Data inventory snapshot
The main personal data you hold, where it comes from, where it goes and who can see it, captured at the level needed to judge risk.
Data Protection / Readiness
PDPA Readiness Assessment
A short, fixed-fee review that tells you where you stand under the amended PDPA and what to do first. It is the right starting point before you commit to an audit, a DPO or a policy rebuild.
Overview
PDPA Readiness Assessment
What it is
A structured review of how your organisation collects, uses, shares, secures and keeps personal data, measured against the PDPA as amended in 2024 and the JPDP guidelines. It ends with a readiness rating and a prioritised action plan.
Why organisations need it
The amendments that took effect in 2025 made data protection officers, breach notification to the Commissioner and processor security duties mandatory, and raised penalties to RM1 million or three years' imprisonment. Most organisations have never checked themselves against the new rules. A readiness assessment answers the basic questions quickly: are we registered if we need to be, do we need a DPO, could we notify a breach within 72 hours, and do our notices match what we actually do.
Key features
What the engagement covers
Notices and consent
Whether your privacy notices, in both Malay and English as the Act requires, and your consent practices match reality.
DPO and registration
Whether you must appoint a DPO and register as a data controller, and whether you have.
Breach readiness
Whether you could detect, assess and notify a breach within 72 hours.
Processors and transfers
Vendors who handle your data and any transfers outside Malaysia.
Security basics
Access, retention and deletion practices at a practical level.
Business value
What the business gets out of it
A clear starting point
You know exactly where you stand before spending on bigger work.
Fixed cost
No open-ended consulting bill.
Board-ready summary
A one-page rating directors can understand.
Prioritised actions
What to fix first, second and later.
A basis for audit
Findings carry straight into a full PDPA Compliance Audit if you need one.
How it works
How the engagement runs
01
Kick-off
Scope, contacts and a short document request.
02
Interviews
Short sessions with HR, sales, operations and IT.
03
Document review
Notices, forms, contracts and policies.
04
Assessment
Rating each area against the amended Act and guidelines.
05
Report and walkthrough
Findings, rating and action plan presented to management.
Deliverables
What you receive
Readiness rating
An overall and per-area rating.
Findings report
Gaps with plain explanations.
Action plan
Prioritised actions with owners and effort.
DPO and registration position
Whether each applies to you.
Management summary
A one-page summary for the board.
Who it is for
Who this is built for
Industries
Company sizes
Departments
Why Orbix
Why organisations choose Orbix
A governance approach, not a tool sale
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Recommendations you can actually implement
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Consultants who have sat on your side of the table
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Built for the Malaysian operating context
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
HRD Corp expertise where it applies
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
Questions
Questions we get asked
How long does it take?
Usually two to three weeks from kick-off to report, depending on the size of the organisation.
How is this different from the PDPA Compliance Audit?
The readiness assessment is a fixed-fee snapshot of where you stand. The audit is a deeper engagement that tests obligations against actual security controls and builds an evidence pack.
Do we need to prepare anything?
A list of the systems and forms you use, your current notices and policies, and time with a few key people.
Will you tell us if we need a DPO?
Yes. We assess it against the Commissioner's DPO guideline thresholds and tell you plainly.
Is it HRD Corp claimable?
The assessment is a consulting service. Any training we recommend afterwards is HRD Corp SBL-Khas claimable.
Get started
Find out where you stand
Tell us your industry, headcount and the main personal data you handle. We will confirm the fixed fee and a start date.