Contracts With IT Vendors: PDPA Clauses for Data Intermediaries

Who counts as a data intermediary under the PDPA

The Personal Data Protection Act 2012 defines a data intermediary as an organisation that processes personal data on behalf of another organisation, other than that organisation's own employee. In plain terms: a vendor that handles your customers' or staff's data because you asked it to, and only for your purposes.

Typical examples for a small business are a web host or developer with access to form submissions, a cloud storage or email provider, a payroll bureau, an outsourced IT support company that can log in to your systems, a CRM or booking platform, and a marketing agency that sends newsletters to your list.

A vendor that uses the data for its own purposes as well (for example, to train its own product or to market to your customers) is not acting only as your intermediary for that use. It then carries the full set of PDPA obligations for it, and you need to ask whether you had consent to share the data that way.

What the PDPA already requires of the vendor

Section 4(2) of the Act limits what applies to a data intermediary that processes personal data for you under a contract that is evidenced or made in writing. PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026) set this out.

Section 4(3) is the part owners forget: you are treated as if you had done the processing yourself. If your web developer leaves a database open and customer records leak, PDPC looks at your arrangements with the developer as well as the developer's security.

The clauses PDPC suggests you put in vendor contracts

PDPC's Guide on Data Protection Clauses for Agreements Relating to the Processing of Personal Data (1 February 2021) gives sample wording you can adapt. It calls the buyer the Customer and the vendor the Contractor. The clauses, in order:

1. 1

   Comply with the PDPA at the vendor's own cost

   A general obligation, so the cost of compliance sits with the vendor.

2. 2

   Process only for your purposes

   Use or disclose the data only to deliver the agreed services, with your prior written consent, or when required by law or court order (with notice to you first where possible).

3. 3

   No transfers outside Singapore without consent

   If you agree to an overseas transfer, ask for a written undertaking that the data will be protected to a standard comparable to the PDPA, passed on to any overseas sub-processor.

4. 4

   Security measures in a schedule

   List the specific measures you expect, such as MFA, encryption, access on a need-to-know basis and staff confidentiality, so they cannot be changed without your consent.

5. 5

   Access and correction on request

   The vendor gives you access to your data and corrects errors when you ask, so you can answer individuals' access and correction requests on time.

6. 6

   Retention, return and deletion

   Keep the data no longer than needed. On request, return or delete it, confirm in writing, and instruct any third parties to do the same.

7. 7

   Breach notification and indemnity

   Tell you immediately on a breach of these clauses, and indemnify you for losses and penalties caused by its breach or negligence, including a subcontractor's.

The guide itself says that using the sample clauses does not by itself make you compliant, and recommends legal advice for anything you are unsure about. This page is general information, not legal advice.

Practical additions for IT and website vendors

The sample clauses are generic. For IT work, a few extra points make them usable when something goes wrong:

• A named breach contact and a time frame. "Without undue delay" is the legal test; a contract can say within 24 hours of discovery, by phone and email, to a named person.
• What the breach notice must contain: what happened, which data and how many records, what the vendor has done, and who is handling it. You need this to assess whether the breach is notifiable.
• A list of sub-processors (hosting, email, backup providers) and notice before adding new ones.
• Admin access stays with you. Domain, hosting, Microsoft 365 or Google Workspace super-admin and payment accounts should be in your name, with the vendor as a separate user you can remove.
• Offboarding steps at the end of the contract: remove the vendor's accounts, rotate shared passwords, return exports in a usable format.

Our IT support contract and SLA checklist and website design contract checklist cover the commercial terms that sit around these clauses.

SaaS tools: checking a vendor's standard DPA

You will not negotiate a contract with Google, Microsoft, Shopify or a booking app. These vendors publish a standard data processing agreement (DPA or data processing addendum), often written for GDPR and applied worldwide. Your job is to read it once, record that you accepted it, and check it covers the points above.

Keep a simple register: vendor, what data it holds, where the DPA is, date accepted, and who owns the account. The same register is the core of a personal data inventory, and it is the first thing you will need if a vendor reports a breach.

When a vendor tells you about a breach

Once the vendor notifies you, the clock is yours. You must assess whether the breach is notifiable (likely to cause significant harm, or affecting 500 or more people). If it is, PDPC must be told as soon as practicable and no later than three calendar days after your assessment, and affected individuals must be told where required.

This is where the contract pays off: a vendor obliged to give you a full account quickly lets you make that assessment on facts. Our guide to PDPA data breach notification walks through the assessment and the PDPC form.

Do it yourself or get help?

If you have only a handful of vendors, you can do this in an afternoon: list them, find each one's DPA or contract, and send PDPC's sample clauses to any local vendor that has nothing in writing. Most reputable vendors will sign them with minor edits.

If you would rather have it done, our PDPA Compliance Pack (S$690) includes a vendor and data inventory, the data protection clauses adapted for your IT and marketing vendors, and the internal policies PDPC expects. It does not replace a lawyer for a complex or high-value contract.