Service Providers as Data Intermediaries
Is this legally binding?
Guidance. Voluntary guidance. Best practice, not obligation, until a contract or a regulator cites it.
GUIDANCE interpreting binding s 4(2): third-party developers of bespoke or fully customisable AI Systems processing personal data for customers are data intermediaries, directly subject to the Protection and Retention Obligations (ss 24-25) and the s 26C breach-reporting duty.
From the source
“they take on the role of data intermediaries and have to comply with applicable obligations under the PDPA”
paras 1.4, 11.2
What this connects to
4 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Part of3
- Concept'Data Intermediary' (s 2(1); s 4(2))Binding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- ObligationProtection Obligation (s 24)Binding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- ObligationRetention Limitation Obligation (s 25)Binding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
Cited by1
- SectionPart V, Procurement of AI Systems (B2B Service Providers)Guidance
Structural decomposition of the source instrument
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.