Is Your Business PDPA Compliant?
Take the Free 15-Minute Assessment

Yes. The 67-question assessment, the instant score and the PDF report are free. There is no payment step anywhere in the tool. Providing your contact details is required only to download the PDF report, and a consultation booking afterwards is optional.

Most people finish in 15 to 20 minutes. Progress saves automatically in your browser, so you can stop at any question and continue later on the same device.

A thorough PDPA compliance assessment examines every area where the Act imposes obligations. This tool asks 67 questions across 10 areas: data governance and DPO appointment, data inventory and mapping, privacy notices and consent, security measures, data subject rights, third-party and vendor management, cross-border transfers, breach management, training and awareness, and policies and documentation.

Each answer is scored as fully implemented, partially implemented, not implemented, or not applicable. The result is an overall readiness score, a breakdown per area, and a prioritised action plan, delivered instantly in the browser and as a downloadable PDF report.

Start with a structured self-assessment: inventory what personal data you hold, compare your practices against each PDPA obligation, score every gap, and turn the gaps into a prioritised action plan. The free 67-question assessment on this page automates those steps and takes about 15 to 20 minutes to complete.

A self-assessment is a diagnostic, not a certification. For organisations with significant exposure (large databases, sensitive data, cross-border flows), the sensible sequence is: run the self-assessment, fix the obvious gaps, then have the remaining questions reviewed professionally.

No. The assessment runs without registration. You are asked for your name, email and phone number only at the end, and only if you want the detailed PDF report.

Your answers are processed in your browser and saved locally on your device. Nothing is sent to us while you answer. If you submit the report form, your contact details, your scores and your PDF report are sent to Edwin Lee & Partners so we can follow up; the individual answers you selected are not transmitted.

The amendments introduced mandatory appointment of a Data Protection Officer for qualifying organisations, mandatory data breach notification, an expanded definition of sensitive personal data, and removal of the whitelist regime for cross-border transfers.

This tool is owned and operated by Edwin Lee & Partners, a Malaysian law firm registered with the Malaysian Bar (Reg. No. 000020008633) and regulated under the Legal Profession Act 1976, based in Kuala Lumpur.

Read the prioritised action plan in your report and fix the highest-risk gaps first. If you want professional support, you can book a free consultation through the link in the report, or explore outsourced DPO services at dpomalaysia.my and the free DPIA tool at dpia.com.my.