By DPEX Editorial Team
From L- R: Moderator: Derek Ho, Deputy Chief Privacy AI & Data Responsibility Officer, Mastercard; Dr Duan Pu, Head of Privacy Enhancing Technologies Department, Ant International; Dr Yap Ghim Eng, Head of Data Practice, GovTech; Benjamin Tan, Senior Scientist II, Institute of Advanced Intelligence and Computing, A*Star ; Timon Van Overveldt, Senior Staff Software Engineer, Google
"Who here has used a PETs-enabled service?" asked Derek Ho, Deputy Chief Privacy AI & Data Responsibility Officer, Mastercard, and moderator for the panel titled, PETs in Action: From Pilot to Production at the Singapore Data Festival.
When only a few hands went up, he followed with another question, "Who here uses Google Maps?" As nearly every hand in the room raised, the point was made. "That means you have used a PETs-enabled service. you just don't know about it."
The fact is, behind the scenes, Google Maps relies on a slew of PETs —specifically differential privacy—to add mathematical "noise" to location data so that we can find the fastest routes without compromising our individual privacy. Ho’s opening set the stage for a discussion on how data leaders take these powerful, yet often invisible, technologies and successfully operationalise them at scale.
To unpack this journey from theoretical cryptography to daily digital life, Ho was joined by a panel of industry practitioners: Dr Yap Ghim Eng, Head of Data Practice at GovTech Singapore; Dr Duan Pu, Head of Privacy Enhancing Technologies Department at Ant International; Benjamin Tan, Senior Scientist II at A*STAR’s Institute of Advanced Intelligence and Computing; and Timon Van Overveldt, Senior Staff Software Engineer at Google.
Solve the Problem, Not the Technology
With buzzwords like homomorphic encryption, zero-knowledge proofs, and federated learning dominating tech discussions, it is easy for organisations to get caught up in the hype. Yet the panel urged a more grounded perspective: PETs are a means to an end, not a badge of honour.
"PETs are meant to be an enabler," argued Dr Yap. "It’s not meant to be a sexy investment... If you can solve it simply, solve it simply." The first question for privacy leaders shouldn't be which complex algorithm to deploy, but whether conventional governance—such as basic access controls, data minimisation, or a trusted third party—can solve the bottleneck first.
Google’s Van Overveldt echoed this view, noting that in the early stages of adoption, "business value and economics and technical feasibility are where the real challenge lies." The focus must remain on identifying where traditional data sharing is completely stuck and using PETs to unlock genuine value.
From Keyboards, to Fintech, to Healthcare
To move past pilots and build the organisational trust needed to scale, leaders need established playbooks for highly sensitive use cases that cannot be solved any other way.
For Google, its journey with federated learning began over a decade ago with Gboard, the Google smartphone keyboard. Keyboards handle highly sensitive private keystrokes, yet they must adapt as language and typing patterns evolve. Google bypassed collecting raw user data by training AI model steps directly on end-user devices and aggregating only the model updates. Van Overveldt highlighted Gboard as a clear first use case that proved federated learning could solve a real-world, high-stakes problem, paving the way for wider adoption across Google's product ecosystem.
Scaling PETs is no longer just a proof of concept but is already in production. Across borders, Dr Duan shared how Ant International tackled the complex world of cross-border fintech via the Alipay+ Risk Management Platform. To conduct real-time anti-money laundering and risk control without moving raw plaintext data across borders, they implemented multi-party computation (MPC). These external partners no longer have to send their raw, plaintext data out of their jurisdictions; instead, the sensitive data stays on localised partner servers while risk assessments are conducted cryptographically.
Meanwhile, Tan of A*STAR shared an operational healthcare project using Trusted Execution Environments (TEEs) to securely process sensitive whole-slide medical images in the cloud. However, he cautioned that PETs don’t solve all the problems, and traditional security hygiene—such as strict access control—remains absolutely essential.
"Allergy Testing" and Security Hygiene
DPOs frequently face hesitancy from legal teams, risk officers, and business units when proposing PETs. To overcome this organisational anxiety, Dr Yap suggested the "allergy test" strategy.
"Always imagine your stakeholders are trying to find out whether they're allergic to something," Dr Yap suggested. "You won't actually do the allergy test on their entire body. You’d test a small area.” Finding a high-value, low-risk pilot gives stakeholders a tangible taste of success without triggering pushback and alarm.
Tan also highlighted how DPOs must navigate tricky compliance definitions. For instance, is processing data in a secure, digital cloud "black box" like a TEE considered a disclosure of personal data to a third party? In the A*STAR project, the medical institution’s need to link diagnostic results back to patient records legally constituted a "disclosure of personal data." Yet, because the cloud and TEE providers "do not have the means" to decrypt or re-identify the patient records, they were legally deemed not to have received personal data. PETs function here as a robust security control rather than simply a legal exemption.
PETs are the “Rebar in the Concrete”
While the PETs ecosystem is still evolving, the panel agreed that waiting on the sidelines is a mistake.
Ho said he viewed PETs not as a flashy showcase feature, but as essential, "invisible" infrastructure—just like the steel rebar hidden inside concrete that structurally strengthens the whole building. PETs are poised to strengthen the entire digital data-sharing ecosystem and render it more resilient. By pairing TEEs with cryptographic verification, organisations can shift from vague promises of trust to concrete, mathematical guarantees. As Van Overveldt neatly summarised, PETs allow organisations to transform aspirational promises of privacy into verifiable cryptographic proof that anyone can audit.
