The 30/60/90 Operating Cadence for Digital Workers
The review cadence that turns a launched Digital Worker into a compounding asset instead of a stalling pilot — what to measure, when, and who owns it.
Read the articlePDPA and Agentic AI: The 2026 Reading
What Malaysian leadership teams need to know when Digital Workers begin handling personal data and customer interactions under Malaysia's updated PDPA framework.
The short version
The PDPA 2010 amendments that took effect in 2025 changed three things that materially affect how organisations deploy agentic AI in Malaysia: mandatory breach notification, the introduction of the Data Protection Officer role, and tighter cross-border transfer rules. None of these are new to compliance teams. All of them are new to most AI engineering teams.
What changed (regulators perspective)
- Mandatory breach notification. Personal data breaches must now be reported to the Personal Data Protection Commissioner and affected data subjects within 72 hours of discovery.
- Data Protection Officer requirement. Organisations processing personal data at meaningful scale must appoint a DPO. The role has statutory accountability.
- Cross-border transfer rules. Personal data transfers outside Malaysia now require either adequacy assessment, contractual safeguards, or explicit consent — and the burden of proof sits with the data exporter.
Why this matters for Digital Workers
Digital Workers handle personal data three ways most organisations do not appreciate at design time: (1) input ingestion — they read customer messages, account records, ticketing notes; (2) inference — they pass that data through models that may be hosted outside Malaysia; (3) output retention — their outputs (decisions, drafted responses, summaries) often persist in logs the organisation does not catalogue.
Every one of those interactions is a PDPA processing event. The DPO needs to know they happen. The cross-border rules apply if the model inference happens on infrastructure outside Malaysia. And the breach notification clock starts ticking the moment any of it leaks.
The four questions to answer before a Digital Worker handles personal data
- Where does the inference happen? If the model is hosted in the US, Singapore, or the EU, you have a cross-border transfer to document. If it is hosted in-Malaysia (or on-premise), you do not.
- What is logged, and for how long? Default LLM logging often retains prompts for 30 days. PDPA says you need a retention policy that matches the original purpose — and that policy is your job, not the vendor’s.
- Who is the data controller for the outputs? When a Digital Worker drafts a customer reply that goes into your CRM, you are the controller. Any third-party model becomes a processor with contractual obligations.
- Is the customer informed? The transparency principle requires that data subjects know their data is being processed by AI. Most organisations have not updated their privacy notices.
The cross-border question, in particular
Most Malaysian organisations deploying AI today are calling out to models hosted in the US (OpenAI, Anthropic) or Singapore (regional hosting of various providers). That is a cross-border transfer under the updated PDPA. It is not illegal — but it requires either: an adequacy assessment of the destination country's data protection regime, a written transfer agreement with the model provider that imposes equivalent safeguards, or explicit consent from each data subject.
In practice, most organisations choose the contractual route — they sign a data processing agreement with the model provider. Get your legal team a copy of the provider DPA, have your DPO review it. Most major providers (including ours) have Malaysian-aligned templates available on request.
Our legal team flagged the cross-border issue six months after we had been running the pilot. Fixing it retroactively was painful. If we had run a 30-minute DPO conversation before launch, none of this would have happened.
— CIO, Malaysian healthcare provider
What to do next
If you have a Digital Worker in production handling personal data: get your DPO and legal team a one-page map of where the data goes. If you do not have one in production yet but are about to launch: make the four questions above part of your go-live checklist. This is straightforward compliance hygiene — and skipping it is the kind of error that surfaces during an incident, not before.
Related
More from the field
How a Mid-Sized Malaysian Bank Cut KYC Time 60% with Digital Workers
An anonymised case study: a Klang Valley universal bank deploys a Digital Worker for KYC document review, cuts average processing time from 18 minutes to 7, and finds the harder problem was governance, not technology.
Read the articleThe Klang Valley CFO Survey: AI in Finance Operations
What 60+ Klang Valley CFOs told us about where AI is replacing manual work in their finance teams — and the specific places it absolutely is not, despite the hype.
Read the articleWant this report applied to your specific operation?
We run on-site workshops in Penang, KL, and Johor — usually a half-day, always tailored.
Book a Workshop