Good morning distinguished guests, partners, colleagues and friends. Since taking on the role of Commissioner in April, I have been looking forward to the opportunity to speak directly with this community.
I would like to thank our panellists for the insightful discussions today. You have been very generous in sharing your perspectives and experiences, all of which contribute to our common goal of supporting trusted use through good data and AI governance. I would also like to acknowledge the data protection authorities and government representatives who have flown in to join us today. I am honoured to welcome representatives from 19 jurisdictions, including ASEAN Member States, as well as Bangladesh, Hong Kong, Japan, Luxembourg, Macao, Maldives, Sri Lanka, the United Kingdom and the United States. To our industry partners, I see many familiar faces, and even more new ones.
Today, we are joined by close to 2,000 attendees, including data protection professionals, technologists, lawyers, and business leaders. Many of you are valued partners who have worked with PDPC over the last 14 years. Thank you all for being here, and for being part of our community.
As Minister Teo mentioned this morning, data protection remains essential even as the conversation around data widens. Data protection is a dynamic practice. Technology is changing rapidly, but their risks and threats are also constantly evolving. Keeping up with the speed and scale of change is not easy. Events like the Singapore Data Festival are an opportunity for us to gather and learn from one another. What each of us is seeing, what is working, and what needs improvement. Let me share some of my perspectives and priorities for the year, across three themes: protection; technology; and community.
First, protection. Today’s threat landscape is vastly different from before. Ransomware, supply chain attacks, zero-day attacks – malicious actors are employing far more sophisticated tactics and techniques; some of which are enhanced by AI tools. Organisations must be well protected in this environment. This includes knowing what data assets they have, what protection measures to put in place, and whether enhanced measures should be adopted depending on the level of risk posed to them and their customers.
Take for example a company that intends to develop and deploy a web application. What are the secure app development practices that they should observe? Should they also use a web application firewall to defend against common web application attacks? To help organisations understand the risks and decide what protections to put in place, the PDPC is today releasing an update to the Guide to Data Protection Practices for ICT Systems. The updated guide compiles data protection best practices, including learnings from past data breaches. It also includes guidance on data protection when AI systems are developed and deployed.
Another area we are paying special attention to is protecting children’s data. Two years ago, we explained in our Advisory Guidelines for Children’s Personal Data that children may not fully appreciate the risks and consequences of sharing personal data online. We highlighted that organisations play a role in adopting data protection by design, so that children can benefit from participating in safe online environments. More broadly, Singapore has been strengthening safeguards for children online, including by limiting children’s access to harmful content and apps. PDPC supports this by clarifying how personal data and age-assurance signals should be governed.
Successful data governance here is not just defined by the risks and harms mitigated, but also by the positive online experiences for children enabled by data. This includes good default settings, responsible recommendations, and appropriate access to chat, transactions, and other features. As the national conversation on children’s online safety continues to evolve, PDPC will do our part to ensure that children’s personal data continues to be handled safely and responsibly.
Our second theme is technology. As we have heard this morning, strong data protection and governance is the foundation for robust, reliable, and safer AI systems. As we move from traditional AI, to generative AI, and now Agentic AI, new data protection challenges come up that need addressing. Our approach continues to be an agile, accretive one, especially where norms and standards are still nascent. Resources such as IMDA’s Model AI Governance Frameworks help give organisations a common frame and language, while leaving room for innovating and experimenting.
We also see use becoming mainstream and standards and norms beginning to coalesce. So, we will also provide clearer and more specific guidance to help organisations achieve responsible AI by design, demonstrate accountability, and meet their legal obligations. We are also watching other tech developments closely, including the increasing use of biometric technology and AI wearables. Previously, biometric technology was primarily used for safety and security purposes, in limited contexts such as building entry management. Today, use cases are widening. Biometrics can be used in place of credit cards for payments; or within buildings to track individuals and detect dangerous or unauthorised activities.
Similarly, wearables with AI and other advanced features have become more widely available to consumers and enterprise users. These can come in a variety of form factors – glasses, earbuds, rings, watches. Modern devices have more extensive data collection and processing capabilities. There are clear benefits, such as greater accessibility and productivity gains. But both biometrics and AI wearables also raise significant legal and social questions: what are the appropriate and inappropriate uses of such technologies? What happens when personal data of bystanders in non-public places is captured? Do different segments of the public have different views on what reasonable use is? These are questions that have no easy answers. We will be exploring them as the technology continues to evolve, in order to create an environment of trusted digital development, anchored in the belief that confidence in use comes from clarity in the rules.
The third theme is community. Today, over 190,000 companies have registered data protection officers with the PDPC. The PDPC will continue to bring together, invest in, and support the growth of our DPOs, privacy professionals, and partners who turn data protection into practice every day. This Festival is a testament to our commitment to that mission. But our journey together extends well beyond this week. That is why we have been actively engaging DPOs to hear how we can better serve you.
One example – we have heard feedback that the operating environment has changed significantly in recent years, and the content and delivery of our resources should keep pace. I agree, which is why we have made it a priority to refresh our materials and resources. Earlier this year, we refreshed our website to make it easier to navigate, and for visitors to find what they need.
In the coming months, we will update the resources and tools we provide. This includes new e-learning materials for training your officers on the PDPA, and a new web-based tool that provides easy-to-follow action plans for organisations. We will also launch a searchable database of DPOs next month. Ultimately, we want our resources to be current, practical, and useful to both new and experienced DPOs, and we are committed to work in close partnership with all of you. Our aim is to make it easier for you to do your job to support your company’s operations, in Singapore and the region.
Let me close with a word on the Singapore Data Festival. Over the course of this week, we are bringing together more than 2,500 people in celebration of data. We have 47 events throughout the week, spanning topics such as data for AI, Privacy Enhancing Technologies, children’s privacy, and cross-border data use.
These conversations are not only about understanding and complying with the law. They are practical ways to share best practices, help one another, and build connections across different parts of the data ecosystem. None of this would have been possible without the 31 partner organisations who have come together to organise events this week. This is our community in action, and we are proud to work alongside you. On that note, let me also thank my colleagues at the PDPC and IMDA, and all our partners, for making this Festival possible.
Lastly, to all of us here – thank you for being a part of our community. I encourage everyone to take part in the various events throughout the week, and to make new connections as you do. The conversations that you have here today will help prepare your organisation to face tomorrow’s challenges.
I wish everyone a productive and meaningful Singapore Data Festival. Let us continue working together to build a trusted data ecosystem for Singapore and the region. Thank you.