Service Provider

Service provider refers to entities that supply digital services, platforms, cloud or infrastructure (including IoT and other networked services) and which may be subject to registration, certification, technical audits and mandatory compliance obligations under the Act. The term is used to determine which operators must implement baseline controls, incident reporting and conformity measures.

Entities providing telecommunications and internet services to the public, including providers obliged to retain specified categories of traffic/access and related data and to respond to motivated judicial orders for access, copying or real‑time collection as set out in the decree.

Domestic or foreign entities that offer online services (such as telecommunications, electronic commerce, social networks, search, cloud services, and other internet-based services) and are required to comply with cybersecurity obligations including security measures, incident reporting, cooperation with authorities, and data management rules.

Any public or private entity that provides the ability to its users to communicate by means of a computer system.

Any person or entity that provides electronic communication services or processes data on behalf of others.

Any entity, public or private, that provides subscribers with the ability to communicate via information technology or processes and stores electronic data on their behalf.

A third‑party organisation that processes personal data on behalf of a client organisation—acting as a data intermediary under the PDPA—such as vendors who build, host or operate AI models. The Guidelines require that such Service Providers implement adequate technical and organisational safeguards and that contracts allocate Protection and Retention obligations and permit audit/attestation rights.