What Organisations Say After Working With Us
Candid accounts from compliance leads, DPOs, and operations teams across sectors in Malaysia.
Back to HomeFrom Our Clients
"We engaged Melur Chambers when we realised our privacy notices had not been reviewed since 2018. The data flow mapping process uncovered processing activities we had not formally documented, and the updated notices they drafted were actually readable — which is not something I have been able to say about legal documents before. The 2024 amendment briefing they provided at the end was particularly useful."
"We had a confirmed breach affecting customer account data. I called Melur Chambers within a few hours of discovering it. Ahmad had a clear process from the start — containment first, then scope assessment, then deciding on notification. The JPDP submission was filed within the required timeframe and the individual notification letters were handled professionally. I appreciated that they did not overstate the severity to generate work, but also did not minimise it."
"As the DPO for a clinic group across multiple locations, the monthly retainer has been genuinely useful rather than just a number in the budget. I bring specific questions each month — patient data retention, consent for referrals, staff access controls — and come away with clear written advice I can rely on. They flagged a biometrics issue with our new attendance system before we went live, which saved us from a significant problem."
"We brought Melur Chambers in when we were expanding from Malaysia into Singapore and needed to understand how our PDPA compliance mapped against PDPA Singapore. The cross-border transfer review was thorough and the summary they produced was clear enough to brief our board on. The compliance roadmap for the Malaysian entity identified three gaps we had not been aware of. Reasonable fees and no unnecessary scope creep."
"Our HR team was receiving data subject access requests from former employees with no process for handling them. Melur Chambers helped us build a proper DSR response workflow and reviewed the two pending requests that had been sitting unanswered for six weeks. The retainer has since given us a standing resource to consult on employment data questions, which come up more often than I expected."
"We are a modest-sized insurance intermediary and were uncertain whether the PDPA applied to our operations in the way it applies to our insurance company principals. The compliance review clarified our obligations, particularly around the sensitive financial and health data we handle as part of policy administration. The notice drafting took our existing broker agreements into account rather than producing something generic."
Three Engagements in Detail
E-Commerce Platform — First PDPA Compliance Review
A growing e-commerce business with over 200,000 registered customers had never conducted a formal PDPA compliance review. Privacy notices on the website were copied from a template, consent mechanisms were ambiguous, and the marketing email list had been built without clear records of consent basis. A complaint from a former customer prompted the review.
Data flow mapping identified fourteen categories of personal data across customer onboarding, order fulfilment, third-party logistics, and marketing. Gaps in consent records and notice adequacy were prioritised. New Privacy Notice, Cookie Policy, and marketing consent mechanism were drafted. Data processor agreements with the logistics partner and payment gateway were reviewed and updated. Compliance roadmap issued in four priority tiers.
The complaint was resolved without escalation to JPDP. Updated notices and consent flows were implemented within six weeks. A follow-up review three months later confirmed three of four priority tiers addressed. The business subsequently engaged on a DPO retainer basis for ongoing advisory support.
Healthcare Group — Data Breach Response
A private hospital group discovered that a misconfigured patient portal had exposed appointment records and limited health information for approximately 3,400 patients over a two-month period. The exposure was identified by an external security researcher. The group had no breach response procedure and was uncertain about its notification obligations under the recently amended PDPA.
Melur Chambers was engaged within 24 hours of internal discovery. Containment guidance was provided while the IT team worked with the researcher. Scope assessment determined the mandatory notification threshold was met. JPDP notification was prepared and filed within the statutory window. Affected patient communications were drafted in Bahasa Malaysia and English. Regulator follow-up queries were managed over the subsequent four weeks.
JPDP notification filed on time. No formal enforcement action was taken. Patient communications were sent within the timeframe recommended by the regulator. The group subsequently implemented a written breach response procedure and conducted a PDPA compliance review across the group.
Education Platform — DPO Retainer & DPIA on AI Tool
An online education provider processing data for approximately 45,000 registered learners was preparing to introduce an AI-assisted progress tracking and personalisation feature. The DPO had concerns about consent requirements for the new processing, the data minimisation approach, and whether an impact assessment was required. Existing internal resources were insufficient to assess the PDPA position confidently.
A DPO retainer was established. The AI feature DPIA was conducted over three months, involving review of the technical specification, consent flow design, data minimisation assessment, and third-party processor agreement review for the AI vendor. The retainer also addressed pending data subject requests and provided advice on learner data retention schedules. Processing records were updated to reflect the new processing activity.
The AI feature launched with an appropriately updated consent flow and documented DPIA. Three changes to the technical specification were recommended and implemented before launch. The retainer continues with monthly calls addressing ongoing matters across the organisation's data processing activities.
Professional Standing
Malaysian Bar
Current practising certificates — all advising practitioners
CIPP/A — IAPP
Certified Information Privacy Professional (Asia)
JPDP Registered
Registered legal practitioners engaged in PDPA advisory work
PI Insurance
Professional indemnity insurance maintained per Bar Council requirements
Ready to Discuss Your Organisation's Situation?
We are glad to have an initial conversation about your PDPA obligations or a specific matter — without any pressure or obligation to proceed.
Send an Enquiry