Businesses collect personal data constantly — enquiry forms, loyalty programmes, CCTV, HR files, customer databases, marketing lists. Most treat compliance as a privacy notice someone copied from another site.
The obligations run much wider. Notice and consent in the required form and languages. Limits on purpose and disclosure. Security. Retention limits. Handling access and correction requests. Controls over data processors and any transfer abroad.
The exposure is not only regulatory. Customers and counterparties increasingly ask, and a business that cannot answer loses the contract.
PDPA Compliance Framework
A compliance framework built around the PDPA principles — data mapping, notice and consent, purpose and disclosure limits, security measures, retention and disposal, data subject request handling, processor contracts and cross-border transfer, together with the internal policy and training that make it operational.
Your Vision, Backed by the Right Legal Support
You build the business. We help you protect it.
Imagine knowing what data you hold, why, where it sits and how long you keep it. Notices in order. Requests handled through a process. Processors under contract. A framework you can show a customer or a regulator.
Who this service is for
This Is For You If…
Businesses collecting customer or member data
Employers holding staff records
Companies running marketing databases or loyalty programmes
Businesses using cloud services or offshore processors
Organisations asked to evidence data protection in a tender or contract
Get Started
What we will do for you
This is what we will do for you
Map what personal data you hold, where it came from and where it sits
Draft notices and consent mechanisms in the required form
Set security, retention and disposal standards
Build a process for access, correction and other data subject requests
Put processor contracts and transfer safeguards in place
What’s Included
What’s Included in our service for you
Data mapping across the business
Notices and consent mechanisms in required form
Security, retention and disposal standards
Data subject request handling process
Processor contracts, transfer safeguards and staff training
Get Started
Why Choose Legal That Works?
Why Choose Us To Assist You?
Digital-first
No office visit required—review and sign online
Transparent fees
Fixed price, no billing surprises
Deep experience
Various contracts across industries
Accessible
Our client portal keeps you informed
Get Started
We've Helped
You Need To Act Now
Important: Limited Slots
Compliance is assessed on what was in place when the data was collected, not on what was implemented after a complaint.
Get Started
Nothing to Lose. Everything to Protect.
No Surprises. No Guesswork. Just Legal That Works.
Before anything starts, we speak with you to understand your business and make sure the service is the right fit. If it is not, we will say so upfront. No pressure. No wasted time. We only take on matters we are confident we can deliver with quality. That is why business owners trust us to get it right.
Get Started
Frequently Asked Questions
What is Legal That Works?
Legal That Works is a business and organisation oriented legal service designed by Messrs Akmal Saufi & Co (the firm that has brought the widely known legal consumer services brand ASCOLAW). We specifically help business owners and organisation leadership to navigate Malaysia’s legal terrain to achieve their commercial goal.
What if I’m not sure what legal service I need?
No problem. Most business owners aren’t legal experts! Just reach out. Our team will guide you to the right service or help you understand your options—without jargon or upselling.
Does the PDPA apply to a small business?
It applies to commercial transactions involving personal data. Size affects what is proportionate, not whether it applies.
Is a privacy notice on our website enough?
No. A notice is one obligation among several. Security, retention, request handling and processor control all sit behind it.
What about data stored on overseas cloud services?
Transfer outside Malaysia carries its own requirements. We will advise on your specific arrangements.
Do we need consent for everything?
Not in every case, but where consent is the basis it must be properly obtained and recorded.
What if we receive a data access request?
There is a process and a timeline. Having it prepared in advance is far easier than improvising.
Who will be helping me?
All our services are delivered by our licensed lawyers under the Malaysian Bar with proven experience across industries. You’ll work with a real legal team, not chatbots or generic customer support.
