If it is only software provided via which the service provider does not access to personal data, then the provider should not be subject to the Personal Data Protection Act. If, however, the provider can access the personal data, then the provisions relating to "processor", Article 4(1)(6) of the Law, would become applicable. The "processor" refers to legal or natural persons who are entrusted by the data controller for certain data processing relating to personal data. Such parties must abide by the PDPA in their personal data processing. Where such parties act as the proxy of the data controller, then the contract between them should include clauses defining the principles and measures for the PDPA. Such parties should ensure the protection of personal data.