them - you take the one that matches your situation. The picture below shows the branching: everyone starts here, then follows the path their answers point to. Most people take one or two. A DPO building a real program might take three.
LiveData Governance - build the actual program3 min▶
What it adds: this is the "how do we actually run governance" course. It goes deep on PDPA-first governance and comes in two tracks - a DPO track for the person who owns it, and an exec track for the leaders who fund and back it - built around the Himalaya case study so you see a real program take shape.
Who should take it: anyone whose job is now to stand up or improve a governance program, not just understand it. If you finished 101 thinking "okay, but what do we build?", this is your answer.
LivePDPA + DNC (Singapore) - the local rulebook3 min▶
What it adds: the ten PDPA obligations spelled out, how consent really works, the Do Not Call registers for marketing, and what to do when a breach happens - with a live compliance checker and the Marina Retail case so the rules stop being abstract.
Who should take it: anyone who handles personal data in Singapore or does any marketing here. For most Singapore organisations, this is the most directly useful next course.
Open PDPA + DNC ↗ core
LiveGDPR for a Singapore org - when Europe reaches you2 min▶
What it adds: when the GDPR actually reaches a company based outside the EU, the lawful bases for using data, the data-subject rights, the 72-hour breach rule, and how cross-border transfers work - all mapped back to the PDPA so you see where the two overlap and where they differ, through the Lumina case.
Who should take it: anyone who serves, sells to, or monitors people in the EU - even from Singapore. If your customers or website visitors include Europeans, this is not optional reading.
LiveAI Governance & the EU AI Act - when you build with AI2 min▶
What it adds: the EU AI Act's risk tiers, the obligations and penalties that come with each, plus the NIST AI Risk Management Framework and ISO 42001 so you have the full governance picture for AI - with a live risk-tier classifier and the Vantage case to test scenarios against.
Who should take it: anyone building or deploying AI that affects people - hiring tools, scoring, recommendations, anything that makes or shapes decisions about humans. This is the advanced door, best taken after you are comfortable with the data courses.
Open AI Governance ↗ then - advanced
Self-studyThe whole shelf in one place1 min read▶
All of these live on one hub alongside every other course, so you can browse, bookmark, and come back as your needs change. A good rhythm: take one deeper course now, apply it, then return for the next when a new situation appears - a new market, a new AI feature, a new role.
Your five-step starting plan 8 min live
You do not need a big project to begin. You need five small, ordered steps - each one takes an afternoon at most, and each one makes the next easier. Do them in order. By the end you will have a real map of your data, a person who owns it, and a clear first fix underway.
LiveStep 1 - make a one-page data register2 min▶
Before anything else, write down what you hold. One page, three columns: what (the kind of data - email list, HR records, CCTV), where (which system or drive it lives in), and why (the reason you have it). You built the start of this in Session 1. This single page is the foundation every deeper course assumes you have.
The register that took 40 minutes. A small clinic thought a data register meant a big software project. Instead the office manager listed nine things on one sheet in under an hour - and immediately spotted two old spreadsheets nobody remembered, full of patient contact details, sitting on a personal laptop. The register did not just document the problem; finding it was the first fix.
LiveStep 2 - name a DPO or an owner2 min▶
Governance with no owner quietly dies. Name one person who is accountable - a DPO if your situation calls for one, or simply "the person who looks after data here" for a small team. It does not have to be a lawyer or a full-time role to start. It has to be a real name, so that when a question or a problem appears, everyone knows who picks it up. Session 5 covered what this role actually does.
LiveStep 3 - run the "which regime touches me?" chooser2 min▶
Now that you know what data you hold and who serves whom, run the chooser (it is right below, in Part 3). It asks a few plain questions - do you handle Singapore personal data, do you serve people in the EU, do you build AI that affects people - and points you at the regimes that apply. This tells you which deeper course to take, so you are not guessing.
LiveSteps 4 and 5 - go deeper, then fix your biggest gap2 min▶
Step 4: take the deeper course the chooser pointed you to. Reading it while you have a real data register in hand makes it land far harder than theory alone.
Step 5: fix your single biggest gap first - do not try to fix everything. For most beginners the biggest gap is one of two things: collecting more than you need (stop asking for it), or a sensitive dataset with no protection (lock it down). Pick the one that would hurt most if it went wrong, and start there.
Run the chooser again, now you know the words ★ 4 min · interactive
You met this chooser in Session 3. Run it again now - the questions will read completely differently because you understand the words behind them. Your answers stay in your browser; nothing is sent anywhere. Use it to decide which deeper course goes on your list this week.
Choose your next course and your first action ★ 10 min · write it down
This is the exercise that makes the whole course count. Two sentences, written down, with dates. That is it.
Based on the chooser, name the one deeper course you will take next. Write it as a commitment: "I will start [course] by [date]."
From your data register, pick your single biggest gap - the thing most likely to hurt if it went wrong. Write one first action: "This week I will [do the specific thing]."
Put both sentences somewhere you will see them - a sticky note, a calendar event, a message to yourself. A plan you cannot find is a plan you will not do.
Three questions to close the loop ★ 6 min · reflect
Answer these out loud or on paper. They gather everything the six sessions gave you into three sentences you can act on.
Which regime touched you? After the chooser - is it PDPA, GDPR, the EU AI Act, or a combination? Name it plainly.
What is your biggest gap? Looking at your register, where are you most exposed - too much collected, or something sensitive left unprotected?
Who owns it? Who, by name, is now accountable for closing that gap and for the data going forward? If the answer is still "nobody", that is your very first action.
Your first week ◐ start this week
- Open (or enrol in) the deeper course you chose - just open the first session this week, so it is real and not "someday".
- Start your one-page data register if you have not already: what you hold, where it lives, why you have it. Aim for done, not perfect.
- Confirm who owns data protection where you are - and if the answer is nobody, raise it with the person who can decide.
- Pick your single biggest gap and write down one action to close it. Do that action, or book the time to.
- Which deeper course did I commit to, and by when?
- What is the one gap I am fixing first, and what is my first action?
- Who owns our data protection now - by name?
- What would I want to be true about how we handle people's data a year from now?
Where to go next on the shelf
This on-ramp gave you the plain-English core. Each of these goes deep on its regime - continue with the one your chooser pointed to.
Three questions before you go 🎯 ◐ 90 seconds
1 · A founder sells to customers across the EU from Singapore. Which deeper course should be on their list?
Serving people in the EU can pull the GDPR onto a company based anywhere, including Singapore. That course covers exactly when and what to do about it.
2 · Someone is building an AI tool that screens job applicants. Which deeper course fits best?
An AI system that affects people - like hiring - is squarely what the AI Governance course is for: risk tiers, obligations, and the frameworks around them.
3 · What is the first step of the five-step starting plan?
You start by mapping what you hold. You cannot choose regimes or fix gaps you have not written down first - the register comes before everything else.