Personal data, held in trust.
Amanah Data helps Malaysian fintech firms, clinic groups and colleges meet the amended PDPA and get more from their data, starting with a baseline you can measure.
The law,in five figures.
The Personal Data Protection (Amendment) Act 2024 came into force in stages during 2025. It reaches the vendors who process data for you, not only your own firm.
Your notes, our record.
Edit the note. Describe what your team keeps, where, and for how long.
This is how every Baseline starts. Your teams describe what they hold in plain words; we turn it into a record of processing with each PDPA question marked, then check it with them.
Secure AI, built around the Act.
We design and govern a private AI workspace; a vetted IT partner builds and supports it under a contract with you. Since 2025 the Act binds that partner directly: “the data processor shall comply with the Security Principle” (s5(1a)). Answer the five questions and the design note beside them fills in.
Your data decides the setup.
Health and biometric data are sensitive under the Act and need explicit consent before AI is used on them (s40).
Someone has to run it at 2am.
With an in-house IT team a private server makes sense. Without one, a managed setup is safer than hardware nobody supports.
Where your people work.
A small team at one site can run a local workstation. Teams across sites need something shared.
How strong the model must be.
The strongest models run in the cloud, and some are served from outside Malaysia, which brings in the transfer rules in s129.
Every party carries its own duties.
The client is the data controller. We and the IT partner are processors, each with our own DPO (s12A(2)). Choose a party to see its duties.
A draft design note, not a quote. The setup is confirmed in the scoping call, and anything that sends data abroad is confirmed by the partner law firm.
Eight documents,each tied to the Act.
The pack
Five of the eight carry legal risk, so our partner law firm drafts or reviews them. Legal advice comes from the law firm, not from us.
How an engagement runs
First, the baseline is measured.
Then owners are named.
Then the quick wins land.
Then we score it again.
What we offer |
BaselineFixed fee | DPO serviceMonthly | FrameworkFixed fee | Secure AIFixed fee |
|---|---|---|---|---|
| What you get | Your PDPA gaps, a 0–5 maturity score, change‑readiness, a plan | Requests and breaches handled, a re‑score every 6–12 months | Named data owners, clear definitions, retention, quality checks | Setup design, 8‑document pack, partner build, quarterly reviews |
| Billed | Once | Monthly retainer | Per project | Per project |
| How long | 2–4 weeks | Ongoing | Scoped per client | Scoped per client |
| When it starts | Step 1, any time | After the Baseline | After the Baseline | After the Baseline, once your data is ready |
| From your side | A sponsor and time with your teams | A named sponsor and data stewards | A sponsor, stewards and a steering group | You own the equipment and contract the IT partner |
| Legal work | Not needed | Partner law firm | Partner law firm | Five documents reviewed by the law firm, billed by it |
| Price quoted after a free scoping call | Get a quote | Get a quote | Get a quote | Get a quote |
What we offer
Every engagement starts with the Baseline. The other three build on it.
Baseline
Fixed fee
Get a quote- What you get
- Your PDPA gaps, a 0–5 maturity score, change‑readiness, a plan
- Billed
- Once
- How long
- 2–4 weeks
- When it starts
- Step 1, any time
- From your side
- A sponsor and time with your teams
- Legal work
- Not needed
DPO service
Monthly
Get a quote- What you get
- Requests and breaches handled, a re‑score every 6–12 months
- Billed
- Monthly retainer
- How long
- Ongoing
- When it starts
- After the Baseline
- From your side
- A named sponsor and data stewards
- Legal work
- Partner law firm
Framework
Fixed fee
Get a quote- What you get
- Named data owners, clear definitions, retention, quality checks
- Billed
- Per project
- How long
- Scoped per client
- When it starts
- After the Baseline
- From your side
- A sponsor, stewards and a steering group
- Legal work
- Partner law firm
Secure AI
Fixed fee
Get a quote- What you get
- Setup design, 8‑document pack, partner build, quarterly reviews
- Billed
- Per project
- How long
- Scoped per client
- When it starts
- After the Baseline, once your data is ready
- From your side
- You own the equipment and contract the IT partner
- Legal work
- Five documents reviewed by the law firm, billed by it
Prices are quoted after a free scoping call.
Every engagement starts with the Baseline. The other three build on it, in the order that suits you.
AI-Readiness work and staff training in Bahasa Melayu and English are scoped alongside any of these. AI-Readiness starts only when the baseline shows the data is ready for it.
No hourly billing. We earn nothing on hardware or legal fees.
We are taking a small number of pilot clients for February to April 2027, at a reduced fee in exchange for a case study.
Request a pilot placeWhy Amanah
Amanah is the Malay word for something placed in your care. Every customer record your firm holds is exactly that, and since 2025 the law treats it that way too.
We started Amanah Data because most governance work we saw ended as a binder of policies no one owned. So we measure first, name owners before we write documents, and score you again later so you can see what changed.
We hold ourselves to the same rules. When your data enters our work we are a data processor, so we appoint our own DPO, keep every tool we use on a register, and keep your files and prompts apart from every other client’s. Where we can, we work from descriptions and summary statistics instead of the records themselves.
Faiz brings the data governance method and leads the advice. Aiman comes from strategy and operations in fintech, and builds the tools that turn questionnaires into records like the one above. Every piece of advice is reviewed and signed off before it reaches you. Legal opinions come from our partner law firm.
Faiz
Practice lead, Amanah Data
Aiman
Practice lead, Amanah Data
Kuala Lumpur at dusk.
Common questions
Tell us what you hold.
We will tell you where you stand under the amended PDPA.
Your enquiry is ready. Copy it and email it to the address below. Nothing has been sent yet.