Use this page to separate organisation and data intermediary responsibilities under the Singapore PDPA when personal data is processed for another organisation under a written or evidenced contract.
The practical focus is role classification, protection and retention duties, organisation accountability, breach escalation to the organisation, contract terms, and evidence records.
Structured answer sets in this page tree.
Cited legal and guidance references.
Under the Singapore PDPA, a data intermediary processes personal data on behalf of another organisation and for that organisation's purposes. For that processing, the intermediary has narrower direct PDPA duties than the organisation, but those duties still need clear contracts, operational controls, incident reporting, and exit records.
Start with the processing activity, not the vendor label. A supplier, affiliate, cloud provider, print house, courier, payroll provider, or support vendor may be a data intermediary for one activity if it processes personal data on behalf of and for the purposes of another organisation.
The boundary changes if the supplier uses or discloses the personal data outside the remit granted by the organisation. In that case, the supplier is no longer acting only as a data intermediary for that use or disclosure and may have to comply with the full set of Data Protection Provisions for that activity.
For processing performed on behalf of and for the purposes of an organisation under a written or evidenced contract, the data intermediary is directly subject to the Protection Obligation, the Retention Limitation Obligation, and the duty to notify the organisation of data breaches.
The organisation remains accountable for personal data processed on its behalf as if it processed the data itself. That means the organisation should perform due diligence, define the outsourced processing scope, approve security and retention requirements, and supervise the intermediary through reports, meetings, audits, or inspections where proportionate.
The contract or written evidence should make the intermediary's obligations reviewable. At minimum, the record should identify the processing scope, prohibited uses, required protection measures, subcontracting limits or approval rules, incident and abnormality reporting, overseas-transfer controls where relevant, and return, deletion, destruction, or anonymisation at exit.
Operational procedures should make the contract executable. For higher-risk or larger processing, document onboarding, training, management reporting, regular review meetings, proactive monitoring, audit rights, on-site inspection rights, incident investigation, and tested breach response steps.
Keep owner records practical and limited to the controls the PDPC guidance supports. The record should prove that the organisation scoped the outsourcing, selected a capable intermediary, put written obligations in place, monitored performance, handled incidents, and completed exit actions.
For the intermediary, the record should prove that it implemented the agreed procedures for the organisation's processing rather than reusing the data for its own purposes. Keep proof close to the control: security test results with protection measures, incident timestamps with breach escalation, and deletion or anonymisation evidence with retention controls.
Use this guide to convert intermediary role boundaries into contract clauses, SOPs, breach escalation paths, retention controls, and evidence requests inside Sorena.
Turn intermediary roles, contracts, protection controls, retention steps, and breach escalation into assigned assessment work.
Use Research Copilot to check the PDPC guidance behind intermediary obligations and contract controls.
Review vendor scope, written obligations, breach escalation, retention evidence, and accountable owner records with Sorena.
"if B uses or discloses personal data in a manner which goes beyond the processing required"
"sample data protection clauses that an organisation may include in their Service Agreements"
"identify, prepare for, and manage data breaches"
"the DI Management Lifecycle, namely (A) Governance and Risk Assessment, (B) Policies and Practices, (C) Service Management, and (D) Exit Management"