Eligibility assessment
Class, business form and licence analysis for each entity.
JPDP Registration Support: Data Controllers and DPOs
JPDP registration support is a fixed-scope service that confirms which of your entities must register as data controllers, and registers appointed DPOs, through JPDP's SPDP system. Two filings on JPDP's SPDP system trip organisations up: registering as a data controller, and registering the DPO once appointed. We check what each entity must file, prepare and submit it, and keep renewals and DPO changes from slipping.
JPDP Registration Support
What it is
A fixed-scope service to confirm registration obligations under Circular 1/2026 and the Class of Data Users Orders, register appointed DPOs with the Commissioner, prepare and submit everything through SPDP, and manage renewals and changes.
Why organisations need it
Circular 1/2026, in force since 1 June 2026, restates who must register: businesses in commercial transactions within a listed class, operating as a sole proprietorship, partnership, private limited or public company. Processing without a valid certificate is an offence carrying a fine of up to RM500,000, up to three years' imprisonment, or both, and continuing to process after a certificate lapses is a separate offence. Separately, where a DPO must be appointed, JPDP requires the data controller to notify the Commissioner within 21 days of the appointment by registering the DPO on SPDP, with a dedicated business email for the DPO and the appointment letter uploaded.
What the engagement covers
Application preparation
Supporting documents and SPDP submission.
DPO registration
Registering the appointed DPO on SPDP within 21 days, with the dedicated business email and appointment letter JPDP requires.
Per-licence registrations
Separate registrations where each regulatory licence requires one.
Renewals
Calendar and filing within the 90 days before expiry.
Certificate display and records
Display at the principal place of business and a registration register.
Change management
New entities, licences, restructures and changes of DPO.
What the business gets out of it
Certainty
A clear yes or no for each entity.
No lapses
Renewals tracked for you.
Low cost
Fixed fee for a narrow task.
Group view
One register for all entities.
A first step
A natural start before a wider PDPA review.
How it works
How the engagement runs
01
Document request
Licences, business registration and group structure.
02
Assessment
Registration obligations per entity.
03
Preparation
Applications and supporting documents.
04
Submission
Filing through SPDP and tracking.
05
Renewal management
Ongoing calendar and reminders.
Deliverables
What you receive
Registration assessment
Per entity and licence.
Submitted applications
With supporting documents.
Registration register
Certificates, DPO registrations, expiry dates and owners.
Renewal calendar
Dates and reminders.
Change checklist
Events that require updates.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
No. Under Circular 1/2026, registration applies to data controllers in commercial transactions within the listed classes of data users, operating as a sole proprietorship, partnership, private limited or public company. Many businesses fall outside those classes. We check each entity and licence and give you a clear yes or no.
JPDP requires the data controller to notify the Commissioner within 21 days of appointing a DPO, by registering the DPO on SPDP with a dedicated business email for the DPO and the appointment letter uploaded. We prepare the email set-up, the appointment letter and the submission so the deadline is not missed.
Circular 1/2026 states that a complete application is considered within fourteen working days. The word that matters is complete: missing documents restart the clock. We assemble the supporting documents before submission so the application goes in complete the first time.
JPDP fees are RM100 to RM400 a year depending on your business form, for certificates of one to five years. Our service fee is separate and fixed for the scope agreed, covering the eligibility assessment, preparation, submission and a renewal calendar.
Generally yes. Registration follows each licence issued by your sector regulator, so an entity holding several licences may need several registrations. The Services class is the exception. We map each licence to its registration obligation in a single register for the whole group.
Continuing to process personal data after a certificate expires is a separate offence, so treat it as urgent. We prioritise the renewal, check whether any other entities are in the same position, and set up a renewal calendar so filings go in within the 90 days before expiry from then on.