This notice explains how we handle personal data when you use the DPIA Assistant Tool at www.dpia.com.my. We have written it in plain language because a privacy notice that nobody can read is not much of a notice. It is issued under section 7 of the Personal Data Protection Act 2010 (“Act 709”).
The Tool asks you to describe a planned processing operation. Your answers may contain commercially sensitive information about your organisation’s systems, vendors, and data practices. Do not enter actual personal data about identified individuals into the Tool. The Tool is designed for descriptions of processing, not for the personal data itself. Describe categories (for example, “customer names and email addresses”), not individuals.
The Tool is owned and operated by Edwin Lee & Partners, a Malaysian law firm registered with the Malaysian Bar (Reg. No. 000020008633) and regulated under the Legal Profession Act 1976. For the purposes of Act 709, Edwin Lee & Partners is the data controller in respect of personal data processed through the Tool.
A-3-2, Aurora Place, Plaza Bukit Jalil, No.1, Persiaran Jalil 1, Bandar Bukit Jalil, 57000 Kuala Lumpur, Malaysia.
| Category | What it includes |
|---|---|
| Your identifying details | Your name, your role, and your organisation’s name, as entered at the intake stage of the Tool. Any internal reference you choose to add. |
| Your answers to the assessment | Your responses to the 35 questions drawn from Annex A of the DPIA Guideline. These describe your planned processing operation, its scope, context, purposes, legal basis, risks, and mitigation measures. |
| Acknowledgment record | The initials you type and the date and time when you acknowledge the precautionary notice, together with your IP address, browser user-agent string, and country as reported by our network provider. |
| Technical usage data | Aggregate, non-identifying information about how the Tool is used, such as which stage users reach before leaving. Collected through our analytics provider. |
| Enquiry form data | Your name, email address, organisation, and message, as entered in the enquiry form on this website. We collect this with your consent when you submit the form, and use it to respond to your enquiry. It reaches us through the same Cloudflare infrastructure and email delivery provider described in section 5 and section 6. Enquiries that do not become client matters are deleted 24 months from your last contact with us; enquiries that become client matters move onto our matter-file retention. |
Your answers to the assessment questions are held in your browser during your session. They are used to generate your draft document on your own device. We do not transmit your assessment answers to our servers unless you separately ask us to email the draft to you.
We do not use your information to market unrelated services to you, and we do not sell or rent it to anyone.
We rely on your consent under section 6 of Act 709. You give that consent when you tick the acknowledgment boxes before starting the assessment and before downloading a draft. You may withdraw your consent at any time by contacting us, although this will not affect a draft you have already downloaded.
We share personal data only with the service providers that make the Tool work:
| Provider | Role | What they receive |
|---|---|---|
| Cloudflare, Inc. (United States) | Hosting, network security, and database services | Acknowledgment records; technical request data such as IP address. See section 6 on transfers outside Malaysia. |
| Our analytics provider | Aggregate usage measurement | Non-identifying page and event data |
| Our email delivery provider | Sending your draft by email, if requested | Your email address and the draft document |
Each of these providers is engaged as a data processor, is bound by contractual confidentiality and security obligations, and may not use your information for its own purposes.
We may also disclose personal data where we are required or permitted to do so by law, by a court order, or by a regulator, including the Personal Data Protection Commissioner.
Some of the information described in section 2 is processed outside Malaysia. This section explains what, why, and on what legal basis.
The Tool is delivered through the global network operated by Cloudflare, Inc., a United States company. Cloudflare provides our website hosting, network security, and the database that holds the acknowledgment record. Cloudflare operates a point of presence in Kuala Lumpur, so much Malaysian traffic is served within Malaysia, but the platform is global and the database that stores acknowledgment records is located in the Asia-Pacific region outside Malaysia.
The information that may be processed outside Malaysia is limited to:
Your answers to the 35 assessment questions are not transferred anywhere. They are processed entirely within your own browser, and your draft document is generated on your own device. They are not sent to Cloudflare, and they are not sent to us. The only exception is if you separately ask us to email your draft to you, in which case the draft and your email address are handled by our email delivery provider.
No sensitive personal data, as defined in Act 709, is transferred outside Malaysia through your use of the Tool.
We have carried out a Transfer Impact Assessment in accordance with Personal Data Protection Guidelines No. 3/2025 (Cross Border Personal Data Transfer). Our assessment concluded that the transfer is permitted, and we rely on three independent bases:
We reassess this transfer at least every three years, and sooner if the law of the receiving jurisdiction changes, if Cloudflare’s protections materially change, or if we begin transferring different categories of information.
We could have stored the acknowledgment record in Malaysia. We chose not to build the Tool that way, for a reason we think is worth stating plainly: because Cloudflare delivers the website itself, your IP address is processed by Cloudflare whichever country the database sits in. Moving only the database to Malaysia would have let us make a stronger-sounding claim without meaningfully changing where your information goes. We would rather reduce the amount of information that leaves your device in the first place, disclose the transfer accurately, and document the assessment behind it.
That is why the substance of your assessment never leaves your browser, and why we capture initials rather than your full name in the acknowledgment record.
| Category | Retention period |
|---|---|
| Your answers to the assessment | Held in your browser for the duration of your session only. Cleared when you close or refresh the page. Not retained by us. |
| Acknowledgment record | Two years from the date of the acknowledgment. This aligns with the record-keeping horizon set out in the DPIA Guideline. |
| Email delivery record | Two years from the date of sending. |
| Aggregate analytics data | Retained in aggregate, non-identifying form. No individual records are kept. |
No system is perfectly secure. If a personal data breach affecting the Tool occurs, we will handle it in accordance with our breach response procedures and the notification requirements under Act 709.
Under Act 709 you may ask us to:
Write to dpomalaysia@lpplaw.my. We will respond within the period required by Act 709. There is no charge for a reasonable request.
If you are not satisfied with how we have handled your request, you may complain to the Personal Data Protection Commissioner at www.pdp.gov.my.
The Tool does not use advertising cookies and does not track you across other websites.
We use a privacy-focused analytics provider that measures aggregate usage without setting cookies and without collecting information that identifies you. If we ever change to an analytics provider that requires cookies, we will ask for your consent through a cookie banner before any such cookie is set, and we will update this notice.
The Tool is a professional compliance aid intended for use by organisations. It is not directed at children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data through the Tool, contact us and we will delete it.
We may update this notice as the Tool develops or as the law changes. The version number and date at the top of this page will change when we do. Material changes will be highlighted on the Tool’s home page.
Data Protection Officer
Edwin Lee & Partners (Reg. No. 000020008633)
A-3-2, Aurora Place, Plaza Bukit Jalil, No.1, Persiaran Jalil 1,
Bandar Bukit Jalil, 57000 Kuala Lumpur, Malaysia.
Email: dpomalaysia@lpplaw.my
Telephone: +6011 5954 1201