Compliance

Service Provider

Entities providing digital, networked or platform services.

How the laws define this

Regulatory frameworks consistently define a service provider as an entity delivering digital, electronic, or information technology services—ranging from telecommunications and cloud infrastructure to online platforms—that must adhere to statutory compliance, security controls, or data management mandates. However, these instruments diverge sharply on the operational scope of the role. Instruments like the Computer Crime Proclamation No. 958/2016 and Decree‑Law No. 2022‑54 on Combating Offences Relating to Information and Communication Systems focus broadly on entities enabling public or subscriber computer communications and retaining access data for legal orders. Similarly, the Cyber Security Act, 2023 (সাইবার নিরাপত্তা আইন, ২০২৩) and Cybersecurity Law target providers of digital platforms, infrastructure, and general online services. Conversely, the Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (PDPC) restricts the concept to third parties processing personal data on behalf of clients, while the Hong Kong Generative Artificial Intelligence Technical and Application Guideline specifically targets organizations deploying generative AI tools as intermediaries between developers and end users.

Synthesised from the 8 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Tunisia	Decree-Law No. 2022-54 of 13 September 2022 on Combating Offences Relating to Information and Communication Systems	In Force	Limits to providers of telecommunications and internet services to the public, with explicit obligations for data retention and responding to judicial orders.
Ethiopia	Computer Crime Proclamation No. 958/2016	In Force	Plainly limits to any public or private entity enabling user communication by means of a computer system.
Maldives	Cyber Security Act	In Force	Includes any person or entity providing electronic communication services or processing data on behalf of others.
Singapore	Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (PDPC)	In Force	Narrowly limits to third-party organisations acting as data intermediaries processing personal data for AI models under PDPA.
Hong Kong	Hong Kong Generative Artificial Intelligence Technical and Application Guideline	In Force	Focuses on organizations deploying generative AI in customer-facing applications as intermediaries between developers and users.
Bangladesh	Cyber Security Act, 2023	Repealed	Encompasses entities supplying digital services, platforms, cloud, infrastructure including IoT, subject to registration and audits.
Vietnam	Cybersecurity Law	Repealed	Covers domestic or foreign entities offering diverse online services like telecom, e-commerce, social networks, and cloud.
Iraq	Draft Informatics Crimes Law	Proposed	Includes any public or private entity enabling communication via IT or processing and storing electronic data for subscribers.

What it triggers

In Tunisia, service providers must retain specified categories of traffic/access and related data and respond to motivated judicial orders for access, copying or real-time collection.source
In Ethiopia, service providers fall under procedural rules for digital evidence and law enforcement in cybercrime investigations.source
In the Maldives, service providers must comply with cybersecurity obligations including standards, incident responses and protections for critical information infrastructure.source

Definitions (8)

Service provider refers to entities that supply digital services, platforms, cloud or infrastructure (including IoT and other networked services) and which may be subject to registration, certification, technical audits and mandatory compliance obligations under the Act. The term is used to determine which operators must implement baseline controls, incident reporting and conformity measures.

Cyber Security Act, 2023 (সাইবার নিরাপত্তা আইন, ২০২৩)Definition 1 of 8

Entities providing telecommunications and internet services to the public, including providers obliged to retain specified categories of traffic/access and related data and to respond to motivated judicial orders for access, copying or real‑time collection as set out in the decree.

Decree‑Law No. 2022‑54 on Combating Offences Relating to Information and Communication SystemsDefinition 2 of 8

Domestic or foreign entities that offer online services (such as telecommunications, electronic commerce, social networks, search, cloud services, and other internet-based services) and are required to comply with cybersecurity obligations including security measures, incident reporting, cooperation with authorities, and data management rules.

Cybersecurity LawDefinition 3 of 8

Any public or private entity that provides the ability to its users to communicate by means of a computer system.

Computer Crime Proclamation No. 958/2016Definition 4 of 8

Any person or entity that provides electronic communication services or processes data on behalf of others.

ސައިބަރ ސެކިއުރިޓީގެ ޤާނޫނުDefinition 5 of 8

Any entity, public or private, that provides subscribers with the ability to communicate via information technology or processes and stores electronic data on their behalf.

مشروع قانون جرائم المعلوماتيةDefinition 6 of 8

A third‑party organisation that processes personal data on behalf of a client organisation—acting as a data intermediary under the PDPA—such as vendors who build, host or operate AI models. The Guidelines require that such Service Providers implement adequate technical and organisational safeguards and that contracts allocate Protection and Retention obligations and permit audit/attestation rights.

Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (PDPC)Definition 7 of 8

Organizations (including platform operators) that deploy generative AI technologies in customer-facing applications and act as intermediaries between developers and end users; the Guideline assigns them responsibilities for content integrity, user consent mechanisms, privacy protection, secure operation, and compliance with applicable laws.

Hong Kong Generative Artificial Intelligence Technical and Application GuidelineDefinition 8 of 8

Not to be confused with

Service provider / intermediary

Service provider/intermediary focuses on entities that host, transmit, store or provide access to digital content or services, while this term covers broader communication or data processing providers.

Digital service provider

Digital service provider specifies ownership or operation of a digital service with data processing control, whereas this term applies more broadly to various service provision entities.

Questions and answers

What obligations do service providers have for data retention in Tunisia?

Under Decree-Law No. 2022-54, service providers must retain specified categories of traffic/access and related data. They must also respond to motivated judicial orders for access, copying or real-time collection.

Does 'service provider' include data processors in the Maldives Cyber Security Act?

Yes, it includes any person or entity that provides electronic communication services or processes data on behalf of others.

What does 'service provider' mean for AI systems in Singapore PDPC guidelines?

It refers to third-party organisations processing personal data on behalf of clients for AI models. The Guidelines describe them as implementing safeguards and having contracts permitting audits.