Compliance

Service Provider (data intermediary)

Third‑party processors handling personal data for clients.

Definition

A third‑party organisation that processes personal data on behalf of a client organisation—acting as a data intermediary under the PDPA—such as vendors who build, host or operate AI models. The Guidelines require that such Service Providers implement adequate technical and organisational safeguards and that contracts allocate Protection and Retention obligations and permit audit/attestation rights.