Privacy notice

Who this notice is from

Amanah Data is a data governance and privacy practice based in Kuala Lumpur, Malaysia, led by two practice leads, Faiz and Aiman. We advise Malaysian organisations on the Personal Data Protection Act, build data governance frameworks, and design governed AI workspaces.

Who we areAmanah Data. Company registration in progress; this notice will carry the registration number once it is issued.

Where we areKuala Lumpur, Malaysia.

How to reach usEmail [contact email to be confirmed]. Use the same address for any question, request or complaint about personal data.

Who handles thisThe two practice leads between them. We have not appointed a data protection officer, because we are below every threshold in the Commissioner’s guideline on appointing a data protection officer (25 February 2025). If that changes we will appoint one, notify the Commissioner, and say so here.

When we are the data controller, and when we are not

The Act splits responsibility in two, and which one we are changes who you should ask.

We are the data controllerFor your enquiry, our correspondence with you, our scoping calls, our contracts, our invoices and our own staff and supplier records. We decide what to hold and why. This notice covers that data.

We are a data processorWhen a client organisation engages us and its data passes through our hands — for example when we review records of processing, sit in a data protection officer role, or help configure a governed AI workspace. There we act on that organisation’s instructions, for its purposes, not ours (section 4).

If you are a customer, patient, student or employee of one of our clients and you want access to your data, or a correction, ask that organisation. It is the data controller and it holds the record. If you send the request to us instead, we will pass it on and tell you that we have, and we will not answer it ourselves unless that organisation instructs us to.

As a data processor we are still directly bound by the Security Principle (section 5(1a) and section 9) and must appoint our own data protection officer once we cross the thresholds (section 12A(2)).

What personal data we hold, why, and for how long

We keep this deliberately short. We are a two-person practice selling professional services to organisations, so almost everything we hold is ordinary business contact data about people acting for their employer.

Personal data we process as a data controller.
What we hold	Why we hold it	How long
Enquiries	Your name, work email, organisation, phone number if you give one, and what you tell us you hold. To reply, arrange a scoping call and quote.	Two years from our last exchange. If you become a client it moves to the engagement record.
Scoping calls	Notes on your systems, data and current practice, and the names and roles of the people we speak to. To scope the work and produce your assessment.	The engagement, then two years, so we can answer questions on the advice we gave.
Engagement records	Contracts, the named sponsor and stewards, correspondence, deliverables and our own sign-offs. To run the work and show what we advised.	Seven years after the engagement ends, covering contract and tax periods.
Invoices	Billing contact, amounts, dates and references. To bill, to collect, and to meet tax and record-keeping duties.	Seven years, as Malaysian tax law requires.
Suppliers	Contact details and terms for the firms we work with, including our law firm and IT partner. To manage them and do our due diligence.	Seven years after the relationship ends.

We do not buy marketing lists, we do not profile anyone, and we do not make automated decisions about people. We have no newsletter; if we ever start one it will be a separate opt-in, and this notice will change before it does.

What this website itself collects

Nothing you type on this website reaches us. The tools on the home page — the data protection officer check, the record-of-processing demonstration and the secure AI configurator — run entirely in your browser. So does the enquiry form: it assembles an enquiry for you to copy and email to us yourself. We have no server collecting it, we set no cookies, and we store nothing on your device.

Two things do happen when you load the page, and you should know about them because neither is wholly under our control:

Our host sees the request. The site is hosted on Vercel. Like any web host, Vercel receives your IP address, the page you asked for, the time, and your browser’s user-agent string, and keeps short-term operational logs. We have not turned on any Vercel analytics product.
The typeface comes from Google Fonts. Your browser fetches the Albert Sans font files from fonts.googleapis.com and fonts.gstatic.com, which discloses your IP address to Google. We are looking at serving the font from our own domain to remove this.

Photographs on the site come from Wikimedia Commons but are served from our own domain, so they make no third-party request.

Where your personal data comes from

Section 7(1)(c) requires us to tell you the source, as far as we know it. In practice there are three:

From you, when you email us, speak to us on a call, or sign a contract.
From your employer or your colleagues, when an organisation engages us and names you as its sponsor, data steward or contact, or when a colleague puts you on an email thread.
From public sources, such as your organisation’s own website or a company register, when we check who we are dealing with before taking on work.

Section 7(1)(e) requires us to name the classes, so here they are in full. We do not sell personal data, and we do not disclose it for anyone else’s marketing.

Our partner law firmWhere a question needs legal advice rather than our advice. We tell you before we pass anything on, unless the matter is a claim against us.

An IT partnerOnly on a secure AI workspace engagement, only where your organisation has contracted that partner, and only on your organisation’s instruction.

Our own service providersOur web host, our email and document provider, and our accountant. They act as our data processors, under contract, on our instructions.

Regulators and courtsThe Personal Data Protection Commissioner, a court, or another authority, where the law requires or allows disclosure.

Insurers and advisersWhere we need to notify a claim or take professional advice about one.

A successorIf the practice is restructured, incorporated or transferred, the client and supplier records pass to the successor, and this notice carries over with them.

Whether your personal data leaves Malaysia

Some of it does, and we would rather say so plainly. Our website host and our email and document provider operate outside Malaysia. Section 129 of the amended Act allows a transfer out of Malaysia on the conditions it sets out; the Minister’s list of approved places was removed by the 2024 amendment, so each transfer now has to stand on its own footing.

We keep a register of every place our data is held, and our partner law firm confirms the basis for each transfer. We do not transfer a client’s data abroad without that organisation’s instruction.

Giving us your personal data is voluntary

Sections 7(1)(g) and 7(1)(h) ask us to say whether you must supply your data and what happens if you do not. You are under no obligation to give us anything.

If you do not give us a way to reply, we cannot answer your enquiry or arrange a call. That is the whole consequence.
If your organisation engages us and will not give us the contact details of a sponsor and data stewards, we cannot do the work, because the work depends on talking to the people who own the data.
Once we have invoiced you, we have to keep the billing record for seven years whether you ask us to or not, because tax law requires it.

Sensitive personal data

We do not ask you for sensitive personal data, and we have no reason to hold it. Under section 4 of the Act, sensitive personal data means data about physical or mental health, political opinions, religious or other beliefs, the commission or alleged commission of an offence, and — added by section 3 of the 2024 amendment — biometric data.

Financial data is not sensitive personal data under the Act. It counts for a different purpose: it is one of the thresholds in the Commissioner’s guideline for deciding whether an organisation must appoint a data protection officer.

If an engagement would mean us seeing sensitive personal data held by a client — a clinic group’s patient records, for instance — we handle it only as that client’s data processor, on its instructions, and section 40 requires that client to have explicit consent or another ground listed in the Act.

How we protect personal data

The Security Principle, section 9, asks us to take practical steps having regard to the harm a loss would cause, where the data is held, the equipment, the people with access, and secure transfer. In our case that means:

Two people have access, each on a separate account with multi-factor authentication and an encrypted device.
Client material stays in a named workspace per client. We do not keep client data on personal devices or in personal accounts.
We take the minimum: samples and extracts rather than whole production datasets, wherever the work allows it.
Material is sent through our document provider’s share links rather than as email attachments, and we delete working copies at the end of an engagement.
If a personal data breach happens we notify the Commissioner as soon as practicable, and the people affected where the breach is likely to cause significant harm, as section 12B requires. Where we are a client’s processor, we tell that client first and at once, so that it can notify.

Your rights, and the choices we offer you

Write to [contact email to be confirmed] and say which of these you want. We will answer an access or correction request within twenty-one days, as sections 31 and 35 require, and if we cannot we will tell you before then and why. We charge no fee for a request from a contact or a client.

Ask what we hold about you, and get a copys30

Have it corrected if it is wrong, incomplete, misleading or out of dates34

Withdraw your consent to our processings38

Require us to stop processing where it would cause you damage or distresss42

Require us to stop processing for direct marketings43

Ask us to transmit your data to another data controller, where that is technically feasibles43A

The choices we offer for limiting what we do (section 7(1)(f))

Tell us to keep you off a particular thread, or to use one address rather than another.
Tell us not to keep your notes after a scoping call, and we will delete them instead of keeping them for two years.
Tell us not to name you in a deliverable, and we will refer to your role instead.
Ask us to delete your enquiry, and we will, unless we have to keep it for a tax or contractual record.

If you send us other people’s details — colleagues on an email thread, or names in a sample extract — please send only what the work needs. Where you ask us to limit how we use your data and the same record identifies a colleague, we apply the same limit to both.

Complaints

Tell us first, at [contact email to be confirmed], and one of the two practice leads will answer. If we have not put it right, you can complain to the Personal Data Protection Commissioner at the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi), Ministry of Digital, Malaysia.

If your complaint is about an organisation that engaged us, rather than about us, it belongs with that organisation as the data controller. We will tell you so, and pass your message on.

Changes to this notice, and the two languages

This is version 1.0, dated 27 October 2026. When we change it we will raise the version number and the date at the top of the page. If a change means using your data for a new purpose, section 7(2)(c)(i) requires us to tell you before we do, and we will write to you rather than rely on you noticing the page.

Section 7(3) requires this notice in the national language and in English, so it exists as English and Bahasa Malaysia, and you may deal with us in either. The two are meant to say the same thing. If you find a difference between them, please tell us: we will correct it, and in the meantime the English text is the one we work from.