Deployment, Data Protection Responsibilities of Generative AI Stakeholders
Is this legally binding?
Guidance. Voluntary guidance. Best practice, not obligation, until a contract or a regulator cites it.
GUIDANCE interpreting binding PDPA: allocates responsibilities across Model Providers, System Providers and System Deployers, covering Retention Limitation, Protection, Purpose Limitation and Accountability Obligations. Final Guidelines also expressly include dataset collectors/curators.
What this connects to
7 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Part of2
- SectionPart 6, Care of Personal DataBinding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- SectionPart 3, General Rules on Protection of and Accountability for Personal DataBinding
Guideline interprets binding PDPA provision; guideline itself is not legally binding
Cites5
- ConceptGenerative AI Stakeholders: Model Providers, System Providers, System DeployersConsultation
Structural decomposition of the source instrument
- ObligationModel Provider ResponsibilitiesGuidance
Structural decomposition of the source instrument
- ObligationSystem Provider ResponsibilitiesGuidance
Structural decomposition of the source instrument
- ObligationSystem Deployer Primary ResponsibilityConsultation
Structural decomposition of the source instrument
- ConceptAgentic Functionality Heightens Data Protection RiskConsultation
Structural decomposition of the source instrument
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.