Part 3, General Rules on Protection of and Accountability for Personal Data
Is this legally binding?
Binding. Binding law. It applies to everyone in scope, whether or not anyone points at it.
Baseline accountability rules: organisations are responsible for personal data in their possession or control, must designate a responsible individual (DPO), and must develop and communicate compliance policies and practices (ss 11-12).
What this connects to
5 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Contains2
- SectionPart IV, Deployment: Collection and Use of Personal Data in AI SystemsGuidance
Guideline interprets binding PDPA provision; guideline itself is not legally binding
- SectionDeployment, Data Protection Responsibilities of Generative AI StakeholdersGuidance
Guideline interprets binding PDPA provision; guideline itself is not legally binding
Cites3
- ObligationAccountability Obligation (s 11)Binding
Structural decomposition of the source instrument
- ObligationDesignated Individual / DPO Requirement (s 11(3)-(5))Binding
Structural decomposition of the source instrument
- ObligationPolicies and Practices Obligation (s 12)Binding
Structural decomposition of the source instrument
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.