Data inventory snapshot
The main personal data you hold, where it comes from, where it goes and who can see it, captured at the level needed to judge risk.
PDPA Readiness Assessment
A PDPA readiness assessment is a fixed-fee review of how your organisation handles personal data, measured against the PDPA as amended in 2024. A short, fixed-fee review that tells you where you stand under the amended PDPA and what to do first. It is the right starting point before you commit to an audit, a DPO or a policy rebuild.
PDPA Readiness Assessment
What it is
A structured review of how your organisation collects, uses, shares, secures and keeps personal data, measured against the PDPA as amended in 2024 and the JPDP guidelines. It ends with a readiness rating and a prioritised action plan.
Why organisations need it
The amendments that took effect in 2025 made data protection officers, breach notification to the Commissioner and processor security duties mandatory, and raised penalties to RM1 million or three years' imprisonment. Most organisations have never checked themselves against the new rules. A readiness assessment answers the basic questions quickly: are we registered if we need to be, do we need a DPO, could we notify a breach within 72 hours, and do our notices match what we actually do.
What the engagement covers
Notices and consent
Whether your privacy notices, in both Malay and English as the Act requires, and your consent practices match reality.
DPO and registration
Whether you must appoint a DPO and register as a data controller, and whether you have.
Breach readiness
Whether you could detect, assess and notify a breach within 72 hours.
Processors and transfers
Vendors who handle your data and any transfers outside Malaysia.
Security basics
Access, retention and deletion practices at a practical level.
What the business gets out of it
A clear starting point
You know exactly where you stand before spending on bigger work.
Fixed cost
No open-ended consulting bill.
Board-ready summary
A one-page rating directors can understand.
Prioritised actions
What to fix first, second and later.
A basis for audit
Findings carry straight into a full PDPA Compliance Audit if you need one.
How it works
How the engagement runs
01
Kick-off
Scope, contacts and a short document request.
02
Interviews
Short sessions with HR, sales, operations and IT.
03
Document review
Notices, forms, contracts and policies.
04
Assessment
Rating each area against the amended Act and guidelines.
05
Report and walkthrough
Findings, rating and action plan presented to management.
Deliverables
What you receive
Readiness rating
An overall and per-area rating.
Findings report
Gaps with plain explanations.
Action plan
Prioritised actions with owners and effort.
DPO and registration position
Whether each applies to you.
Management summary
A one-page summary for the board.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
Usually two to three weeks from kick-off to report. The first days go on a short document request and interviews with HR, sales, operations and IT, the middle on reviewing notices, forms and contracts, and the last on the readiness rating and a management walkthrough. Larger or multi-entity organisations take longer.
The readiness assessment is a fixed-fee snapshot that tells you where you stand and what to fix first. The PDPA Compliance Audit is a deeper engagement that tests each obligation against your actual security controls and builds an evidence pack. Many organisations start with readiness and move to the audit for the gaps it finds.
Very little. A list of the systems and forms you use to collect personal data, your current privacy notices and policies, any vendor contracts that involve personal data, and a few hours with the people who run HR, sales, operations and IT. We send a short request list at kick-off.
Yes. We assess your processing against the Commissioner's DPO guideline thresholds and tell you plainly whether an appointment is required, and whether you also need to register as a data controller. If you already have a DPO, we check the appointment has been notified as the guideline requires.
The assessment itself is a consulting service, so it is not claimable. Any training we recommend afterwards, such as PDPA Awareness for staff or DPO training for the person who will own compliance, is HRD Corp SBL-Khas claimable and is quoted separately for that reason.