The PDPA requires practical safeguards for personal data, not a policy folder. We assess your obligations against the controls you actually have, close the gaps in both the documentation and the technology, and leave you with the evidence trail a Commissioner enquiry or a client audit asks for.
Most PDPA work in Malaysia stops at documentation: a privacy notice, a consent form, a policy folder. That satisfies the visible obligations and leaves the Security Principle largely unaddressed, because nobody checked whether the safeguards the policies describe genuinely exist.
This engagement joins the two. We assess your obligations under the PDPA as amended against the controls actually in place, and produce a mapping that shows, obligation by obligation, whether it is evidenced, partial or missing. That covers the Security Principle, retention and disposal, data processor arrangements with your suppliers, data subject rights handling, the data protection officer duty, and the personal data breach notification requirement.
Where documentation is the gap we redraft it: acceptable use, password and authentication, remote and hybrid working, BYOD, incident response, data classification and handling, and increasingly an AI acceptable use position, since staff are pasting customer information into generative AI tools with no guidance either way. Where the control itself is the gap we say so and sequence the fix, because a policy asserting a safeguard that does not exist is worse than no policy at all.
The 2024 amendments raised the documentary and operational bar together. Personal data breaches must now be notified to the Commissioner, and affected individuals told where significant harm is likely. Organisations meeting the prescribed thresholds must appoint a data protection officer. Data processors carry direct obligations for the first time, which changes what your supplier contracts need to say.
None of that is satisfied by a policy folder. Meeting a notification window requires knowing what data you hold, where it is, who can reach it, and having audit logging good enough to establish what an attacker accessed. Those are security controls, and they are what an enquiry examines after the fact.
Commercially, the same evidence keeps being requested by different people. Enterprise clients ask during vendor due diligence. Insurers ask at renewal. Auditors ask during ISO 27001 certification. Building it once, properly, answers all three, which is why we structure the output as an evidence pack rather than a report.
Both halves matter. An organisation with excellent policies and no logging fails in the same place as one with good technology and no documentation.
Every applicable PDPA obligation mapped to the specific control that satisfies it and the evidence that proves it, marked evidenced, partial or missing. This is the artefact auditors and enterprise clients actually ask for.
Whether the practical safeguards genuinely exist: access control and privilege, multi-factor authentication coverage, encryption in transit and at rest, audit logging and retention, backup and recovery, and secure disposal.
A workflow for determining whether an incident is notifiable, who decides, what evidence is required, and how the notification is prepared inside the window, plus an honest assessment of whether your logging would let you establish scope at all.
Acceptable use, password and authentication, remote work, BYOD, incident response, data classification and AI acceptable use, assessed for coverage, currency, internal consistency and enforceability under Malaysian employment practice, then redrafted where needed.
Which suppliers process personal data on your behalf, whether the contractual terms reflect the amended Act, and what your exposure is if one of them is breached. Usually the least documented area on the register.
Records of processing, retention schedule, access review evidence and training records assembled into a single pack that can be produced on request rather than reconstructed under pressure.
The output is designed to be produced on demand, because the moments you need it are the moments you have least time.
A documented mapping of obligations to controls, with dates and owners, is a materially stronger position during a Commissioner enquiry than an assertion that the organisation takes data protection seriously.
Organisations that have built and tested the workflow can make the notification decision under pressure. Those that have not lose their first day debating whether the duty is even engaged.
When an incident involves employee conduct, your position depends on documented, acknowledged, consistently applied policy. Getting that right beforehand is far cheaper than discovering the gap during an industrial relations claim.
Regulator, enterprise client and insurer largely want the same artefacts. Building it once and maintaining it removes a recurring scramble.
Most organisations cannot name every processor holding their customer data. Producing that list, and fixing the contracts, closes a gap the amended Act made considerably more pointed.
Most breaches of policy are people guessing. Clear direction on whether a customer list may go to a personal address, or client data into an AI tool, removes the guessing.
Four to six weeks depending on the size of the existing policy set and how much needs drafting from scratch.
We gather everything: policies, standard operating procedures, the employee handbook, IT guidance, supplier contracts and any relevant employment contract clauses. Obligations are usually scattered across several documents, and locating them all is the first finding.
What personal data you hold, where it lives, who can reach it and which suppliers process it, alongside a review of the technical controls protecting it. Interviews with IT, HR and business users establish how work actually happens rather than how it is documented.
Each obligation assessed against the control and the evidence, and each policy assessed for coverage, currency, consistency and enforceability. Findings are graded so a genuine control gap is distinguishable from a drafting improvement.
We redraft deficient documents and write the missing ones, sized to your organisation, and sequence the technical fixes where the control rather than the paperwork is the gap.
We build the breach notification decision workflow and walk your team through it against a worked scenario, because the first time you use it should not be during a live incident. Deeper testing is covered by incident response planning.
Support through management approval, employee communication and acknowledgement capture, then a policy register recording owner, approval date and review frequency so the set does not silently drift out of date again.
Everything in editable format and owned by you. There is no licensing on documents that govern your own organisation.
Every applicable obligation with its satisfying control, the supporting evidence, and a status of evidenced, partial or missing.
Findings graded by regulatory exposure and effort to close, covering both documentation and technical controls.
Acceptable use, password and authentication, remote work, BYOD, incident response, data classification and AI acceptable use, drafted for your organisation.
Decision workflow, evidence checklist and draft notification templates for the Commissioner and for affected individuals.
Records of processing, retention schedule, processor register and training records, assembled and ready to produce.
A register recording owner, approval date and next review for each document, plus a short compliance position summary for management or the audit committee.
Any organisation holding Malaysian personal data whose compliance work has so far been documentation-led, which is the large majority.
Sectors handling volume or sensitivity of personal data carry the sharpest exposure, particularly where a regulator or major client audits controls.
Smaller organisations usually need documents drafted from scratch. Larger ones usually have too many documents saying inconsistent things, which is a different problem.
Compliance and IT have to be in the room together, which is precisely the combination most organisations have never convened.
This is the service closest to what Orbix has always done. Compliance is the practice the rest of the cybersecurity work grew out of.
We work the compliance and the control together, which is the whole point. Plenty of firms will produce a policy pack and plenty will review your technology; the gap that causes problems is between them, where a policy asserts a safeguard nobody verified. Our mapping ties every obligation to a control and to evidence, which is the form an enquiry, an auditor and an enterprise client all ask for.
Documents are drafted to the size of the organisation and to be enforceable in a Malaysian employment context. Where a policy would be unenforceable in practice we say so and propose something workable, and where the honest answer is a technical fix rather than a paragraph we sequence that instead.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Because the same practice provides outsourced DPO services and HRD Corp claimable training, the appointment duty and the staff training obligation can be met through one relationship, with the training portion claimable for levy-contributing employers under SBL-Khas.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
