Live — in production
Privacy POLICY audit · Malaysia PDPA
Paste the full text or upload a pdf copy of your company’s privacy policies, notice, or statement you already publish. Praxis Privacy scores it against the Malaysia PDPA statutory text in three never-blended layers, weights the sensitive-data categories you under-disclose, and returns a Praxis Grade with a ruled evidence ledger. Every finding cites its provision and the exact passage. A grade, not a certification, and plainly labelled as such.
The problem
A flat checklist counts items. It does not tell you which sensitive-data categories you are under-disclosing, or which gap carries the largest statutory exposure.
“Retention not adequately addressed” is an opinion. A finding that cites the provision and quotes the exact passage — or its absence — is evidence a DPO or counsel can act on.
Data-protection-by-design maturity is guidance, not obligation. When the two are blended into one score, a maturity gap looks like a violation and a violation hides in the average.
What you getA defensible audit trail against actual PDPA statutory text — every finding cites its provision and an exact quote from your notice.
Statutory layers (PDPA 2010 core, Act A1727 readiness) are never blended with non-binding Data Protection by Design guidance, so maturity gaps are never mistaken for legal violations.
The category layer surfaces exactly which sensitive-data categories are under-disclosed, weighted more heavily than a flat item count.
An illustrative exposure ceiling mapped against the verified PDPA penalty schedule helps a DPO prioritise fixes by what they could cost.
Low-confidence findings route to a documentary-verification review queue rather than being stated as fact — fewer false-positive compliance claims.
A branded PDF with grade cards, exposure, per-principle disclosure bars and a ruled evidence ledger — worded so it cannot be mistaken for a certification.
How it works
The pipeline is deterministic where it can be and reviewed where it must be — and every rating carries the passage it rests on.
Paste the notice URL, text or upload the document. English and Bahasa Malaysia notices are segmented at intake so a bilingual notice is never under-scored.
A deterministic keyword sweep, then retrieval ranking, then semantic adjudication with exact-quote verification; a finding is only kept if its quote appears in your notice.
L1 PDPA 2010 core (six principles), L2 Act A1727 readiness, L3 Data Protection by Design; reported separately, never averaged into one number.
Six special data categories (socio-economic, lifestyle and behaviour, tracking, financial, authenticating, medical and health) checked for disclosure, with a capped, penalty-only deduction where disclosure is weak.
Every finding carries a High, Medium or Low confidence band. Low-confidence findings go to a review queue for documentary verification before they are relied on.
A Praxis Grade A–D, illustrative statutory exposure, per-principle disclosure bars and a ruled evidence ledger with verbatim quotes and character offsets, exported as a branded PDF.
What is inside
L1 PDPA 2010 Core (72 points, six principles), L2 Act A1727 Readiness (48 points), L3 DPbD Readiness (26 points, explicitly non-mandatory). Never blended.
Six special data categories detected and checked; a capped, penalty-only deduction for weak disclosure so sensitive gaps outweigh cosmetic ones.
Deterministic sweep → retrieval ranking → semantic adjudication, with the quoted passage verified against the notice text before a finding is kept.
High / Medium / Low on every finding; Low routes automatically to documentary verification.
Findings mapped against the verified PDPA penalty schedule to give a prioritisation ceiling — illustrative, and labelled as such.
Grade cards, exposure, per-principle disclosure bars and a ruled evidence ledger with verbatim quotes and character offsets.
Notices published in both national languages are segmented at intake and scored on what they actually say.
24-hour, rate-limited share links with a DPO override — send the ledger to counsel without sending the login.
Immutable, append-only record of every audit, plus a Data Inventory Seed that hands structured findings to Praxis DPIA and Frontier.
Built to be defended
Grade a client's published notice against statutory text before you rewrite it — an evidenced starting point for a notice-drafting engagement or a portfolio review.
Every entity and brand graded the same way, with an illustrative exposure view that turns a list of gaps into a remediation order the board understands.
Start here. Grade the notice you already publish and see which sensitive-data categories you under-disclose, with the exact passages behind every finding.
How to get it
Every new organisation gets one complete audit free — the full pipeline and the issued PDF for one notice. After that, buy one at a time or take a suite plan. All prices in MYR, exclusive of applicable tax.
Grade, exposure, evidence ledger and the issued PDF for one notice. Company email required; no card needed.
Audit a notice freeOne clean issued report, listed in Praxis Integrity for easy external audit validation. Credited against your first subscription if you subscribe within 90 days.
Buy one auditPrivacy Audit on its own from RM299/month, or the full suite from RM599/month — every Praxis application, licensed by client workspace.
Compare plans Common questions
Praxis Privacy Audit structures and evidences professional analysis. It does not provide legal advice, and it does not replace the review and approval of an appropriately qualified person before reliance or issue.
Part of the Praxis suite
Every suite plan includes all seven applications as each ships — licensed by client workspace, never by seat. See plans.
Praxis DPIAImpact assessments on the 2026 DPIA Guideline
Praxis Frontiers.129 cross-border transfer assessments
Praxis Privacy AuditPrivacy-notice audit against statutory text
Praxis Breachs.12B breach notification with a live 72-hour clock
Praxis SchemaData mapping and Records of Processing Activities
Praxis PassportCitation-backed adequacy reference across jurisdictions
Praxis IntegrityPublic verification registry for every issued report
Seven applications on one knowledge engine — Praxis DPIA, Frontier, Privacy Audit, Breach, Schema, Passport and Integrity — built on Malaysia's PDPA for law firms, enterprise DPOs and the businesses that handle personal data.
