The DPO Desk, for Malaysian companies
PDPA compliance work for Malaysian companies, signed off by a human reviewer.
Specialised AI agents prepare the work your Personal Data Protection Act (PDPA) duties create. A human reviewer signs off every output before it reaches you.
Twelve questions, about 5 minutes. Nothing leaves your browser.
Today our founder prepares each piece of work with AI-assisted first drafts; the agent software is still being built.
New in 2025
The PDPA asks more of you.
The amended PDPA adds breach notices on a 72-hour clock, data portability on request, and a Data Protection Officer (DPO) for larger data sets, registered within 21 days.
- HR
- Payroll
- Customers
- CCTV
- Vendors
A breach likely to cause significant harm goes to the Personal Data Protection Commissioner (the Commissioner) as soon as practicable and within 72 hours.
PDPA s.12B; Breach Notification Guideline paras 5.1 and 6.1. As of 21 Oct 2026.
The DPO is registered with the Commissioner within 21 days of appointment.
DPO Guideline para 7.1. As of 21 Oct 2026.
A DPO is required once you hold data on more than 20,000 people, or sensitive data, including financial information, on more than 10,000.
DPO Guideline para 4.2. As of 21 Oct 2026.
See the other duties
The people affected are told without unnecessary delay, and within 7 days after the Commissioner is notified.
Breach Notification Guideline paras 8.1 and 9.1. As of 21 Oct 2026.
People can ask you to send their data to another organisation.
PDPA s.43A, in force 1 Jun 2025. As of 21 Oct 2026.
Access requests are answered within 21 days.
PDPA s.31(1). As of 21 Oct 2026.
Southeast Asia
Data protection law in six Southeast Asian countries
The DPO rule, the breach clock and the penalties, country by country, each linked to the law itself.
MalaysiaPDPA 2010, as amended
Personal Data Protection Act 2010 (Act 709), as amended by Act A1727 (2024)
- DPO rule
- Required where you hold data on more than 20,000 people, more than 10,000 for sensitive data including financial information, or for regular and systematic monitoring. Register within 21 days of appointment.
- Breach clock
- A breach likely to cause significant harm: to the Commissioner within 72 hours (the guideline says "from the occurrence"; its examples count from awareness or confirmation), then to the people affected within 7 days after that.
- Penalties
- Up to RM1,000,000, up to 3 years' imprisonment, or both, for breaching a data protection principle (since 1 April 2025).
Read the lawAs of 21 Oct 2026
SingaporePDPA 2012
Personal Data Protection Act 2012
- DPO rule
- Every organisation designates at least one individual responsible for compliance (often called the DPO) and publishes a business contact for one of them.
- Breach clock
- To the Personal Data Protection Commission (PDPC) no later than 3 calendar days after assessing a breach as notifiable; to affected individuals on or after that, where the breach is likely to cause them significant harm.
- Penalties
- Administrative fines up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, otherwise up to S$1 million.
Read the lawAs of 21 Oct 2026
VietnamLaw on Personal Data Protection 2025
Law on Personal Data Protection No. 91/2025/QH15, with Decree 356/2025/ND-CP
- DPO rule
- Every organisation designates a capable data-protection unit or staff, or hires a provider. Small enterprises and startups may defer this for 5 years and micro-businesses are exempt, unless they sell data-processing services, process sensitive data, or process data on 100,000 or more people.
- Breach clock
- A violation that may harm national defence, national security or public order and safety, or a person's life, health, honour, dignity or property: report to the agency no later than 72 hours after discovering it.
- Penalties
- Administrative fines up to 5% of the previous year's revenue for cross-border transfer violations; 10 times the proceeds for trading in personal data; up to VND 3 billion for other violations.
Read the lawAs of 21 Oct 2026
ThailandPDPA B.E. 2562
Personal Data Protection Act B.E. 2562 (2019)
- DPO rule
- Required for public authorities as the Committee prescribes; where collecting, using or disclosing data requires regular monitoring of personal data or systems because of a large amount of data, as the Committee prescribes; and where the core activity is processing sensitive data.
- Breach clock
- To the Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights; to the people affected without delay if the risk is high.
- Penalties
- Administrative fines up to THB 1 million, 3 million or 5 million per offence, depending on the provision.
Read the lawAs of 21 Oct 2026
IndonesiaLaw 27/2022
Law No. 27 of 2022 on Personal Data Protection
- DPO rule
- An officer is required for public-service processing, for core activities needing regular, systematic, large-scale monitoring, and for core activities processing specific (sensitive) personal data, or data on criminal offences, at large scale.
- Breach clock
- Written notice to the people affected and to the agency within 3 × 24 hours.
- Penalties
- Administrative fines up to 2% of annual income or revenue relating to the violation.
Read the lawAs of 21 Oct 2026
PhilippinesData Privacy Act 2012
Data Privacy Act of 2012 (Republic Act 10173)
- DPO rule
- Every controller designates someone accountable for compliance. With 250 or more employees, sensitive data on 1,000 or more people, or risky processing, register the DPO and processing systems with the National Privacy Commission (NPC) within 20 days.
- Breach clock
- For breaches that meet the notification conditions: the NPC and the people affected within 72 hours of knowing or reasonably believing it happened; the full report within 5 days.
- Penalties
- Administrative fines up to PHP 5 million per act: 0.5–3% of annual gross income for grave violations and 0.25–2% for major ones.
Read the lawAs of 21 Oct 2026
Relief: National Oceanic and Atmospheric Administration (NOAA) ETOPO 2022. Borders: Natural Earth. Both public domain.
Drill. How the Breach station will run once it is built: an illustrative timeline, not a client case.
72 hours to tell the Commissioner.
We drill on the strictest reading: the clock starts when the breach happens, not when someone notices.
"... no later than seventy-two (72) hours from the occurrence of the personal data breach": Breach Notification Guideline para 6.1. Its worked examples (para 6.2) count from when the controller is informed of, realises or confirms the breach. Breach register: para 14.1. As of 21 Oct 2026.
- Hour 0
The breach happens. On the strictest reading, the clock starts now.
- Hour 2
Detected. The Breach station will open the record.
- Hour 6
Contained. IT closes the gap; the station will log what, who and how many.
- Hour 18
Harm assessed. Significant harm likely: notify. If not, it still goes in the breach register.
- Hour 30
Drafted: the Commissioner notice, built from the record.
- Hour 40
Signed off. Our reviewer signs; your accountable person approves.
- Hour 48
Notified. Sent to the Commissioner with a day to spare.
If harm is significant, the people affected are told without unnecessary delay, and within 7 days after the Commissioner is notified.
Readiness check
Twelve questions on seven PDPA duties
For each duty: what the law asks, where you stand, and the source. It is not a score, and nothing leaves your browser unless you choose to send it.
Start with a Readiness Sprint.
A fixed-scope Readiness Sprint, led by our founder, turns this profile into a register, a breach runbook and a fix list in order.
AI agents prepare the work, a human reviewer signs it, and you approve it.