PDPA Check-up, Malaysia
Fixed RM1,800 PDPA Check-up
For your chatbots, CRM and AI tools. Start with 5 taps and see where you stand. No email needed to see it.
What kind of business are you?
Our founder reviews and signs every pack. Delivered in 5 working days. Not legal advice.
What the Check-up gives you
- A map of what your chatbots, CRM and AI tools collect, and where the data goes.
- Which providers receive it outside Malaysia, and the ground you rely on (PDPA s.129).
- Your privacy notice checked, in Bahasa Melayu and English (s.7(3)).
- A processor-clause checklist: the points to agree with your vendors and your lawyer.
- A one-page breach-response sheet with the 72-hour notice step (Breach Guideline para 6.1).
- DPO yes or no, against the three thresholds (DPO Guideline para 4.2), and a fix list in order.
- A registration check: whether your business is in one of the 13 classes that must register as a data controller with the Commissioner.
Price
PDPA Check-up
RM1,800 fixed, one-off
Everything above, reviewed and signed by our founder, within 5 working days of the kick-off call.
Scope: one business entity (one SSM registration); its website forms, chatbots, CRM, AI tools, privacy notice, vendor list, breach readiness and data-controller registration. Payment terms in your booking confirmation. Groups with several companies or clinics: tell us how many and we price the group.
DPO Desk (optional)
From RM1,500 a month
Each month we prepare the DPO's work (data register, access-request deadlines, breach drafts, vendor checks) for the DPO you appoint to approve. Terms in your proposal.
Not included
- Legal advice, a certificate, or a promise that you are compliant.
- Acting as your appointed DPO, or filing with the Commissioner for you.
- Changing your tools or contracts: we mark what to change; your team or vendor makes the change.
What you receive
PDPA Check-up · Data map and fix list
1. Data map
2. Fix list, in order
- Fix 1 · Privacy notice: add the transfer outside Malaysia, in BM and English (s.7(3)).
- Fix 2 · AI tool: stop pasting customer data, or record a ground for the transfer.
- Fix 3 · Breach sheet: name who decides on the 72-hour notice.
Reviewed and signed: our founder · date
How it works
- You send your 5 answers and how to reach you. We reply within 1 working day.
- If you book: a 30-minute kick-off call about your tools, vendors and how customer data moves.
- First drafts are prepared with AI tools (an AI model provider), from your policies, settings and data maps. We don't need, and ask you not to send, your customers' records.
- Our founder reviews, corrects and signs every page. The pack reaches you within 5 working days of the call.
Questions
Why look at chatbots, CRM and AI tools first?
They collect names, numbers and messages every day, and often send them to providers outside Malaysia. That is allowed where the destination has a law substantially similar to ours or adequate protection, or on another ground in s.129(3), such as the person's consent (PDPA s.129, as amended by Act A1727; the Commissioner's Cross Border Personal Data Transfer Guideline, 2025). The Check-up records which ground each transfer relies on.
Is this legal advice?
No. We prepare compliance work for your review: maps, drafts, a checklist and a fix list. For a formal legal opinion, we'll refer you to a Malaysian law firm.
Will we be compliant afterwards?
We do not certify or promise compliance. You will know what your tools collect, where the data goes, what is missing and what to fix first.
Do you need our customer records?
No. We work from your tool settings, forms, notices and vendor contracts, and from what you tell us on the call.
Who does the work?
Our founder reviews every page, corrects it and signs it off; nothing reaches you unsigned. To keep the price fixed, first drafts are prepared with AI tools (an AI model provider) from your policies, settings and data maps; we don't need your customers' records. We're a new Malaysian firm, registered with SSM (details at the foot of this page).
Need a formal legal opinion? We'll refer you to a Malaysian law firm.
Sources: PDPA ss.4, 7(3), 12A, 12B, 40, 129 (as amended by Act A1727); DPO Guideline paras 4.2, 4.3, 4.5, 7.1; Data Breach Notification Guideline paras 5.2-5.4, 6.1, 6.2, 8.1, 8.2, 9.1; Personal Data Protection (Class of Data Users) Order 2013 and (Amendment) Order 2016 ("13 Class of Data Controller"); Personal Data Protection Guidelines: Cross Border Personal Data Transfer (CBPDT), v1.0, 29 April 2025 (pdp.gov.my).