How a DPO question sent me back to school
Sometime in 2024, a few of my clients started calling me after receiving letters from the Personal Data Protection Commission.
The question was roughly the same:
“Michelle, they are asking us to register a DPO. Who is supposed to be our DPO?”
Good question. One with no direct answer.
Naturally, they asked me because I was already helping them with corporate compliance matters.
So I researched.
I read.
I Googled.
I gave them answers based on what I could verify.
But strangely, the more I learnt, the less confident I became.
Not because I knew less.
Because I was starting to realise how much I didn’t know.
That bothered me.
If clients were looking to me for guidance on compliance matters, I didn’t want to be standing at the back door saying, “Should be okay lah.”
So I started looking for a proper Data Protection course.
I found courses offered by NTUC LearningHub.
Then I found SMU.
SMU offered Data Protection courses too, but there was one small “problem”.
They could be stacked towards a Master’s degree.
And the wider programme also covered things like AI, Machine Learning, Blockchain, Web3, Metaverse, IoT and etc.
At this point, a sensible person might have said:
“I just need a short Data Protection course.”
Apparently, I am not that sensible person
I signed myself up for the Industry Practice Master of Digital Economy at SMU, a programme that generally takes under 36 months to complete.
I signed up because of Data Protection, but I fell in love learning about AI, Machine Learning, blockchain, IoT and all sorts of shiny things
The Master’s programme had 2 main parts.
Get Michelle Ten’s stories in your inbox
Join Medium for free to get updates from this writer.
The first was 6 modules (2-day class x 6) covering things like AI/ML, Blockchain, Web3, Metaverse, IoT and Innovation Culture Catalyst.
Honestly, I enjoyed and loved these modules more than what’s coming…
Data Protection and Data Governance.
Then came my Track Core.
Data Protection and Data Governance.
16 modules.
Yes. Sixteen.
Compared with AI, Machine Learning, IoT, Web3 and Metaverse, this part was definitely… less exciting.
And to be honest, sometimes very boring.
More policies. More frameworks. More controls. More “who has access to what” and “how long are we keeping this?”
There were moments when I really wanted to run away from it. I even contemplated changing my track core …
But I had to stay on my “track”, because I remembered the reason I signed up for the programme in the first place.
Too bad… 😭😭😭😭😭😭😭😭😭😭😭
As part of the programme, I also spent about 4 months working on a group project with my classmates, trying to solve real-world problems in Data Governance and Data Protection.
That turned out to be a very valuable learning experience.
We put our heads and sometimes our souls together, trying to turn what we had learnt into something practical, working through ideas, disagreeing occasionally, figuring things out, and somehow moving forward together.
And somewhere along the way, I started to realise something.
All the exciting technology depends on data.
AI needs data. Machine Learning needs data. IoT creates data.
So before I ask:
“What can we do with the data?”
Maybe I should first ask:
“Do we know what data we have collected?”
And that moment, I finally saw the data-flow.
And that was when Data Protection started becoming much bigger to me than just appointing a DPO.
And somehow, what started with a client asking me, “Who should be our DPO?” eventually took me all the way to July 2026, when I graduated with my SMU IPMDE classmates as part of the Class of 2026.
I would say, it was quite a long detour from one simple question from my clients. 😂
