Duration
1 day
Overview
YB Dato' Sri Ahmad Shabery bin Cheek, Minister of Communications and Multimedia, has made announcement that the Personal Data Protection Act 2010 ("PDPA") comes into operation on 15 November 2013. With PDPA coming into force, data users will have a three-month transitional period to comply with its provisions in respect of existing personal data being processed, but will have to immediately comply with its provisions in respect of new personal data collected.
Will this affect me?
Both the public and private agencies who process their customers' personal data will need to re-evaluate their current data privacy policies, processes and personal data management. Indiviuals will now have a new set of mandated rights, whereby they need to be informed about their personal data as well as the rights to access, correct and also to control the procession of the personal date by other parties.
Does this apply to my company?
This act is applicable to Malaysian companies that process personal data. Non-Malaysian companies who use equipment in Malaysia to process personal data is also subject to the PDPA. For non Malaysian companies, a designated Malaysian representative is required in this case.
This training is specially crafted for those who need to know more about personal data protection and who has contact with personal data on a regular basis.
There are some new regulations coming into Malaysia as of 25th May 2018. These regulations are known as the EU GDPR. The full name is European Union General Data Protection Regulation 2016 and malaysian companies dealng with EU data or storing their HR data in their EU parent company are bound by these regulations. This update will be given during the training.
Learning Outcomes
This seminar is to educate on the legal and practical know-how that will be necessary to your compliance with the PDPA.
By the end of the training, delegates will be able to understand, implement and ensure compliance to the PDPA
Who Must Attend
- Directors, Chief Executive Officers, Chief Financial Officers, General Managers, Human Resource Managers, Compliance Officers. Marketing & Sales Managers, Business Entrepreneurs, Legal Advisor
- Delegates who handle personal data on a regular basis as part of their job functions from the following departments:
- IT Legal & Compliance
- Human Resources
- Customer service
- Internal Audit
- Sales & Marketing
- Accounting & Finance
Module 1: Data Protection At the Workplace
Discussion on General Principles on Personal Data Protection Act 2010
This module will look at how to:
- Appreciate who and what is covered by Personal Data Protection rules
- Understand the organisation’s policy and aims on personal data use
- Overview of the Act
- Know and apply the core principles for personal data use
Module 2: Criminal Offences and Liabilities under the PDPA 2010
- Punishment for contravention of the Act
- Offences by body corporate
- Contravention of the personal data protection principles
- Processing of sensitive personal data in contravention to Section 40
- Unlawful collection or disclosure of personal data
Module 3: Notice and Choice Principle
- When do you need to seek the consent of data subjects?
- How do you seek consent and exemptions to consent
- Channels of serving Notice to employees, contractors, supplies, vendors and visitors
- Guidelines on Consent
- Recognise when, and for what purpose staff / customer data may be used
- Questions to ask when collecting Data.
Module 4: Compliance: The What, When and How
- What do companies need to do in order to comply?
- When do companies need to fully comply?
The Employer’s Perspective: Change of Approach Required?
The series of changes intended to be brought about by the Act will invariably affect the way employers approach employment issues where the employees’ personal information is involved.
- Understanding applications to Employment Relationships
- Understanding how the Employment Act 1955 affects Personal Data
- How do companies set up an effective compliance framework?
- Guidelines on understanding Purpose under Section 6 PDPA 2010.
Module 5: Issues and Implications of the Principles
- Disclosure Principle and guidelines on when you can refuse to disclose or partially disclose;
- Retention Principle in relation to Employees and former employees;
- Data Integrity Principle
- Access Principle
- Activities relating to each Principle will be done.
Module 6: Benefit and Risks
- Benefits and challenges in being PDPA complaint
- Understanding the implementation of PDPA and the stages of Employment that is Pre/Beginning/During and End of Employment.
- Potential privacy related risks to organisations
- Case study on personal data issues and impacts
Module 7: The Personal Data Protection Standards 2015
- The Data Security Standard distinguishes between conventional and electronic data management and prescribes various security measures in relation to each.
- Data Retention Standard focuses
- Data Storage Standards
- Data Integrity Standard
- Data Security Standard
Module 8: Human Resource Department and PDPA principles
For Human Resources departments, meeting the requirements of data protection law can be particularly challenging. Holding and handling staff information carries significant legal responsibilities and risks. This module discusses key areas of compliance issues.
- Ensuring that the recruitment and selection process meets legal requirements, including the content of application forms, pre-employment vetting, criminal records, medical checks and the interview process
- Retaining staff records, and appropriate periods of time for keeping information
- Dealing with staff information requests – what must be disclosed and can be withheld
- Disclosing staff information to outside third parties –the legal requirements that must be met before staff information can be sent outside the organisation
- References and the rights of ex-members of staff
- Monitoring staff activities and communication including using Managers, CCTV cameras and website technologies
- Outsourcing functions to third party providers
Module 9: Security Guidance
This module looks at what constitutes a Personal data security breach and how such breaches can occur. It also considers how to avoid breaches, and the practical steps that should be taken when a breach occurs. Key aspects of this module include:
- Analysis of the Security Principle under Section 9 PDPA
- Managing Information security
- Data Security Standard -Implementation
- Understanding risks to Personal Information
- Taking a holistic approach to data security – staff vetting and access and other important organisational measures that should be implemented
- Knowing what to do in the event of a data protection breach
The Principles 2010 and Standards 2015 will provide protection to the individual’s personal data, thereby safeguarding the interests of consumers, and e-commerce, network and non-network facility practitioners.
Methodology
Interactive lectures, Activities, and discussion
Personal Data Protection Checklist For Organisations will be emailed to Human Resource Manager to be shared with the Pro-tem Committee as a guide on the implementation exercise.
Programme scope, delivery arrangements and suitability are confirmed during enquiry.