This page helps classify whether a processing activity is handled as an organisation activity, an excluded boundary, or data intermediary processing on behalf of a customer.
The practical output is a role-and-scope record that identifies the actor, the written contract or exclusion relied on, the PDPA obligations that remain, and the evidence needed before launch or vendor approval.
Structured answer sets in this page tree.
Cited legal and guidance references.
Singapore PDPA scope depends on more than whether personal data exists. Identify each handling it, the purposes of the activity, any statutory actor or data boundary, and whether a vendor processes personal data on behalf of and for another organisation's purposes under a contract evidenced or made in writing.
Start with the PDPA Act definitions. An can include an individual, company, association, or body of persons, whether or not formed or recognised under Singapore law or resident or having an office or place of business in Singapore. A is an organisation that processes personal data on behalf of another organisation, but does not include an employee of that other organisation.
For implementation, do not classify a whole company once and reuse that answer everywhere. A SaaS provider, payroll vendor, agency, or group company may be a for customer data, but an for its own employee records, prospect lists, analytics, billing, security logs, or marketing uses.
The PDPA Act states that Parts 3, 4, 5, 6, 6A, and 6B do not impose obligations on an individual acting in a personal or domestic capacity, an employee acting in the course of employment with an , a public agency, or other prescribed organisations or personal data. That does not mean the organisation can ignore PDPA governance when employees handle personal data for work; it means the employee is not the obligated actor for that employment act.
is another boundary to record carefully. Except where business contact information is expressly mentioned, Parts 3, 4, 5, 6, and 6A do not apply to business contact information. The Act defines it as information such as a person's name, position, business telephone number, business address, business email address, business fax number, or similar information, where it was not provided solely for personal purposes.
When a vendor qualifies as a for a processing activity, the PDPA does not impose most -facing obligations on that vendor for that activity. The core duties that remain for the data intermediary are the Protection Obligation and Retention Limitation Obligation, plus the duty to notify the organisation or public agency of a data breach without undue delay once it has credible grounds to believe a breach occurred.
The engaging remains accountable for personal data processed on its behalf and for its purposes by the as if the organisation processed it itself. The contract record should therefore show what the intermediary may process, what it must not do, what safeguards and deletion/return steps apply, and how breach escalation works.
This scope and data intermediary guide helps create role records, vendor evidence requests, contract checks, and breach escalation paths in Sorena.
Convert scope, exclusion, and data intermediary questions into assigned intake fields and evidence requests.
Use Research Copilot to check role allocation, contract evidence, and unresolved PDPA scope assumptions against cited sources.
Review Singapore PDPA role classification, vendor records, and accountable owners with Sorena.
A useful PDPA scope record should be short enough to attach to a procurement ticket, product review, data inventory entry, or incident file, but specific enough that legal, privacy, security, and commercial teams can see why the role classification was made.
Create or refresh the record when a new vendor is onboarded, a customer asks for a processor schedule, a product begins using customer data for analytics or AI features, employee or business contact data is reused, a sub-processor is added, a data flow crosses jurisdictions, or a suspected breach involves a service provider.
"To notify organisation of data breaches without undue delay"
"key considerations for organisations when outsourcing data processing activities to data intermediaries"
"governance and risk assessment, policies and practices, service management and exit management"
"Parts 3, 4, 5, 6, 6A and 6B do not impose any obligation"
"a company may act in both roles for different types of processing activities"