Which term is listed as not within the scope of the Data Privacy Act?

Which term is listed as not within the scope of the Data Privacy Act?

• A. Intermediary
• B. Third party
• C. Profiling
• D. Security incident

Answer: (A)

The Data Privacy Act governs how personal data is processed and who is responsible for that processing, covering activities like sharing with third parties, profiling to derive inferences, and handling security incidents. An intermediary, in this context, is seen as a service that simply facilitates transmission or storage without deciding the purposes or means of processing or accessing the data content. Because the Act focuses on entities that control or process personal data, a pure intermediary that doesn’t process data on behalf of a controller falls outside its processing scope. If an intermediary actually processes data on behalf of a controller, then it becomes a data processor and would be within scope, but that distinction hinges on control and purpose. The other terms describe concrete processing or obligations under the Act, so they are within scope.

The Data Privacy Act governs how personal data is processed and who is responsible for that processing, covering activities like sharing with third parties, profiling to derive inferences, and handling security incidents. An intermediary, in this context, is seen as a service that simply facilitates transmission or storage without deciding the purposes or means of processing or accessing the data content. Because the Act focuses on entities that control or process personal data, a pure intermediary that doesn’t process data on behalf of a controller falls outside its processing scope. If an intermediary actually processes data on behalf of a controller, then it becomes a data processor and would be within scope, but that distinction hinges on control and purpose. The other terms describe concrete processing or obligations under the Act, so they are within scope.