Use this page to classify whether a processing activity is handled as an organisation activity, an excluded boundary, or data intermediary processing on behalf of a customer.
The practical output is a role-and-scope record that identifies the actor, the written contract or exclusion relied on, the PDPA obligations that remain, and the evidence needed before launch or vendor approval.
Structured answer sets in this page tree.
Cited legal and guidance references.
The Singapore PDPA scope question is not just whether personal data exists. Teams need to record who controls the purpose and means of processing, whether any statutory exclusion applies, whether the data is only business contact information, and whether a vendor is processing personal data on behalf of and for the purposes of another organisation under a written contract.
Start with the PDPA Act definitions. An organisation can include an individual, company, association, or body of persons, whether or not formed or recognised under Singapore law or resident or having an office or place of business in Singapore. A data intermediary is an organisation that processes personal data on behalf of another organisation, but does not include an employee of that other organisation.
For implementation, do not classify a whole company once and reuse that answer everywhere. A SaaS provider, payroll vendor, agency, or group company may be a data intermediary for customer data, but an organisation for its own employee records, prospect lists, analytics, billing, security logs, or marketing uses.
The PDPA Act states that Parts 3, 4, 5, 6, 6A, and 6B do not impose obligations on an individual acting in a personal or domestic capacity, an employee acting in the course of employment with an organisation, a public agency, or other prescribed organisations or personal data. That does not mean the organisation can ignore PDPA governance when employees handle personal data for work; it means the employee is not the obligated actor for that employment act.
Business contact information is another boundary to record carefully. Except where business contact information is expressly mentioned, Parts 3, 4, 5, 6, and 6A do not apply to business contact information. The Act defines it as information such as a person's name, position, business telephone number, business address, business email address, business fax number, or similar information, where it was not provided solely for personal purposes.
When a vendor qualifies as a data intermediary for a processing activity, the PDPA does not impose most organisation-facing obligations on that vendor for that activity. The core duties that remain for the data intermediary are the Protection Obligation and Retention Limitation Obligation, plus the duty to notify the organisation or public agency of a data breach without undue delay once it has credible grounds to believe a breach occurred.
The engaging organisation remains accountable for personal data processed on its behalf and for its purposes by the data intermediary as if the organisation processed it itself. The contract record should therefore show what the intermediary may process, what it must not do, what safeguards and deletion/return steps apply, and how breach escalation works.
Use this scope and data intermediary guide to create role records, vendor evidence requests, contract checks, and breach escalation paths inside Sorena.
Convert scope, exclusion, and data intermediary questions into assigned intake fields and evidence requests.
Use Research Copilot to check role allocation, contract evidence, and unresolved PDPA scope assumptions against cited sources.
Review Singapore PDPA role classification, vendor records, and accountable owners with Sorena.
A useful PDPA scope record should be short enough to attach to a procurement ticket, product review, data inventory entry, or incident file, but specific enough that legal, privacy, security, and commercial teams can see why the role classification was made.
Create or refresh the record when a new vendor is onboarded, a customer asks for a processor schedule, a product begins using customer data for analytics or AI features, employee or business contact data is reused, a sub-processor is added, a data flow crosses jurisdictions, or a suspected breach involves a service provider.
"To notify organisation of data breaches without undue delay"
"key considerations for organisations when outsourcing data processing activities to data intermediaries"
"governance and risk assessment, policies and practices, service management and exit management"
"Parts 3, 4, 5, 6, 6A and 6B do not impose any obligation"
"a company may act in both roles for different types of processing activities"