Data Protection Policy Template Malaysia

DATA PROTECTION POLICY TEMPLATE (MALAYSIA)

THIS DATA PROTECTION POLICY (the "Agreement") is made and entered into as of this [Day] day of [Month], [Year] (the "Effective Date") by and between:

[Company Name], a company incorporated in Malaysia with its registered office at [Registered Address] (hereinafter referred to as the "Data User");

AND

[Counterparty Name], a company incorporated in [Jurisdiction/Country] with its registered office at [Registered Address] (hereinafter referred to as the "Data Processor").

(Collectively referred to as the "Parties" and individually as a "Party").

RECITALS

WHEREAS, the Data User is subject to the Personal Data Protection Act 2010 ("PDPA 2010") of Malaysia;

WHEREAS, the Data User wishes to engage the Data Processor to process Personal Data on its behalf, and the Data Processor agrees to provide such services in compliance with the PDPA 2010 and the standards set forth herein.

---

1. OPERATIONAL DEFINITIONS

1.1 "Personal Data" means any information in respect of commercial transactions that relates directly or indirectly to a Data Subject, who is identified or identifiable from that information, or from that and other information in the possession of the Data User.

1.2 "Processing" means collecting, recording, holding, or storing the Personal Data or carrying out any operation or set of operations on the Personal Data.

1.3 "Data Subject" means an individual who is the subject of the Personal Data.

1.4 "Sensitive Personal Data" means any personal data consisting of information as to the physical or mental health or condition of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature, the commission or alleged commission by him of any offence or any other personal data as the Minister may determine.

1.5 "Security Standard" means the administrative, technical, and physical safeguards mandated under the PDPA 2010 and its subsidiary legislation.

---

2. SUBSTANTIVE TERMS AND OBLIGATIONS

2.1 Compliance with Law: The Data Processor represents and warrants that it shall, at all times, process Personal Data in strict accordance with the seven (7) Personal Data Protection Principles set out in the PDPA 2010.

2.2 Purpose Limitation: The Data Processor shall process Personal Data solely for the purposes defined in the Service Level Agreement (SLA) and shall not process, use, or disclose such data for any secondary purpose without the express written consent of the Data User.

2.3 Security Measures: The Data Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

2.4 Sub-processing: The Data Processor shall not engage any third-party processor without the prior written authorization of the Data User. Any authorized sub-processor shall be bound by a written agreement containing data protection obligations no less protective than those contained herein.

2.5 Data Access: The Data Processor shall restrict access to Personal Data strictly to employees, agents, or contractors who require such access to perform the obligations under this Agreement.

---

3. DEFAULT, TERMINATION, AND REMEDIES

3.1 Breach: A material breach of the data protection obligations herein shall constitute an Event of Default.

3.2 Cure Period: Upon the occurrence of a breach, the non-breaching Party shall provide written notice to the breaching Party. The breaching Party shall have thirty (30) business days from the receipt of such notice to cure the breach to the reasonable satisfaction of the non-breaching Party.

3.3 Termination for Cause: If the breach is not cured within the 30-business-day period, the non-breaching Party may terminate this Agreement immediately upon written notice without penalty.

3.4 Indemnity: The Data Processor shall indemnify, defend, and hold harmless the Data User from and against any and all claims, fines, penalties, or damages arising out of the Data Processor’s failure to comply with its obligations under the PDPA 2010 or this Agreement.

---

4. BOILERPLATE LEGAL PROVISIONS

4.1 Severability: If any provision of this Agreement is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

4.2 Entire Agreement: This Agreement constitutes the entire understanding between the Parties concerning the subject matter hereof and supersedes all prior agreements or negotiations.

4.3 Force Majeure: Neither Party shall be liable for any failure to perform its obligations where such failure results from any cause beyond the Party's reasonable control, provided that the Party affected gives prompt notice of such event.

4.4 Governing Law: This Agreement shall be governed by and construed in accordance with the laws of Malaysia.

4.5 Dispute Resolution: Any dispute arising out of or in connection with this Agreement shall be referred to and finally resolved by arbitration in Malaysia under the rules of the Asian International Arbitration Centre (AIAC) by a single arbitrator appointed in accordance with said rules.

---

5. FORMAL EXECUTION BLOCK

IN WITNESS WHEREOF, the Parties have caused this Agreement to be executed by their duly authorized representatives as of the Effective Date.

For and on behalf of [Company Name] (Data User):

Signature: __________________________ Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]

For and on behalf of [Counterparty Name] (Data Processor):

Signature: __________________________ Name: [Name of Signatory] Title: [Title of Signatory] Date: [Date]