What Our Clients Say

A Selangor-based e-commerce platform was preparing for a series B fundraise. Investors' due diligence process flagged that the company's privacy notice had not been updated since 2019 and did not cover several new data-processing activities introduced during product expansion.

Cemerlang Law conducted an expedited Gap Analysis covering the company's current data-processing activities, followed by a full redraft of the customer-facing privacy notice and internal employee data-processing policy. Both documents were delivered in English and Bahasa Malaysia within two weeks.

Investor due diligence concerns were resolved at the next review cycle. The company now holds documentation that accurately reflects current practices and has a clear internal process for updating notices when new processing activities are introduced. Series B fundraise completed on schedule.

A Kuala Lumpur fintech company processing payment data for SME clients had no formal compliance function. The founding team understood that PDPA obligations existed but had no structured approach to monitoring compliance, no breach-response plan, and had never completed PDPA registration.

Cemerlang Law commenced a DPO Retainer engagement, beginning with an initial compliance assessment and PDPA registration. We developed a breach-response playbook, a compliance dashboard, and delivered a half-day staff training session covering the team's practical data-handling responsibilities.

PDPA registration completed within the first month. Staff now have a clear understanding of their handling obligations. The quarterly review cadence has become a useful internal governance checkpoint. Company has successfully referenced its compliance programme in two enterprise client procurement processes.

A Penang-based healthcare administration company processing sensitive employee and patient data had existing policies but recognised that HR onboarding practices and patient data consent procedures were not aligned. They needed both a gap review and updated internal documentation.

We conducted a targeted Gap Analysis covering HR onboarding flows and patient consent mechanisms, then prepared revised employee data-processing notices and updated consent forms for patient data. All documents were reviewed against both PDPA requirements and the company's specific operational context.

Onboarding and consent procedures now accurately reflect PDPA requirements. HR team reports that staff have a clearer understanding of why data is collected and what it is used for. Company identified and addressed three specific consent-collection practices that would have presented risk in a regulatory examination.