¶¶Òõ¶ÌÊÓƵ

An External Privacy Notice is a mandatory document required for organizations operating in Malaysia that collect, process, or handle personal data in commercial transactions. This document must comply with the Personal Data Protection Act 2010 (PDPA) and related Malaysian regulations. The notice serves as a primary means of fulfilling the organization's transparency obligations by informing data subjects about their data processing activities. It should be provided to customers, users, and other individuals whose personal data is being collected, detailing the types of data collected, purposes of processing, disclosure practices, security measures, and data subject rights. The External Privacy Notice must be easily accessible, written in clear language, and regularly updated to reflect any changes in data processing practices or regulatory requirements.

1. Introduction: Overview of the organization and scope of the privacy notice

2. Definitions: Key terms used throughout the privacy notice, including 'personal data', 'processing', 'sensitive personal data' as defined in PDPA

3. Types of Personal Data We Collect: Comprehensive list of personal data categories collected

4. How We Collect Your Personal Data: Methods and sources of data collection, including direct and indirect collection

5. Purposes of Processing Personal Data: Detailed explanation of why personal data is collected and how it will be used

6. Disclosure of Personal Data: Information about third parties who may receive the personal data and circumstances of sharing

7. Cross-border Data Transfers: Information about international data transfers and safeguards in place

8. Data Security: Measures taken to protect personal data

9. Data Retention: How long personal data is kept and criteria for retention periods

10. Your Rights: Description of data subject rights under PDPA and how to exercise them

11. Changes to Privacy Notice: How updates to the privacy notice will be communicated

12. Contact Information: Details of data protection officer or responsible person for privacy queries