Singapore PDPA Scope, exclusions, and data intermediaries

Start with the PDPA Act definitions. An organisation can include an individual, company, association, or body of persons, whether or not formed or recognised under Singapore law or resident or having an office or place of business in Singapore. A data intermediary is an organisation that processes personal data on behalf of another organisation, but does not include an employee of that other organisation.

For implementation, do not classify a whole company once and reuse that answer everywhere. A SaaS provider, payroll vendor, agency, or group company may be a data intermediary for customer data, but an organisation for its own employee records, prospect lists, analytics, billing, security logs, or marketing uses.

The PDPA Act states that Parts 3, 4, 5, 6, 6A, and 6B do not impose obligations on an individual acting in a personal or domestic capacity, an employee acting in the course of employment with an organisation, a public agency, or other prescribed organisations or personal data. That does not mean the organisation can ignore PDPA governance when employees handle personal data for work; it means the employee is not the obligated actor for that employment act.

Business contact information is another boundary to record carefully. Except where business contact information is expressly mentioned, Parts 3, 4, 5, 6, and 6A do not apply to business contact information. The Act defines it as information such as a person's name, position, business telephone number, business address, business email address, business fax number, or similar information, where it was not provided solely for personal purposes.

When a vendor qualifies as a data intermediary for a processing activity, the PDPA does not impose most organisation-facing obligations on that vendor for that activity. The core duties that remain for the data intermediary are the Protection Obligation and Retention Limitation Obligation, plus the duty to notify the organisation or public agency of a data breach without undue delay once it has credible grounds to believe a breach occurred.

The engaging organisation remains accountable for personal data processed on its behalf and for its purposes by the data intermediary as if the organisation processed it itself. The contract record should therefore show what the intermediary may process, what it must not do, what safeguards and deletion/return steps apply, and how breach escalation works.

A useful PDPA scope record should be short enough to attach to a procurement ticket, product review, data inventory entry, or incident file, but specific enough that legal, privacy, security, and commercial teams can see why the role classification was made.

Create or refresh the record when a new vendor is onboarded, a customer asks for a processor schedule, a product begins using customer data for analytics or AI features, employee or business contact data is reused, a sub-processor is added, a data flow crosses jurisdictions, or a suspected breach involves a service provider.