A Malaysian law firm, acting as your Data Protection Officer.
Appointing a DPO became mandatory for most sizeable Malaysian organisations in June 2025. We take the appointment: named, registered with the Commissioner, independent of your operations and answerable to your board.
The PDPA changed in 2025. Here's what it means for you.
The Personal Data Protection (Amendment) Act 2024 came into force in three phases. It raised the penalties and set a clear standard for who must appoint a DPO. Two penalties are often confused; the difference is worth getting right.
Administrative
“Data User” becomes “Data Controller”; processors gain direct obligations.
Penalties & cross-border
Fines raised to RM1m; biometric data made sensitive; whitelist removed.
DPO & breach
Mandatory DPO; breach notification within 72 hours of awareness; data portability.
DPIA & ADMP
Automated decisions trigger a mandatory DPIA, with no volume exemption.
Sources: PDPA (Amendment) Act 2024; PDPD Guidelines: DPO Appointment (Feb 2025), DPO Competency (Aug 2025), DPIA/ADMP (Apr 2026). Last reviewed August 2026.
If any one of these is true, appointment is mandatory.
You don't need to meet all three; a single condition triggers the obligation. Most groups handling customer, payment, HR or health data cross at least one.
Not sure where you land? Try the quick check below, or simply ask us.
Practical work products, not advice in the abstract.
A defined set of documents and systems a regulator, client or auditor can actually see. Every engagement builds these.
PDPA Gap Assessment
Department-level scoring across 10 control areas, with written recommendations.
Data Inventory & RoPA
A living Record of Processing Activities, the first thing a regulator asks to see.
Bilingual Policy Suite
Master handbook, notices, SOPs and DPA clauses, in English and Bahasa Malaysia.
72-Hour Breach Playbook
A detection-to-notification plan, drilled with your team until it's second nature.
DPIA / DPbD / ADMP
Risk screening for new and automated processing, cleared before it goes live.
Vendor & Cross-Border
DPA templates, due-diligence checklists and transfer safeguards for data leaving Malaysia.
Training & Awareness
A 10-module PDPA e-learning library plus live board and management sessions.
Proprietary Tools
In-house DPIA and assessment platforms, built by us, not licensed.
Not sure where you stand? Take a look.
Set your data footprint below for an indicative read on whether a DPO is mandatory and what obligations apply. It's a guide, not legal advice, but it's a useful starting point before we talk.
Your data footprint
Answer three quick questions.
Indicative guide only, not legal advice. Thresholds under the PDPA (Amendment) Act 2024. Book a consultation to confirm your exact obligations.
Two tools we built ourselves.
We didn't just read the guidelines; we built practical software around them. Both are free to start and follow the regulator's own methodology.
Prepare a DPIA in the regulator's own template
Structures your inputs into Annex A of the PDPD's DPIA Guideline (v1.0, 30 April 2026): 35 questions, the DEICA methodology, an audit-ready draft download.
Open the DPIA Assistant →A 15-minute PDPA compliance assessment
67 questions across 10 categories produce a readiness score and a prioritised action plan. No registration to start; instant results.
Take the assessment →Six areas, one bundled function.
Delivered as a single retained appointment, scoped to your organisation's size, sectors and data footprint.
Core Scope
- Named DPO appointment
- Liaison with the Commissioner
- PDPA compliance advisory
- Frontline data-subject requests
Risk & Compliance Review
- PDPA gap assessment
- Remediation advisory
- DPIA support for high-risk work
Policy & Training
- Privacy notices & internal policies
- IT / security policy drafting
- Compliance handbook
Third-Party Compliance
- PDPA clauses for vendor contracts
- Third-party due diligence
- Cross-border transfer safeguards
Incident & Breach
- 24/7 on-call data breach hotline
- Data Breach Notification (DBN)
- Recovery & post-incident review
Monitoring & Reporting
- Quarterly compliance reviews
- Internal spot checks / audits
- Annual PDPA report to the board
Our strategic partners in PDPA compliance and cybersecurity.
PDPA compliance isn't just a legal checklist. It's a security issue. We work with established specialists, each trading for more than 20 years, to deliver a stronger, well-rounded compliance framework while we act as your dedicated DPO.
LGMS Berhad: Malaysia's first listed cybersecurity services company
LGMS is the trusted partner for cybersecurity testing, compliance assessments, ISO/IEC 27001:2022 evaluations, and digital forensics. They help you stay ahead of threats by aligning your security posture with global standards and delivering enterprise-grade protection.
VLAN Asia: IT solutions and managed security, in Malaysia since 2003
VLAN is the go-to provider of CyberShield for Business, delivering advanced email security and anti-virus, endpoint protection, firewall defence, and remote backups. They protect your operations with scalable solutions that keep your business running securely and efficiently.
AhnLab: Korean cybersecurity software, listed on KOSDAQ since 2001
AhnLab is a trusted provider of advanced cybersecurity solutions and services for consumers, enterprises, and small to medium businesses across Malaysia and globally. It delivers a comprehensive security portfolio that includes proven antivirus protection for desktops and servers, mobile security, online transaction security, network security appliances, and expert consulting services.
Meet Edwin Lee.
Protecting personal data isn't only about following the law; it's about safeguarding the trust your clients, partners and teams place in you.
Edwin has spent 15 years helping organisations of every size navigate the PDPA with confidence, from policy to practice, and from paperwork to people. He leads ELP's DPO practice and appears regularly in the media on data protection.
The Commissioner has published what a DPO must be.
Two guidelines set out what is expected of a Data Protection Officer: one to be appointed, one to be competent. This is how we read against both.
Why clients trust Edwin
- Based in Malaysia. Physically present at least 180 days each year.
- Easy to reach by phone, email and messaging. Fast response.
- Fluent in Bahasa Malaysia and English. Proficient in Mandarin and local dialects.
- Deep familiarity with the PDPA and data protection laws in the region.
- Hands-on understanding of business operations and IT security across finance, technology, healthcare and retail.
- Co-author, Beyond Data Protection: Strategic Case Studies and Practical Guidance (Springer, ISBN 978-3-642-33080-3).
- Certified in AI governance and emerging technologies.
- Featured in The Star, The Edge, The Sun, NTV7, CHIP Magazine and DataGuidance.
- Expert contributor to OneTrust DataGuidance (UK).
- Promotes a strong data protection culture through training and written publication.
- LL.M research on Malaysia's PDPA, University of Malaya (2010).
- Malaysian Rising Star and Asia 40 under 40, Asian Legal Business (2020).
- Young Lawyer of the Year 2020 (Finalist), ALB Malaysia Law Awards.
- No conflict of interest with current roles.
- Reports directly to top management.
- Empowered to act independently, with integrity, strong ethics and sound governance (a lawyer by profession).
These criteria follow the Guideline on the Appointment of Data Protection Officers, issued by the Personal Data Protection Department of Malaysia in February 2025.
How Edwin and the team meet the DPO competency criteria (KSA model)
- Deep understanding of the PDPA, data subject rights, breach protocols, DPIAs and data security.
- Up to date on regulatory developments and enforcement.
- Co-author of a data protection textbook. Regular contributor to respected publications.
- Supported 50+ organisations across finance, technology, healthcare, manufacturing and retail.
- Conducts gap assessments, audits, DPIAs and breach response exercises.
- Drafts and updates policies, notices, SOPs and governance documents.
- Delivers training, briefings and workshops for teams and leadership at all sizes.
- Advises on PDPA and IT security practices that align with business operations.
- Manages regulator communications and prepares submissions to the Commissioner when required.
- Translates complex legal duties into practical procedures your team can use.
- Builds internal PDPA capability: templates, workflows, awareness programmes and periodic reviews.
- Provides end-to-end compliance support, from onboarding to audit readiness and continuous improvement.
- Helps embed a strong data protection culture across the organisation.
These criteria follow the Guideline on DPO Competency, issued by the Personal Data Protection Department of Malaysia in August 2025.
Currently, the appointed DPO for listed companies and MNCs.
ELP currently acts as Primary or Secondary Data Protection Officer across the sectors below. Client identities are anonymised for confidentiality.
ELP acts as Primary or Secondary DPO for each engagement listed.
Board and staff briefings, in the room and at the desk.
Part of the DPO function is making the obligations legible to the people who handle data every day. Sessions run from board level down to operational teams, and a self-paced video library covers everyone else.
All four photographs are cropped so that no attendee is identifiable.
Ten modules, one PDPA-compliant workforce
A self-paced video library built in-house and included in the engagement. Developed and presented by Edwin Lee and Wong Shen Ming, with a certificate on completion.
Writing and speaking on data protection passionately since 2010.
Edwin's LL.M research examined the Personal Data Protection Bill before it was enacted. The work since spans a Springer textbook and regular commentary in the Malaysian press, on data protection and on how firms adopt technology.
A steady 24-month function, not a one-off project.
The Commissioner's Guideline on the Appointment of DPOs (Para 6.6) recommends a 24-month structure so capability is genuinely built and sustained. Onboarding runs in about two weeks; registration within the 21-day window.
Build
Gap assessment, RoPA, bilingual policy suite, DPO office set-up, breach protocol and DPA templates.
Active Advisory
The framework embedded in live operations: DSARs, vendor DPAs and new-process DPIAs run with our support.
Steady-State
Supervisory advisory, periodic re-assessment, regulatory-update briefings and breach-response standby.
Running throughout: quarterly reviews · annual board report · 24/7 data breach hotline · named Commissioner liaison
Frequently asked questions
PDPA compliance means handling personal data in accordance with Malaysia's Personal Data Protection Act 2010 and its 2024 amendments: collecting data lawfully with proper notice and consent, keeping it secure, honouring data subject rights, controlling disclosures to vendors and cross-border transfers, notifying breaches, and appointing a Data Protection Officer where required.
In practice, compliance work falls into recurring areas: governance and accountability, a data inventory, privacy notices, consent records, security measures, vendor contracts, breach response and staff training.
Ready to strengthen your compliance?
You don't need to have it all figured out. That's what we're here for.
If you're unsure where the gaps are, or just want an expert to review your risks, reach out. We'll walk you through it, step by step.