Do I need a DPIA? Request a Demonstration
Methodology

A structured method you can inspect — not a model you have to believe.

The foundation of a Praxis assessment is a documented, versioned methodology: stated criteria, stated assumptions, stated limits. DEICA for DPIAs, a 21-provision Malaysian-floor matrix for transfers, three-layer statutory scoring for notices — every finding tied to source, quote, version and the assessments that relied on it.

Request the Methodology Overview
Three methods, one engine

DEICA for DPIAs. A Malaysian-floor matrix for transfers.
Three-layer statutory scoring for notices.

Impact assessments follow the Commissioner's DEICA sequence with two-tier statutory screening and a 3×3 risk matrix. Cross-border transfers compare the destination's law against a 21-provision Malaysian floor with four essential-guarantee gates, then work through the eight s.129 conditions. Privacy notices are scored in three never-blended layers — PDPA 2010 core (72 points), Act A1727 readiness (48) and Data Protection by Design guidance (26) — with a disclosure-weighted check on six sensitive-data categories. All three draw on the same maintained evidence base, and all three are versioned.

S ScreenD DescribeE EvaluateI IdentifyC ConsiderA Assess
Validation — DPIA

Implements the DPIA Guideline of 30 April 2026 as written, including its quantitative triggers (20,000 / 10,000 data subjects) and qualitative factor checklist.

Validation — transfers

129 jurisdictions scored on the same 21-provision matrix. Each issued TIA freezes the dataset version it relied on, so a finding is reproducible after the data is updated.

Validation — notices

Frozen, versioned methodology validated against 137 published Malaysian privacy notices across 12 sectors, with a gold-fixture regression suite so scores stay comparable across releases.

PDPA Act 709 (Act A1727 amendments)PDPA DPIA Guideline 2026 · DEICAADMP Guidelines.129 cross-border · CBPDTs.12B breach notification · Annex B

Frameworks are named as references for the workflow — not as published legal conclusions.

Structured Freedom

Standardise the evidence. Preserve the judgment.

Consistency and professional nuance are not in conflict — provided you are explicit about which is which. Praxis standardises one column and deliberately leaves the other alone.

Standardised by Praxis

Source provenance · evidence mappings · assessment criteria · required questions · validation rules · review checkpoints · audit history.

Reserved to the professional

Contextual interpretation · weighting of unusual facts · reasoned departures · client-specific advice · the final conclusion and recommendation.

Two competent professionals may reach different defensible conclusions from the same evidence. Praxis does not force false uniformity — it makes the route to each conclusion transparent, evidenced and reviewable.
Theory of Knowledge

How information becomes a decision — and stays explainable.

Seven propositions govern how Praxis treats evidence. They are the reason a finding can be defended a year after it was made.

01
A source is not a conclusion.
02
A citation supports a claim only when its meaning and context are preserved.
03
A methodology should state its criteria, assumptions, version and limits.
04
Scoring supports comparison; it does not erase ambiguity.
05
Technology may assist throughout the chain; professional responsibility remains human.
06
Every material conclusion should be explainable after the fact.
07
Confidence must be proportionate to the quality, completeness and currency of the evidence.
Proposition 07 in practice: every Praxis Privacy finding carries a High, Medium or Low confidence band, and Low-confidence findings are routed to human review rather than asserted.
Traceable Findings

Tied to sources, versions and the work that relied on them.

Each finding is associated with its legal sources, the source version, review status and the assessments that relied upon it — so a conclusion can always be traced, and a change connected back to the work it may affect.

Source, quote & version
The provision relied upon, the exact version reviewed — and, for notice audits, the verbatim passage with its position in the document.
Review status
Whether the source has been reviewed, and when.
Dependent assessments
The assessments that relied on the finding, for change-impact analysis.
Audit chain
Every action in every application is appended to a hash-chained log with a verification endpoint; issued outputs are rendered from immutable snapshots.

Praxis structures and evidences professional analysis. It does not independently provide legal advice or replace the review and approval of an appropriately qualified person. Detailed scoring logic is maintained as confidential methodology; the criteria, sources and reasoning behind any finding are open to the professional reviewing it.

How the DEICA implementation, the Malaysian-floor matrix, the three-layer notice scoring model and the traceability chain hold up under review.

Request the methodology overview.

Request the Methodology Overview Explore Praxis DPIA