How we protect your data
SenangUrus runs the records that keep a business moving — invoices, payroll, customer lists. Under Malaysia's Personal Data Protection Act, some of that is sensitive data. This page sets out who is responsible for what, the controls we keep, the commitments we put in writing, and who answers when you ask a hard question.
Last updated: 17 September 2026
Who is responsible for what
We are your data processor
For everything you put into SenangUrus — your employees, customers, suppliers and their records — you are the data controller and we process it only on your written instructions. We do not use your data for our own purposes, and we do not sell or rent it.
We carry direct duties too
Since 1 April 2025, the Personal Data Protection Act 2010 (as amended by Act A1727) puts the Security Principle on the data processor directly — not only on the controller. A processor that fails to protect personal data commits an offence in its own right. Our controls are built for that standard, not for a contract clause alone.
We have a Data Protection Officer
Our DPO is accountable to us for PDPA compliance and is reported to the Personal Data Protection Commissioner as section 12A requires. Customers, auditors and data subjects reach that officer directly.
The measures we maintain
These are the controls behind the Security Principle for a processor. They are summarised from the technical and organisational measures annexed to our Data Processing Agreement, and we do not reduce them during a subscription term.
| Measure | What that means in practice |
|---|---|
| Access control | Named accounts only, role-based permissions, least privilege, multi-factor authentication for administrative access, immediate revocation when someone leaves. |
| Network isolation | Application databases are bound to the local interface and are not reachable from the public internet. Administrative interfaces are restricted by firewall rules. |
| Encryption | TLS for data in transit, encryption at rest where the platform supports it, and encrypted backups. |
| Auditability | Administrative and configuration changes are logged and the logs are retained and reviewable. |
| Resilience | Daily backups with a tested restore procedure and a documented recovery runbook. |
| Vulnerability management | Framework and dependency security updates are tracked and applied on a documented schedule. |
| Tenant separation | The platform is multi-tenant: access to one customer's data is never used to serve another, and internal tooling respects that boundary. |
| People | Staff who touch customer data are bound by confidentiality obligations and receive periodic security and privacy training. |
| Change management | Security requirements are part of how we ship; production personal data is not used in development or test environments. |
| Incident response | A documented incident runbook with defined detection, triage, containment, notification and post-incident review steps — rehearsed, not written for the drawer. |
Where your data is processed
We tell you where your data is processed instead of leaving you to guess. Our current sub-processors, the data each one can reach and their processing locations are published on our sub-processors page and repeated in the annex to your Data Processing Agreement.
Malaysia's cross-border transfer rules changed on 1 April 2025: personal data may only be transferred outside Malaysia where the destination has substantially similar protection, or where appropriate safeguards are in place. We maintain those safeguards for the transfers we conduct, and we will not start processing in a new country without telling you first.
If your own policy requires data to stay in Malaysia, say so in the Order Form — we will confirm in writing which parts of the Service that covers before you sign.
If something goes wrong
The obligations after a breach are the ones customers care about most — and the ones most vendors describe vaguely. Ours are specific.
You hear from us within 24 hours
Our Data Processing Agreement commits us to notify you within 24 hours of becoming aware of a personal data breach affecting your data. Awareness means the moment we have reasonable grounds to believe a breach occurred — not the end of our investigation.
Deliberately shorter than the law requires of you
Under section 12B you must notify the Commissioner within 72 hours and, where there is significant harm, affected data subjects within 7 days. Our notice starts your clock earlier than the law does, so you keep time to assess and decide.
We help with the paperwork
We provide the facts your notification needs — timeline, categories, numbers, containment, root cause — and our DPO is the contact for the Commissioner's questions.
Everything is recorded
We keep a register of all personal data breaches, including those that turn out not to be notifiable, for at least two years.
Your data subjects' rights, and yours
- Access, correction, export and deletion work inside your tenant — you do not have to ask us for your own data.
- The PDPA now includes a right to data portability (section 43A). We provide structured, machine-readable exports so you can move data on when a data subject asks and the format allows it.
- If a data subject contacts us directly, we do not answer on the merits: we pass the request to your designated contact and tell the person it has been forwarded.
What we give you when you ask
A Data Processing Agreement we will actually sign
Processing scope, security measures, 24-hour breach notice, sub-processor list, cross-border disclosure, audit rights, export and deletion on exit. Ask for it — it is a template, not a negotiation from zero.
Answers in writing
Security questionnaires, procurement forms and DPIA questions get answered by the DPO, in writing, with the same set of facts as this page.
Audit on reasonable terms
Once a year, or after a breach affecting you, you or an independent auditor bound by confidentiality can audit our processing on 30 days' notice — without seeing other customers' data.
No inflated claims
We do not claim a PDPA certification, because none exists. If you need a recognised badge, ask us for our security summary and we will tell you honestly what we hold and what we do not.
What we never do with customer data
- We do not sell, rent or licence your data, and we do not share it for advertising.
- We do not use your data to train AI models, ours or anyone else's.
- We do not build benchmarks or industry comparisons from your data unless you instruct us in writing and the output is anonymised.
- We do not feed production customer data to AI assistants or third-party tools. That is a written internal rule, and it is enforced on access.
- We do not use one tenant's data to serve another.
Reach our Data Protection Officer
Our DPO is accountable to us for PDPA compliance and reported to the Personal Data Protection Commissioner as section 12A requires. Security questionnaires, DPIA questions, audit requests and breach notices go there directly.
[email protected] · (+6) 03-7890 3946
C-16-3A Zen Suites @ ZetaPark, Jalan Langkawi, Taman Danau Kota, 53100 Setapak, W.P. Kuala Lumpur, Malaysia
Questions we get asked
01/Are you the data controller or the data processor?
02/Do we need a Data Processing Agreement signed before go-live?
03/Where is our data stored?
04/What happens to our data when we leave?
05/Can we audit you?
06/Who do we contact about privacy or security?
Put the hard questions to our DPO
Send your procurement or security questionnaire, or ask for the Data Processing Agreement and the current sub-processor list. You will get written answers, not a brochure.