Is 'Data Intermediary' (s 2(1); s 4(2)) legally binding?

Q: Is 'Data Intermediary' (s 2(1); s 4(2)) legally binding?

'Data Intermediary' (s 2(1); s 4(2)) is binding in Singapore. Binding law. It applies to everyone in scope, whether or not anyone points at it. An organisation that processes personal data on behalf of another organisation. Data intermediaries are directly subject only to the Protection (s 24) and Retention (s 25) obligations plus breach-notification duty; the client organisation keeps full responsibility. Key category for AI service providers.

ConceptBinding

'Data Intermediary' (s 2(1); s 4(2))

Is this legally binding?

Binding. Binding law. It applies to everyone in scope, whether or not anyone points at it.

An organisation that processes personal data on behalf of another organisation. Data intermediaries are directly subject only to the Protection (s 24) and Retention (s 25) obligations plus breach-notification duty; the client organisation keeps full responsibility. Key category for AI service providers.

From the source
“an organisation which processes personal data on behalf of another organisation but does not include an employee of that other organisation”
s 2(1); s 4(2)

sso.agc.gov.sg Show it on the map

What this connects to

4 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.

Contains2

SectionPart V, Procurement of AI Systems (B2B Service Providers)Guidance
Guideline interprets binding PDPA provision; guideline itself is not legally binding
ConceptService Providers as Data IntermediariesGuidance
Guideline interprets binding PDPA provision; guideline itself is not legally binding

Applies to2

ObligationProtection Obligation (s 24)Binding
Data intermediaries are directly subject to s 24 (and s 25) per s 4(2)
ObligationRetention Limitation Obligation (s 25)Binding
Data intermediaries are directly subject to s 25 per s 4(2)

Learn this properly

This page tells you what 'Data Intermediary' (s 2(1); s 4(2)) is and whether it binds you. The AI Governance program teaches the whole discipline, with dedicated coverage of the Singapore governance stack and the MAS regime, and every topic is passed by explaining it back in your own words, graded against the source.

See the AI Governance program

Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.

Useful to someone you work with?

Credential program

Earn a verifiable AI governance credential. The first module is free.

Singapore governs AI through guidance, supervisory expectation and one binding data law, which means the hard part is not finding the rule. It is deciding what your organization does when nothing is strictly mandatory and everything is expected.

Certified AI Governance Professional (CAIGP) is fourteen modules of exactly that work: you run an organization through the AI era, make decisions that can fail, and leave with a record an employer can verify.

14 modules, 98 topics, each with a lesson and a graded quiz.
Opens with “Why decisions, not information, will make you the expert”, and the whole first module is free.
The Professor answers your questions inside every topic.
A mastery exam at the end, then a credential anyone you send it to can verify.
Your progress is saved to your account, on any device.

To start

Free

The first module, with a free account. No card is asked for.

Start the first module freeRead the full description

Direct it. Catch it. Prove it. (56 s)

Back to the Navigator

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

What this connects to

Contains2

Applies to2

Learn this properly

Readers of this also ask