'Data Intermediary' (s 2(1); s 4(2))
Is this legally binding?
Binding. Binding law. It applies to everyone in scope, whether or not anyone points at it.
An organisation that processes personal data on behalf of another organisation. Data intermediaries are directly subject only to the Protection (s 24) and Retention (s 25) obligations plus breach-notification duty; the client organisation keeps full responsibility. Key category for AI service providers.
From the source
“an organisation which processes personal data on behalf of another organisation but does not include an employee of that other organisation”
s 2(1); s 4(2)
What this connects to
4 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Contains2
- SectionPart V, Procurement of AI Systems (B2B Service Providers)Guidance
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- ConceptService Providers as Data IntermediariesGuidance
Guideline interprets binding PDPA provision; guideline itself is not legally binding
Applies to2
- ObligationProtection Obligation (s 24)Binding
Data intermediaries are directly subject to s 24 (and s 25) per s 4(2)
- ObligationRetention Limitation Obligation (s 25)Binding
Data intermediaries are directly subject to s 25 per s 4(2)
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.