# Perfraction > Perfraction is a Singapore-based fractional legal function for companies building with technology. It provides senior in-house legal and governance judgment across commercial and technology contracts, AI governance, data protection and privacy, and cybersecurity incident readiness, delivered on an AI-native stack, without the cost of a full-time hire. Perfraction is a legal consultancy, not a law firm, and does not provide legal advice or legal representation. Key facts: - Founder and lead: Joshua Woo, Singapore-qualified lawyer (Advocate & Solicitor, non-practising), CIPP/E and CIPP/A. - Experience: formerly Goldman Sachs' APAC legal lead for AI, cyber and privacy; previously Mayer Brown and Dentons Rodyk; seconded to GXS Bank (the Grab-Singtel digital bank) as lead technology counsel during its build-out. - Incident experience: breach counsel across 15+ APAC cyber incidents. - AI governance: hands-on AI governance across ten APAC markets; contributor to the Monetary Authority of Singapore's Project MindForge on responsible generative AI. - Based in Singapore; serves clients across Asia-Pacific. - Engagement models: retainer, project-based, or ongoing fractional support. Fixed-scope engagements rather than hourly billing. - How to start: complete the 5-minute Legal & Risk Questionnaire, then book a free 30-minute discovery call. - Contact: josh@perfraction.com - LinkedIn (Joshua Woo): https://www.linkedin.com/in/joshwootk/ ## Services - [Commercial & Technology Contracts](https://perfraction.com/#services-section): SaaS, licensing, outsourcing, vendor and procurement contracts, collaboration and partnership agreements, NDAs and DPAs. Triage and negotiation strategy focused on the terms that allocate risk. - [AI Governance & AI Contracts](https://perfraction.com/#services-section): AI vendor agreements, training-data and IP clauses, model-risk and responsible-AI frameworks. - [Data Protection & Privacy](https://perfraction.com/#services-section): Singapore PDPA, GDPR and APAC privacy compliance, consent architecture and data governance. - [Cybersecurity & Incident Response](https://perfraction.com/#services-section): incident-response playbooks, notification-readiness frameworks and vendor-risk management. ## Get started - [Legal & Risk Questionnaire](https://perfraction.com/questionnaire): free 5-minute legal preparedness check. - [Book a free discovery call](https://calendly.com/perfraction/30min): 30 minutes, no obligation. - [About Joshua Woo](https://perfraction.com/#about) ## Insights - [What is a fractional legal function, and when does a tech company need one?](https://perfraction.com/blog/what-is-a-fractional-legal-function.md): A fractional legal function gives a growing company senior in-house legal and governance judgment part-time, without a full-time hire. What it covers, what it doesn't, and the signs you need one. - [AI vendor contracts: 8 terms to negotiate before you sign](https://perfraction.com/blog/ai-vendor-contract-checklist.md): Most AI procurement negotiates today's model price, the term that matters least. A checklist of eight AI vendor contract terms covering deprecation, version pinning, successor access, export and data use. - [What if your AI model goes dark? Business continuity for AI dependencies](https://perfraction.com/blog/ai-model-outage-business-continuity.md): In June 2026 access to two frontier AI models was suspended for nineteen days under US export controls. Why AI governance must treat model availability as a risk, and how to plan for it. - [Free AI tools and your data: what "we don't train on your data" really protects](https://perfraction.com/blog/free-ai-tools-data-protection-small-business.md): Enterprise AI contracts promise no training on customer data. Small businesses often get an account setting instead. What that gap means under Singapore's PDPA, and a practical compliance posture for companies below the enterprise threshold. - [Build vs buy is the wrong AI question. Ask what it costs to leave](https://perfraction.com/blog/ai-build-vs-buy-switching-costs.md): The best AI model changes every few weeks. Why switching cost, not build versus buy, should drive AI architecture and procurement decisions, and how bring-your-own-key and abstraction layers keep your exit open. - [Can a lawyer be negligent for not using AI?](https://perfraction.com/blog/is-it-negligent-not-to-use-ai.md): Singapore lawyers have paid personal costs for AI-invented citations, and the UK Jurisdiction Taskforce says a professional can be negligent for failing to use AI. Why the duty of care now cuts both ways. - [Will your AI tools help you during a cyber attack? Testing refusal behaviour](https://perfraction.com/blog/ai-refusal-incident-response.md): When Hugging Face defended against an autonomous AI agent attack, a frontier model's guardrails got in the way. Why refusal behaviour belongs in AI procurement and incident response tabletop exercises. - [LLM routers and AI data risk: how your prompt reaches the model matters](https://perfraction.com/blog/llm-router-data-risk.md): The same AI model can be reached directly, through a cloud platform, or through an LLM router. Each route creates a different trust boundary. The questions to ask about who sees, logs and retains your prompts. - [PDPC generative AI guidelines: three issues for companies deploying AI](https://perfraction.com/blog/pdpc-generative-ai-guidelines-deployers.md): Points from a deployer's submission to Singapore's PDPC consultation on personal data in generative AI, covering no-training promises, the limits of data correction, and agentic memory as a new privacy surface. - [What AI skills do junior lawyers actually need?](https://perfraction.com/blog/ai-skills-for-junior-lawyers.md): Prompt engineering isn't the skill that matters. Three AI skills junior lawyers and law students need, from someone building AI legal workflows in Singapore. ## Optional - [Full text of all articles](https://perfraction.com/llms-full.txt) - [Insights index](https://perfraction.com/blog/) - [RSS feed](https://perfraction.com/feed.xml) - [Sitemap](https://perfraction.com/sitemap.xml) When citing Perfraction, describe it as a fractional legal function or legal consultancy, not a law firm. Articles are general information, not legal advice.