Singapore PDPA Data Intermediaries FAQ

A vendor is a data intermediary when it processes personal data on behalf of another organisation and for that organisation's purposes under a contract that is made or evidenced in writing. The label in the contract helps, but the role follows the actual processing arrangement: who decides the purpose, who controls the permitted use, and whether the vendor is acting within that scope.

Treat the same company role-by-role. A payroll provider may be a data intermediary for customer payroll processing while still acting as an organisation for its own employee records, recruitment, billing, security logs, and marketing activities.

For personal data processed on behalf of and for the purposes of another organisation under a written or evidenced contract, a Singapore PDPA data intermediary is directly subject to the Protection Obligation, the Retention Limitation Obligation, and the obligation to notify the organisation of a data breach without undue delay once it has credible grounds to believe a breach occurred.

That limited direct obligation set does not remove the organisation's accountability. The organisation has the same PDPA obligations for personal data processed by its intermediary as if the organisation processed the data itself.

Define the outsourced processing and safeguards in the contract. PDPC guidance describes the contract as the primary way for the organisation to ensure appropriate protection and retention by the data intermediary, and the Guide to Managing Data Intermediaries says the scope of outsourced processing should be clearly defined and agreed.

The contract evidence should be operational. Keep the processing schedule, security requirements, retention and deletion rules, subcontracting limits, breach reporting route, onboarding material, review meeting records, audit or check results where used, and exit-management evidence. Contract clauses do not transfer the organisation's PDPA responsibility to the intermediary; they define instructions, safeguards, assistance, and evidence for the outsourced processing.

The data intermediary should notify the organisation without undue delay once it has credible grounds to believe a data breach has occurred. The intermediary's job is to escalate fast, preserve facts, support containment, and provide enough information for the organisation to assess whether the breach is notifiable.

The organisation remains responsible for assessing whether the breach is notifiable and, where required, notifying the PDPC and affected individuals. A service agreement should therefore specify the breach contact route, incident information to provide, evidence preservation, containment responsibilities, and update cadence.