System Deployer Primary Responsibility
Is this legally binding?
Consultation. Proposed, not final. Read it, plan for it, and do not treat it as settled.
Proposed and not final. Nothing here can be enforced against you yet.
GUIDANCE interpreting binding PDPA: System Deployers bear primary responsibility for ensuring the GenAI systems they use meet PDPA obligations, must define purposes (s 18), safeguard new data categories (prompts, outputs, tool activity) (s 24), document policies, and regularly review safeguards, especially for agentic functionality.
From the source
“System Deployers bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA.”
paras 9.1-9.6 (carried into final)
What this connects to
6 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Part of3
- ObligationPurpose Limitation Obligation (s 18)Binding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- ObligationProtection Obligation (s 24)Binding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- ObligationAccountability Obligation (s 11)Binding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
Cites1
Cited by2
- SectionDeployment, Data Protection Responsibilities of Generative AI StakeholdersGuidance
Structural decomposition of the source instrument
- ConceptAgentic Functionality Heightens Data Protection RiskConsultation
Agentic-risk guidance directed at System Deployers (para 9.5-9.6)
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.