Start Free Trial Request a Demonstration
Why compliance needs Hybrid Intelligence

Regulators do not hold algorithms accountable.
They hold organisations accountable.

AI can process information. AI can generate outputs. AI can accelerate compliance work. But regulators do not hold algorithms accountable. They hold organisations accountable. That is why Praxis was built around Hybrid Intelligence. AI accelerates the work. Hybrid Intelligence provides direction. Humans remain accountable for the decision.

AI Accelerates.

What AI is good at — and what we let it do.

  • Reads the regulation, the guideline and the source law
  • Maps obligations to the facts of the matter
  • Drafts the assessment, the notice audit and the transfer analysis
  • Assembles, hashes and cross-references the evidence
  • Turns weeks of research into hours of review

HI Navigates.

Where Praxis is different: information becomes direction.

  • Every finding cited to the provision and the exact quote
  • Gaps, options and residual risk laid out in the Guideline's own order
  • Confidence stated; low-confidence findings routed to a person
  • Change in the law connected back to the assessments it affects
  • A versioned method that can be inspected, not a model that must be believed

Humans Decide.

What AI must never own — and what the system will not let it.

  • Accountability for the conclusion
  • Acceptance of residual risk
  • Interpretation of regulatory intent
  • The final governance decision
  • The signature — enforced: the author can never approve their own work

AI Accelerates.HI Navigates.Humans Decide.

The Hybrid Intelligence Layer

Between AI and accountability.

Between the model and the decision sits Hybrid Intelligence. The layer that converts analysis into direction while preserving human judgment and accountability. It supports decisions. It does not make them.

What the Hybrid Intelligence layer does
  • Analyses regulations

    Acts, guidelines and regulatory decisions held as structured, versioned sources.

  • Maps obligations

    Each statutory duty connected to the processing, transfer or notice it applies to.

  • Identifies gaps

    Where the facts fall short of the Guideline, the s.129 test or the statutory notice content.

  • Generates recommendations

    Mitigations, safeguards and rewrites — proposed, cited, and queued for review.

  • Produces evidence

    Hashed documents, locked snapshots and an audit chain a regulator can verify.

What it never does
  • Own accountability

    The organisation, and the qualified person who signs, remain answerable.

  • Accept risk

    Residual risk is accepted by a named human, on the record.

  • Interpret regulatory intent alone

    Ambiguity is surfaced with its confidence stated — never resolved silently.

  • Make the final governance decision

    Draft → in review → approved → issued. Only a person completes the last two.

  • Approve its own output

    Separation of duties is enforced by the system, not by policy.

How direction becomes a defensible decision

  1. AI

    Knowledge

    Acts, regulations, guidelines and regulatory decisions held as structured, versioned sources — provenance and review status on every one.

  2. HI

    Framework

    A documented methodology with stated criteria, assumptions and limits: DEICA for DPIAs, a 21-provision Malaysian floor for transfers, three-layer scoring for notices.

  3. Human

    Assessment

    The professional works the framework against the facts of the matter. Praxis structures the questions and the reasoning; the judgment stays human.

  4. HI

    Evidence

    Supporting documents hashed on upload and attached to the finding they substantiate; issued reports rendered from an immutable snapshot.

  5. Human

    Verification

    An append-only, hash-chained audit log with a verification endpoint — and, through Praxis Integrity, an independent check that an issued report is genuine and current.

Read the full methodologyRequest the methodology overview
The Platform

Seven modules. One Hybrid Intelligence layer.
One defensible compliance record.

Praxis is not automated compliance. Each module applies Hybrid Intelligence to a specific compliance obligation. AI accelerates the work. HI structures the analysis. Humans retain accountability. Every assessment writes to the same evidence vault, the same methodology and the same verifiable record.

Praxis DPIA

Live

Runs the Commissioner's 2026 DPIA Guideline as published. Statutory screening, the five DEICA stages, a 3×3 risk matrix, mitigation tracked to closure and reports issued from a locked snapshot.

Why you need it

Mandatory when satisfying any of the following criteria:

QUANTITATIVE:
  • 20,000 general data subjects
  • 10,000 sensitive data subjects
  QUALITATIVE:
  1. Legal or Significant Effects
  2. Systematic Monitoring
  3. Innovative Technologies
  4. Denial or Restriction of Rights
  5. Location or Behaviour Tracking
  6. Vulnerable Individuals
  7. Automated Decision-Making and Profiling (ADMP)
Without it
A template DPIA with no evidence trail, no enforced sign-off, and no way to show a regulator how the conclusion was reached.
Who decides
AI drafts and scores; a reviewer other than the author approves; the DPO or partner issues from a locked snapshot.
Explore Praxis DPIA

Praxis Frontier

Live

Transfer Impact Assessments under s.129: all eight conditions, 142 destination jurisdictions scored on a 21-provision Malaysian-floor matrix, a hashed Evidence Vault and a three-year validity clock.

Why you need it

The whitelist is gone. To transfer personal data outside Malaysia, a data controller must satisfy one of the primary conditions or statutory exceptions:

PRIMARY CONDITIONS
  • Condition 1A: SUBSTANTIALLY SIMILAR LAWS to Malaysia PDPA
  • Condition 1B: ADEQUATE LEVEL OF PROTECTION comparable or equivalent to the protection provided under Malaysian law, verified through a TIA (valid for a maximum of 3 years).
  STATUTORY EXCEPTIONS (Section 129(3))
  • Explicit Data Subject Consent
  • Contract Necessity
  • Legal Proceedings/Vital Interest
DUE DILIGENCE & TRANSFER MECHANISM
  • Binding Corporate Rules (BCRs)
  • Standard Contractual Clauses
  • Certifications
Without it
Transfers rest on a memo nobody can reproduce when challenged, and validity expires unnoticed.
Who decides
AI pre-scores the destination and assembles the evidence; counsel chooses the s.129 route and accepts the residual risk.
Explore Praxis Frontier

Praxis Privacy Audit

Live

Grades a published privacy notice or policy against PDPA statutory text in three never-blended layers, with a verbatim quote behind every finding and a Praxis Grade A–D. English and Bahasa Malaysia.

Why you need it
The notice is the first thing a regulator, customer or counterparty reads, and the easiest gap to prove.
Without it
Under-disclosure of sensitive-data categories stays invisible until someone else finds it.
Who decides
AI grades and quotes; low-confidence findings go to a human review queue; the grade is a grade, never a certification.
Explore Praxis Privacy Audit

Praxis Breach

Early access

A mobile-first s.12B wizard any employee can start on discovery: the Annex B form mirrored question by question, significant-harm triage, a live 72-hour countdown and a DPO review queue before anything is filed.

Why you need it
The 72-hour clock starts at awareness, not when the DPO hears about it.
Without it
The first day is spent finding out who to tell, and the notification is reconstructed after the fact.
Who decides
Any employee starts the record; triage is guided; only the DPO can file — nothing is sent without a human.
Explore Praxis Breach

Praxis Schema

Live

A data-mapping register with a shared PDPA/GDPR sensitivity taxonomy, sector packs, an automatic sources → systems → recipients flow map and exports that feed DPIA, Frontier and Breach.

Why you need it
Every assessment starts from the same question (what data, where, to whom), and answering it from spreadsheets is where programmes stall.
Without it
Each DPIA, transfer assessment and breach response rediscovers the data map from scratch, inconsistently.
Who decides
AI pre-classifies sensitivity and draws the flow map; the data owner validates each activity before it feeds an assessment.
Explore Praxis Schema

Praxis Passport

Live

A citation-backed reference on how closely another jurisdiction's law matches Malaysia's PDPA, 21 criteria, a deterministic verdict, and a verified quote from the source law behind every rating.

Why you need it
Counsel need a defensible starting point before a full transfer assessment, not a week of jurisdiction research.
Without it
Adequacy judgments rest on memory or secondary summaries, with no quote to point to.
Who decides
AI scores the rubric against the source law; counsel decides whether the verdict holds for this transfer, or refers it to Frontier.
Explore Praxis Passport

Praxis Integrity

Live

A public, read-only verification registry: a unique code on every issued report that a regulator, counsel or counterparty can look up to confirm it is genuine, which methodology version it used and whether it is still valid.

Why you need it
A report that can be verified independently is worth more than one that has to be taken on trust.
Without it
The authenticity and currency of an issued assessment can only be asserted, never checked.
Who decides
Nobody, that is the point. The registry records what a human issued and lets anyone verify it without trusting anyone.
Explore Praxis Integrity
One subscription, every module

See Hybrid Intelligence on your own matter.

A 30-minute demonstration on a scenario you recognise, or try the whole suite free for 7 days, starting today. Suite plans include every module as each ships, licensed by client workspace, never by seat.

Request a DemonstrationStart Free Trial

Modules marked Early access, Preview, In development or Planned are described as direction, not availability. Every suite plan includes all seven as each ships.

How Praxis Fits Together

One matter, in order.
Each module hands its evidence to the next.

Select a stage to see what happens there and what carries forward. Facts are entered once; evidence is hashed once; every downstream assessment inherits the record instead of rebuilding it.

Data Mapping — Praxis Schema

Preview

What happens here

Personal-data assets, systems, recipients and cross-border flows are recorded once in a register that already knows what is sensitive, by sector pack and by the shared PDPA/GDPR taxonomy.

What flows to the next stage

The processing activities and flagged flows that trigger a DPIA or a transfer assessment, exported in the structure those modules start from.

Explore Data Mapping — Praxis Schema
The report is an output. The methodology, the evidence and the audit trail are the product.
Why Now

Malaysia's privacy regime made assessments
recurring, timed and high-stakes.

Regulators increasingly expect documented decision-making, not merely documented activity. The challenge is no longer collecting information. The challenge is turning information into defensible decisions while preserving accountability. That is exactly where Hybrid Intelligence belongs.

20,000 / 10,000

DPIA triggers — data subjects processed, or sensitive/financial data subjects — on the Commissioner's DEICA guideline

8 CONDITIONS

The s.129 whitelist is gone: each overseas transfer needs its own basis under one of eight conditions

72 HOURS

Section 12B breach notification to the Commissioner from the moment of awareness, with data-subject notices to follow

1 ACCOUNTABLE DPO

Appointment thresholds make a named person answerable for all of the above

3-YEAR VALIDITY

Transfer assessments expire; reassessment is on the regulator's clock, not yours

ADM & PROFILING

Automated decision-making and profiling carry their own obligations, whatever the scale

Governance & Accountability

Trust is not built by better answers.
It is built by accountable decisions.

Privacy by Design

Multi-tenant by design: organisation → client → matter → assessment, every query scoped to the tenant. Client documents, personal data and client-specific reasoning never leave the matter and are never reused across clients.

The knowledge boundary
Humans Decide

Nothing in Praxis concludes on a practitioner's behalf. Draft → in review → approved → issued, with separation of duties enforced by the system: the author can never approve their own assessment.

Immutable Audit Log

Every action in every module is appended to a hash-chained log with a verification endpoint an auditor can call. Issued reports are rendered from locked snapshots; revisions clone and supersede, never overwrite.

Evidence Traceability

Material conclusions carry citations clear enough to verify — provision, source version, and, in Privacy Audit, the verbatim quote and its position in the notice. Evidence is SHA-256 hashed the moment it is uploaded.

Regulator Ready

Built on the Commissioner's own DPIA Guideline, the s.129 conditions and the s.12B Annex B form. A Commissioner-ready audit pack per client or entity, produced on demand.

Human Accountability

The accountable decision, and the signature, stays with the qualified person. Outputs are compliance aids and a Praxis Grade is explicitly not a certification; the platform is honest about what it is.

Platform disclaimer

Hybrid Intelligence does not replace professional judgment. It amplifies it. AI accelerates the work. HI provided direction. Humans remain accountable.

Who Relies On It

Built for whoever signs the assessment.

The method and the record are the same for everyone. What differs is the desk the obligation lands on, and what each desk needs to be able to prove.

Why law firms choose Praxis

Carry more privacy matters per lawyer — and sign every one with confidence.

  • Firm → client → matter hierarchy with every query firm-scoped; per-client workspaces you can demonstrate are segregated
  • Partner sign-off enforced, not assumed: the associate who prepared the assessment cannot approve it
  • Evidence hashed on upload with a surfaced disposal date, a chain of custody for every supporting document
  • A Commissioner-ready audit pack per client, produced on demand; licensed by active client matter, never by seat
For law firms
Why DPOs choose Praxis

A register you can hand to the Commissioner — not a folder you have to explain.

  • One register of DPIAs, transfers and notices across every entity, with coverage and status by business unit
  • Owner, admin, DPO, contributor and viewer roles; two-factor authentication; SSO via OIDC (Entra, Google, Okta)
  • Nothing quietly expires: reassessment triggers on DPIAs and a three-year validity clock on every transfer assessment
  • Dispute-proof records: hash-chained logs, hashed evidence and immutable issued snapshots
For enterprise DPOs
Why compliance teams choose Praxis

Do the assessment properly, keep the record, and prove both — without hiring ahead of demand.

  • Guided workflows that ask the right questions in the order the Guideline asks them, ending in a signed, retained record
  • The free screening tells you what applies; the notice audit shows what you under-disclose, with the passage behind each finding
  • Try the whole suite free for 7 days, then pay per assessment or subscribe, no procurement cycle
  • Work directly, or through a privacy adviser who uses Praxis; the record is yours either way
For compliance teams & sector SMEs
Compliance Framework Support

Named instruments, not generic templates.

Each module is built on the specific instrument it answers. Frameworks are named as references for the workflow, not as published legal conclusions.

Malaysia PDPA

Personal Data Protection Act 2010 (Act 709) as amended by Act A1727

The statutory floor beneath every module

DPIA

PDPA DPIA Guideline 2026 · DEICA sequence · 20,000 / 10,000 triggers

Praxis DPIA

CBTIA

s.129 cross-border transfers · eight conditions · CBPDT guidance

Praxis Frontier · Praxis Passport

AI Governance

ADMP Guideline — automated decision-making and profiling obligations

Praxis DPIA (ADM & profiling risks)

Privacy Notices

s.7 notice & choice · Act A1727 readiness · Data Protection by Design guidance

Praxis Privacy Audit

Breach Notification

s.12B · Annex B notification form · 72-hour Commissioner clock

Praxis Breach

How To Start

Five steps from sign-up to a subscription —
with a finished, issued report before you pay.

You never buy on a promise. The first complete assessment is free, and it produces the same submission-ready report a paying subscriber gets.

  1. 1

    Sign up

    Create an organisation with a company email address.

    No card · no procurement cycle
  2. 2

    Start trial

    Open your first client workspace in Praxis DPIA, Frontier or Privacy Audit.

    Whole suite free for 7 days
  3. 3

    Complete assessment

    Work the guided workflow on a scenario you recognise; a second person reviews and approves.

    Human sign-off enforced
  4. 4

    Generate evidence

    Issue the report from a locked snapshot — with hashed evidence, the review trail and the audit chain behind it.

    Yours for life · listed in Praxis Integrity
  5. 5

    Subscribe

    Buy one assessment at a time, or take a suite plan for every module. Fees paid in the last 90 days are credited.

    Per assessment from RM590 · suite from RM599/month
Commercial Model

Priced for how each desk actually works.

Firms license Praxis by active client matter — never by seat. Enterprise DPO teams take an annual organisation plan. Smaller organisations try the whole suite free for 7 days, then buy one assessment or subscribe online. Archived work keeps its full history and evidence at no continuing cost, and if you stop paying nothing is deleted.

Start Free TrialSee plans and pricing
Design Partner Programme

Shape the method — and put it to work early.

We are onboarding a small cohort of law firms, DPO teams and sector businesses to validate the workflow before general availability. Partners influence the methodology, the review controls and the report itself. Participation never requires delegating legal judgment to the platform.

Request a DemonstrationApply to the programme
Before You Commit

The questions procurement, risk and the partners will ask.

AI does the processing: it reads the sources, maps obligations to your facts, drafts assessments and notice audits, pre-scores destination jurisdictions and assembles evidence. It never owns the conclusion, accepts residual risk, interprets regulatory intent on its own, or approves anything. Assessments move draft → in review → approved → issued, and the system will not let the author approve their own work. That division is what we mean by Hybrid Intelligence.

No. Praxis structures and evidences professional analysis. Outputs are compliance aids that require review and approval by an appropriately qualified person before reliance or issue, and a Praxis Grade is explicitly not a certification. See the platform disclaimer.

Client documents, personal data, legal advice and client-specific reasoning stay inside the matter and are never reused across clients. Praxis improves only through generic methodology, public-source evidence mappings and de-identified quality signals — a design commitment we call the knowledge boundary.

Praxis DPIA, Praxis Frontier and Praxis Privacy Audit are in production. Praxis Breach is in early access, Praxis Schema is a preview, and Praxis Passport and Praxis Integrity are in development and planned respectively. Every suite plan includes all seven as each ships, and unreleased modules are described as direction, not availability.

By the workflow itself. Assessments move draft → in review → approved → issued, and the system will not let the author approve their own work. Low-confidence findings in Privacy Audit are routed to human review rather than asserted. Nothing reaches a client without a practitioner having reviewed the reasoning.

Yes. Every module keeps an append-only, hash-chained audit log with a verification endpoint; evidence is SHA-256 hashed on upload; issued reports are rendered from immutable snapshots. Praxis Integrity will add a public registry so a report's authenticity, methodology version and validity can be checked without seeing its contents.

Owner, admin, DPO, contributor and viewer roles enforced per route, two-factor authentication, and per-organisation single sign-on via OIDC (Azure AD / Entra, Google, Okta) on enterprise plans. Firms and groups are multi-tenant by design, with every query scoped to the tenant.

After a 7-day grace period workspaces become read-only. Nothing is deleted; every issued report stays downloadable; subscribe again and everything unlocks. Your matters and evidence are yours — portability and fair exit terms are published in the agreement, not discovered at renewal.

Firms license by active client matter (a client workspace) on monthly or annual suite plans; enterprise DPO offices take an annual organisation plan quoted by entities and business units; smaller organisations try the whole suite free for 7 days, then buy one assessment or subscribe online by FPX, DuitNow, card or e-wallet. See pricing.
Request a DemonstrationTrust & security overview
Compliance for the HI Era

Artificial Intelligence processes information.
Hybrid Intelligence turns information into direction.
Human experts turn direction into decisions.

The future belongs to organisations that can combine all three.

Artificial Intelligence Accelerates.Hybrid Intelligence Navigates.Humans Decide.

Faster Compliance.Human Accountability.Evidence a Regulator can Verify.

Praxis SystemsHybrid Intelligence for Compliance

A 30-minute demonstration on a scenario you recognise — or try the whole suite free for 7 days, starting today.

See Praxis on your own matter.

Request a Demonstration Start Free Trial
Praxis SystemsRequest a Demonstration