From PDPC: Breach of Protection and Openness Obligations by K Box Entertainment

actually the vendor should be responsible as they were the one managing the system. so can i say that if any vendor who failed to implement adequate security measures for a company, r they liable?

You have a point there.

Just that the current Act confines the vendor to just a "Data Intermediary" and as such it just need to meet the protection obligation and retention limitation obligation - instead of all 9 obligations.

<img src=" i.imgur.com/5GK8GYe.gif " alt="" width="769" height="160" />

Source: www.pdpc.gov.sg/docs/default-source/enfo...210416).pdf?sfvrsn=2

&nbsp;