We do PDPA compliance, as an engineering job.

Yes. We deliver on-site PDPA awareness training for the people who actually touch personal data all day — reception, HR, sales, delivery, customer service — in short, focused sessions, in English, Malay or Mandarin. The worked examples are your own systems and your own forms, not a generic slide deck about the GDPR. A session covers four things: what counts as personal data in this company, what may and may not be done with it in the situations that come up weekly, who to tell immediately when something goes wrong, and why nobody is in trouble for reporting it in the first hour.

Only above the Commissioner’s thresholds, and a good number of Malaysian SMEs sit below them. Under the Guideline on Appointment of Data Protection Officer, appointment is mandatory if you process the personal data of more than 20,000 data subjects, or sensitive personal data — including financial information — of more than 10,000 data subjects, or if your processing requires regular and systematic monitoring. That third limb is the one that surprises people: CCTV, tracking and behavioural profiling can pull in a company well under either headcount. Note also that the duty is not the data controller’s alone — a data processor handling personal data on someone else’s behalf has its own obligation under section 12A(2). Where you are appointing, the officer is registered with the Commissioner within 21 days, a change within 14 days, and the business contact details published on your site, in your privacy notice and in your security policies. If you are below all three thresholds we will tell you so, and you should not buy a DPO from us or from anyone else — but do keep the written record of why you concluded that, which the guideline asks for and which is the only thing that makes the decision defensible two years later.

Since 30 April 2026, yes, if you cross either quantitative threshold in the Commissioner’s DPIA Guideline — processing expected to involve more than 20,000 data subjects, or sensitive personal data including financial information of more than 10,000 data subjects. Those are the same two figures that make a DPO mandatory, so the practical rule is simple: if you needed a DPO, you now need impact assessments too. Below the numbers it becomes a judgement your DPO has to make against qualitative factors — systematic monitoring, AI, children’s data, anything with a significant effect on someone’s finances, health, reputation or access to services. One trigger overrides the numbers entirely: automated decision-making or profiling requires a DPIA regardless of scale. A completed assessment is valid for two years, the residual risk is reported to senior management, and the records outlive the project by at least two years.

Two people, and deliberately so. Beston Tan Yon Chin — an external consultant, not one of our staff — is a law lecturer who previously practised as a litigation lawyer, and he grounds what the Act requires and why. One of our engineers grounds what that means inside the systems your team touches: which screen, which form, which chat group. Most PDPA training fails on one side or the other, either a legal briefing nobody can act on or an IT talk that gets the obligation wrong. Note what this is and is not: he is teaching the law, not acting as your lawyer, and the session is not legal advice on your circumstances. For that you need a practising lawyer with a current certificate, and we will tell you when you have reached that point.

We quote after a free scoping call rather than before it, because the price is driven by how many systems hold personal data and how many people touch them, and neither is knowable from a website. What is fixed is the shape: the data inventory workshop is quoted as a fixed fee before it starts, and it produces a register and a written gap list that are yours whether or not you continue with us. Remediation and training are quoted separately against that gap list, so you are never asked to approve a number for work nobody has scoped yet.

The company itself, no — we hold data for many of our clients, and a processor supervising its own processing is exactly the conflict the guidelines are written to prevent. What we can field is a named individual: Beston Tan Yon Chin, an external consultant — the law lecturer who co-delivers our training — contracted through ZYNTEIRO, notified to the Commissioner as your DPO and reporting directly to your management rather than through us. We decline that appointment entirely for any company whose systems we operate, and we tell you plainly that ZYNTEIRO pays him. Our first recommendation is still an internal appointment — someone in operations, finance or HR with genuine executive backing, because they can stop something and an outsider cannot. The external option exists for the common case where nobody inside has the calendar time, and that stalls the appointment altogether.

The inventory workshop comes first, on site, because every other obligation is downstream of knowing what personal data you hold. Remediation of what it finds follows, and how much there is depends entirely on how much sits in systems versus in habits. Training runs alongside. The DPO appointment and the breach route are deliberately put in place early rather than at the end, because those are the two that carry a statutory clock. Impact assessments come after the inventory and before any new system goes live — a DPIA is meant to be done in advance, so one written after launch is a report rather than an assessment. Compliance is not a state you reach and keep, though: the register goes stale within months, a DPIA expires at two years, a transfer assessment at three, and the Commissioner has proposed a further round of amendments to the regulations. That is why the engagement ends with a review cadence rather than a certificate.

No — and a law lecturer co-delivering the training does not change that, because teaching what the Act requires is not the same thing as advising you on your own circumstances. We are an IT and operations company, and the work is operational: finding where personal data is, writing down what happens to it, fixing the systems that hold it, and training the people who handle it. Where a question is genuinely legal — whether a particular consent clause is adequate, how to answer an enforcement notice, what a contract with a processor must say — we will tell you it is a lawyer's question and stop. Most SMEs need one conversation with a lawyer and a great deal of the operational work; the common mistake is buying it the other way round.

It makes the inventory longer and the remediation more interesting, which is normal. Personal data in an SME is rarely in one place: it is in the ERP, in a shared drive, in an export somebody made in 2023, and in a WhatsApp group where identity-card photographs get forwarded. We can implement retention, access control and deletion inside Odoo and on your file storage directly, because we operate those systems for other clients. The WhatsApp group is a training and policy problem, and it is usually the one that matters most.