Personal data, held in trust.

Amanah Data helps Malaysian fintech firms, clinic groups and colleges meet the amended PDPA and get more from their data, starting with a baseline you can measure.

Book a scoping call Check if you need a DPO

DPO requirement checkPDPA s12A · DPO Guideline

People whose personal data you hold

48,000

Of those, people whose sensitive or financial data you hold

6,500

Do you monitor people regularly and systematically?

The law,in five figures.

The Personal Data Protection (Amendment) Act 2024 came into force in stages during 2025. It reaches the vendors who process data for you, not only your own firm.

Parliament House, Kuala Lumpur, photographed in 1971 — Parliament House, Kuala Lumpur, in 1971 and today. The amendments were passed here in July 2024.

Parliament House, Kuala Lumpur, seen from above today — Parliament House, Kuala Lumpur, in 1971 and today. The amendments were passed here in July 2024.

1,000,000ringgit, the maximum fine for breaching the data protection principles, now including processors. s5(2)

250,000ringgit, the maximum fine for failing to notify the Commissioner of a breach. s12B(3)

3years, the maximum prison term under s5(2), up from two.

20,000people’s personal data held, above which a DPO is required. DPO Guideline

10,000people’s sensitive or financial data held, the lower threshold. DPO Guideline

Your notes, our record.

We keep patient names, IC numbers and phone numbers in a Google Sheet for appointment reminders. Diagnosis notes stay in the clinic system. Reminders go out on WhatsApp. We have never deleted anything.

Edit the note. Describe what your team keeps, where, and for how long.

Record of processing · draftBaseline intake

This is how every Baseline starts. Your teams describe what they hold in plain words; we turn it into a record of processing with each PDPA question marked, then check it with them.

Secure AI, built around the Act.

We design and govern a private AI workspace; a vetted IT partner builds and supports it under a contract with you. Since 2025 the Act binds that partner directly: “the data processor shall comply with the Security Principle” (s5(1a)). Answer the five questions and the design note beside them fills in.

Your data decides the setup.

Health and biometric data are sensitive under the Act and need explicit consent before AI is used on them (s40).

Someone has to run it at 2am.

With an in-house IT team a private server makes sense. Without one, a managed setup is safer than hardware nobody supports.

Where your people work.

A small team at one site can run a local workstation. Teams across sites need something shared.

How strong the model must be.

The strongest models run in the cloud, and some are served from outside Malaysia, which brings in the transfer rules in s129.

Every party carries its own duties.

The client is the data controller. We and the IT partner are processors, each with our own DPO (s12A(2)). Choose a party to see its duties.

Secure AI Workspace · your setupDesign note draft

A draft design note, not a quote. The setup is confirmed in the scoping call, and anything that sends data abroad is confirmed by the partner law firm.

Eight documents,each tied to the Act.

The Sultan Abdul Samad Building on Merdeka Square, Kuala Lumpur — Sultan Abdul Samad Building, Merdeka Square, Kuala Lumpur.

The pack

AI-use policys6(3)Ours

Purpose and notice checks6(3), s7(2)(c)(i)Law firm reviews

Security controls standards9(1)(a)–(e)Ours

Processing agreementss5(1a), s9(2)Law firm drafts

Breach-notification playbooks12B(1)–(3)Law firm reviews

Retention and deletion rules10Ours

Sensitive and biometric datas40; A1727 s3Law firm advises

Transfer registers129, as amendedLaw firm confirms

Five of the eight carry legal risk, so our partner law firm drafts or reviews them. Legal advice comes from the law firm, not from us.

How an engagement runs

Sample clinic groupWeek 3

Baseline score1.3 / 5

PDPA gaps14

SponsorNot named

StatusAssessed

First, the baseline is measured.

Sample clinic groupWeek 6

SponsorChief operating officer

Data stewards4

DPO appointedYes, s12A

StatusOrganised

Then owners are named.

Sample clinic groupDay 90

Breach playbookDone

Retention scheduleDone

Notice updateOpen

Vendor agreementsOpen

Then the quick wins land.

Sample clinic groupMonth 6

Re-scored2.4 / 5

Change+1.1

PDPA gaps5

Next reviewMonth 12

Then we score it again.

What we offer	BaselineFixed fee	DPO serviceMonthly	FrameworkFixed fee	Secure AIFixed fee
What you get	Your PDPA gaps, a 0–5 maturity score, change‑readiness, a plan	Requests and breaches handled, a re‑score every 6–12 months	Named data owners, clear definitions, retention, quality checks	Setup design, 8‑document pack, partner build, quarterly reviews
Billed	Once	Monthly retainer	Per project	Per project
How long	2–4 weeks	Ongoing	Scoped per client	Scoped per client
When it starts	Step 1, any time	After the Baseline	After the Baseline	After the Baseline, once your data is ready
From your side	A sponsor and time with your teams	A named sponsor and data stewards	A sponsor, stewards and a steering group	You own the equipment and contract the IT partner
Legal work	Not needed	Partner law firm	Partner law firm	Five documents reviewed by the law firm, billed by it
Price quoted after a free scoping call	Get a quote	Get a quote	Get a quote	Get a quote

What we offer

Every engagement starts with the Baseline. The other three build on it.

Baseline

Fixed fee

Get a quote

What you get: Your PDPA gaps, a 0–5 maturity score, change‑readiness, a plan
Billed: Once
How long: 2–4 weeks
When it starts: Step 1, any time
From your side: A sponsor and time with your teams
Legal work: Not needed

DPO service

Monthly

Get a quote

What you get: Requests and breaches handled, a re‑score every 6–12 months
Billed: Monthly retainer
How long: Ongoing
When it starts: After the Baseline
From your side: A named sponsor and data stewards
Legal work: Partner law firm

Framework

Fixed fee

Get a quote

What you get: Named data owners, clear definitions, retention, quality checks
Billed: Per project
How long: Scoped per client
When it starts: After the Baseline
From your side: A sponsor, stewards and a steering group
Legal work: Partner law firm

Secure AI

Fixed fee

Get a quote

What you get: Setup design, 8‑document pack, partner build, quarterly reviews
Billed: Per project
How long: Scoped per client
When it starts: After the Baseline, once your data is ready
From your side: You own the equipment and contract the IT partner
Legal work: Five documents reviewed by the law firm, billed by it

Prices are quoted after a free scoping call.

Every engagement starts with the Baseline. The other three build on it, in the order that suits you.

AI-Readiness work and staff training in Bahasa Melayu and English are scoped alongside any of these. AI-Readiness starts only when the baseline shows the data is ready for it.

No hourly billing. We earn nothing on hardware or legal fees.

We are taking a small number of pilot clients for February to April 2027, at a reduced fee in exchange for a case study.

Request a pilot place

Why Amanah

Amanah is the Malay word for something placed in your care. Every customer record your firm holds is exactly that, and since 2025 the law treats it that way too.

We started Amanah Data because most governance work we saw ended as a binder of policies no one owned. So we measure first, name owners before we write documents, and score you again later so you can see what changed.

We hold ourselves to the same rules. When your data enters our work we are a data processor, so we appoint our own DPO, keep every tool we use on a register, and keep your files and prompts apart from every other client’s. Where we can, we work from descriptions and summary statistics instead of the records themselves.

Faiz brings the data governance method and leads the advice. Aiman comes from strategy and operations in fintech, and builds the tools that turn questionnaires into records like the one above. Every piece of advice is reviewed and signed off before it reaches you. Legal opinions come from our partner law firm.