Singapore AI Security & Data Protection Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

As AI systems increasingly process personal data in ways the Personal Data Protection Act's original drafters never anticipated, this keynote examines how organisations operating in Singapore are interpreting consent, purpose limitation, and accountability obligations for AI-driven data use, and where genuine ambiguity remains.

• How organisations are navigating PDPA's consent requirements when AI models learn from and reuse data in ways not originally disclosed to individuals.
• What recent guidance signals about how Singapore's regulator expects organisations to demonstrate responsible AI governance, not just technical compliance.
• Practical approaches for staying ahead of a regulatory framework still actively adapting to AI, rather than reacting after each new guideline.

As Singapore continues to position itself as APAC's trusted data and digital hub, organizations based here face growing complexity managing cross-border data transfers across a region where privacy and data residency requirements are diverging rather than converging.

• How multinational organisations headquartered or operating through Singapore are structuring data architecture to satisfy multiple, sometimes conflicting, jurisdictional requirements.
• What organisations are learning from actually using Singapore-recognised transfer mechanisms at scale, versus the theory.
• The added complexity of ensuring AI systems trained or fine-tuned using regional data don't inadvertently create cross-border compliance gaps.

Privacy and security leaders are no longer managing one regulatory relationship; they're navigating overlapping and sometimes conflicting obligations across privacy law reform, sector-specific rules, and emerging AI governance requirements, often with limited resourcing to do it all well.

• Practical approaches to building compliance programs flexible enough to absorb reform without constant rebuilds.
• How organisations operating across APAC are managing divergent data residency and transfer requirements without duplicating infrastructure for every jurisdiction.
• Shifting compliance from a post-hoc legal review into an input that shapes how AI and data systems are architected from day one.

With employees adopting AI tools faster than IT could track or approve them, one security leader built a discovery and governance approach that brought unauthorized AI usage into the light — without triggering a workforce backlash or slowing legitimate innovation.

• How the team mapped unsanctioned AI tool usage across the organization before deciding on any policy response, since you can't govern what you can't see.
• Designing an approval pathway fast enough that employees chose to use it rather than route around it, turning shadow AI into managed AI.
• Building lightweight, continuous visibility into new AI too.

A hands-on, interactive session working through a real AI security and data protection scenario as a room. Details announced soon.

With critical infrastructure and legacy platforms too costly or risky to replace outright, one security leader built a layered protection strategy that meaningfully reduced risk exposure without waiting for a full modernisation program.

• Triaging legacy system vulnerabilities realistically, rather than pursuing an unachievable "patch everything" strategy.
• How network segmentation, enhanced monitoring, and strict access controls around legacy systems provided durable risk reduction, not just a stopgap.
• Building the business case for ongoing investment in legacy security, when the instinct is often to deprioritize spending on systems slated for eventual retirement.

After years of data classification policies that existed on paper but were ignored in practice, one data protection leader built a classification approach employees actually followed, turning a compliance exercise into a functioning control.

• Recognising that asking employees to correctly label sensitive data by hand was never going to scale, and redesigning around automated detection instead.
• How classification was built into the tools people already used daily, rather than requiring a separate step that competed with getting work done.
• How accurate classification became the foundation for access controls, DLP policies, and AI governance decisions downstream.

As AI systems make decisions with real legal and financial consequences, organizations are discovering that liability frameworks built for human decision-making don't map cleanly onto AI-driven processes; leaving legal, privacy, and security leaders to navigate accountability, contracts, and customer trust largely without settled precedent.

• When an AI system's decision leads to a data breach, discriminatory outcome, or regulatory breach, how are legal teams currently allocating fault between the organisation, the AI vendor, and the underlying model provider; and where does existing law simply not have an answer yet?
• How eroded customer trust following an AI-related incident is increasingly translating into legal action and what that means for how legal and privacy teams collaborate on incident response.
• Exploring the tension between regulatory and legal expectations for transparency and explainability, and the practical reality that many AI systems can't yet provide a clear, defensible account of how a specific decision was made.

Small-group, discussion-based sessions where you'll work through real AI security and data protection challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Facing a security team stretched thin and alert fatigue eroding response quality, one CISO restructured detection and triage around automation and prioritisation; dramatically compressing the time between compromise and containment.

• How the team re-engineered alert prioritization so analysts spent time on genuine threats instead of drowning in low-value notifications.
• Where automated containment actions (isolating endpoints, revoking access) were safely delegated to systems versus kept as human decisions.
• How the leader secured budget and buy-in for detection tooling improvements proactively, before an incident forced the issue.

Singapore's status as a global financial hub and its designation of critical infrastructure sectors under the Cybersecurity Act mean AI-driven threats and defences are being tested first and hardest here, this keynote draws lessons from finance and critical infrastructure for every industry navigating AI security.

• How financial institutions' heightened regulatory scrutiny is producing AI governance practices other sectors can adapt before they're forced to.
• How designated critical information infrastructure owners are being pushed toward AI-security maturity faster than market pressure alone would drive.
• What non-regulated industries can practically borrow from finance and infrastructure's AI security playbooks, and where those lessons don't transfer.

As enterprises rely on growing networks of AI vendors, SaaS platforms, and outsourced service providers, sensitive data increasingly flows through systems organisations neither built nor fully control; turning vendor risk management into one of the hardest unsolved problems in data protection.

• Why static vendor assessments fail to capture real-time risk, and what continuous monitoring of third-party access actually looks like in practice.
• The unique challenges of assessing AI and model providers, where questions about training data use, data retention, and model behavior go beyond traditional security due diligence.
• Lessons from real incidents on managing incident response, regulatory notification, and reputational fallout when the failure originated outside your own walls.

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

As AI systems increasingly process personal data in ways the Personal Data Protection Act's original drafters never anticipated, this keynote examines how organisations operating in Singapore are interpreting consent, purpose limitation, and accountability obligations for AI-driven data use, and where genuine ambiguity remains.

• How organisations are navigating PDPA's consent requirements when AI models learn from and reuse data in ways not originally disclosed to individuals.
• What recent guidance signals about how Singapore's regulator expects organisations to demonstrate responsible AI governance, not just technical compliance.
• Practical approaches for staying ahead of a regulatory framework still actively adapting to AI, rather than reacting after each new guideline.

As Singapore continues to position itself as APAC's trusted data and digital hub, organizations based here face growing complexity managing cross-border data transfers across a region where privacy and data residency requirements are diverging rather than converging.

• How multinational organisations headquartered or operating through Singapore are structuring data architecture to satisfy multiple, sometimes conflicting, jurisdictional requirements.
• What organisations are learning from actually using Singapore-recognised transfer mechanisms at scale, versus the theory.
• The added complexity of ensuring AI systems trained or fine-tuned using regional data don't inadvertently create cross-border compliance gaps.

Privacy and security leaders are no longer managing one regulatory relationship; they're navigating overlapping and sometimes conflicting obligations across privacy law reform, sector-specific rules, and emerging AI governance requirements, often with limited resourcing to do it all well.

• Practical approaches to building compliance programs flexible enough to absorb reform without constant rebuilds.
• How organisations operating across APAC are managing divergent data residency and transfer requirements without duplicating infrastructure for every jurisdiction.
• Shifting compliance from a post-hoc legal review into an input that shapes how AI and data systems are architected from day one.

With employees adopting AI tools faster than IT could track or approve them, one security leader built a discovery and governance approach that brought unauthorized AI usage into the light — without triggering a workforce backlash or slowing legitimate innovation.

• How the team mapped unsanctioned AI tool usage across the organization before deciding on any policy response, since you can't govern what you can't see.
• Designing an approval pathway fast enough that employees chose to use it rather than route around it, turning shadow AI into managed AI.
• Building lightweight, continuous visibility into new AI too.

A hands-on, interactive session working through a real AI security and data protection scenario as a room. Details announced soon.

With critical infrastructure and legacy platforms too costly or risky to replace outright, one security leader built a layered protection strategy that meaningfully reduced risk exposure without waiting for a full modernisation program.

• Triaging legacy system vulnerabilities realistically, rather than pursuing an unachievable "patch everything" strategy.
• How network segmentation, enhanced monitoring, and strict access controls around legacy systems provided durable risk reduction, not just a stopgap.
• Building the business case for ongoing investment in legacy security, when the instinct is often to deprioritize spending on systems slated for eventual retirement.

After years of data classification policies that existed on paper but were ignored in practice, one data protection leader built a classification approach employees actually followed, turning a compliance exercise into a functioning control.

• Recognising that asking employees to correctly label sensitive data by hand was never going to scale, and redesigning around automated detection instead.
• How classification was built into the tools people already used daily, rather than requiring a separate step that competed with getting work done.
• How accurate classification became the foundation for access controls, DLP policies, and AI governance decisions downstream.

As AI systems make decisions with real legal and financial consequences, organizations are discovering that liability frameworks built for human decision-making don't map cleanly onto AI-driven processes; leaving legal, privacy, and security leaders to navigate accountability, contracts, and customer trust largely without settled precedent.

• When an AI system's decision leads to a data breach, discriminatory outcome, or regulatory breach, how are legal teams currently allocating fault between the organisation, the AI vendor, and the underlying model provider; and where does existing law simply not have an answer yet?
• How eroded customer trust following an AI-related incident is increasingly translating into legal action and what that means for how legal and privacy teams collaborate on incident response.
• Exploring the tension between regulatory and legal expectations for transparency and explainability, and the practical reality that many AI systems can't yet provide a clear, defensible account of how a specific decision was made.

Small-group, discussion-based sessions where you'll work through real AI security and data protection challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

Facing a security team stretched thin and alert fatigue eroding response quality, one CISO restructured detection and triage around automation and prioritisation; dramatically compressing the time between compromise and containment.

• How the team re-engineered alert prioritization so analysts spent time on genuine threats instead of drowning in low-value notifications.
• Where automated containment actions (isolating endpoints, revoking access) were safely delegated to systems versus kept as human decisions.
• How the leader secured budget and buy-in for detection tooling improvements proactively, before an incident forced the issue.

Singapore's status as a global financial hub and its designation of critical infrastructure sectors under the Cybersecurity Act mean AI-driven threats and defences are being tested first and hardest here, this keynote draws lessons from finance and critical infrastructure for every industry navigating AI security.

• How financial institutions' heightened regulatory scrutiny is producing AI governance practices other sectors can adapt before they're forced to.
• How designated critical information infrastructure owners are being pushed toward AI-security maturity faster than market pressure alone would drive.
• What non-regulated industries can practically borrow from finance and infrastructure's AI security playbooks, and where those lessons don't transfer.

As enterprises rely on growing networks of AI vendors, SaaS platforms, and outsourced service providers, sensitive data increasingly flows through systems organisations neither built nor fully control; turning vendor risk management into one of the hardest unsolved problems in data protection.

• Why static vendor assessments fail to capture real-time risk, and what continuous monitoring of third-party access actually looks like in practice.
• The unique challenges of assessing AI and model providers, where questions about training data use, data retention, and model behavior go beyond traditional security due diligence.
• Lessons from real incidents on managing incident response, regulatory notification, and reputational fallout when the failure originated outside your own walls.

Unwind with your peers for a couple of drinks on us!