What you keep, who can see it

Applicant data and retention review

Application packs hold identity documents, contact details, salary history, and sometimes health or family notes that never belonged on the form. Under Malaysia’s Personal Data Protection Act 2010, that pile is not a drawer of harmless paper. It is personal data with a purpose limit and a retention story you should be able to tell.

Indicative duration: 9–13 working days. A firm timetable sits in the engagement letter after we see the sample.

Access and copies

We map who can open shared drives, email inboxes, and printed cabinets. Forwarded PDFs in personal mailboxes are treated as live stores. We note printers, WhatsApp transfers, and agency copies that never came back.

Retention

We compare your stated period for unsuccessful applications with what is still on disk. We do not invent a legal retention number for you; we show the mismatch and the practical deletion path, including backups your IT team forgot to mention.

You take away

Store-and-access map
Notice-versus-practice table
Retention mismatch list
Deletion and access recommendations

If this is not the right cut of the file, the full list of reviews may fit better. To talk through scope, ask the desk for a briefing.

Request this review