Questions to ask an IT vendor in Malaysia

Hand your member list to an IT vendor and the legal responsibility stays with you. If they lose it, the Commissioner comes to you first. That has always been broadly true here, and since last year the rules around it have tightened considerably.

Most vendors are decent. Almost every bad outcome we have seen came from something nobody wrote down, so these are the questions worth asking before you sign. Some of them make vendors uncomfortable, ourselves included.

This is general information and not legal advice. It was written in September 2026 and we will revisit it in March 2027. Every legal claim below links to its source so you can check it yourself.

What changed in 2025

The Personal Data Protection Act 2010 was amended by the Personal Data Protection (Amendment) Act 2024, which came into force in stages through last year. Both texts sit on the Department of Personal Data Protection website, and the full Act 709 reprint is on the Attorney General's portal.

From 1 April 2025, data processors became directly liable under the Security Principle in section 9. Before that, only the organisation that collected the data carried the obligation. Your vendor now carries one too, and breaching the data protection principles can cost up to RM1 million and three years' imprisonment. The same date made biometric data sensitive personal data, replaced "data user" with "data controller" throughout the Act, and removed the old whitelist for sending data overseas.

From 1 June 2025, three more obligations landed. Breach notification became mandatory. Certain organisations must appoint a data protection officer. And people gained a right to data portability.

The breach rules matter most when choosing a vendor. Under section 12B and the Data Breach Notification Guideline, you notify the Commissioner within 72 hours where a breach is likely to cause significant harm or affects more than 1,000 people, then tell affected individuals within seven days of that. Failing to notify carries up to RM250,000 and two years. The duty is yours. If your vendor sits on the news for a week, you have still missed your deadline.

Is this a real business

Ask for the registration number, then check it yourself on SSM e-Info without involving them. A company profile costs RM15.40 and a sole proprietor's business profile RM10.

Look for a struck-off or dormant status, a registration dated a few weeks before your first meeting, directors who are not the people sitting across from you, and a sole proprietorship describing itself as a firm.

Ask to speak to a client who left. Any vendor can produce a happy customer. Ask the one who moved on whether the handover happened promptly and whether the final invoice matched the quote.

Ask what happens if their lead developer leaves. Small vendors often run on one or two people, which is fine as long as somebody has written things down. A good answer names a second person who knows your system. "That won't happen" is not an answer.

Who owns the code

Malaysian law is kinder here than most people expect, and kinder than Singapore's. Section 26(2) of the Copyright Act 1987 transfers copyright in commissioned work to whoever commissioned it, subject to any agreement excluding or limiting that transfer.

That last clause is where it goes wrong. The default favours you, and a vendor's standard terms can quietly remove it. Read them. A fair arrangement assigns you the custom code on payment and gives you a permanent licence to whatever reusable components the vendor brought along.

Whose name is on the domain

Yours. Same for the cloud accounts, the app store listing and the certificates. Give the vendor administrator access by all means, but the registered owner should be your organisation, on an email address you control.

When a vendor holds the domain, a billing dispute can take your website and email offline while it gets resolved. Setting it up correctly costs nothing at the start of a relationship and is painful to fix at the end of one.

Data protection questions

Ask whether they will sign a data processing agreement. The Act does not spell out a required contract, but section 9 expects you to take practical steps to ensure your processor protects the data, and a signed agreement is how you show it. A vendor who refuses has told you something useful.

Ask where the data is stored and who else touches it. You want the hosting country and a written list of sub-processors, meaning the cloud host, the email service, the analytics tool, any AI service in the stack. Since April 2025 you can transfer data abroad where the destination has comparable protection or you have taken reasonable precautions and done due diligence, and the Cross-Border Transfer Guideline sets out what that looks like. Keep a record of each transfer.

Ask who their data protection officer is. Appointment is mandatory above certain thresholds, set out in the DPO Appointment Guideline: processing personal data of more than 20,000 people, sensitive data of more than 10,000, or regular systematic monitoring. Where it applies, the appointment must be registered with the Commissioner within 21 days at daftar.pdp.gov.my. Below those thresholds it is optional, though "nobody in particular" is still a poor answer from someone holding your data.

Ask how fast they will tell you about a breach. Your clock is 72 hours, so theirs needs to be shorter. Within 24 hours of discovery, in writing, with whatever they know at the time.

Ask what happens to your data when you leave. Returned in a format you can use, deleted everywhere afterwards including backups, confirmed in writing.

Money and scope

Fixed price or time and materials both work. What matters is a written scope and a change process where every change gets priced and approved before anyone starts building.

Ask about the warranty period. Thirty to ninety days after go-live, during which defects get fixed at no charge, is the usual arrangement for custom software. It is a market norm rather than a legal right, so it only exists if you ask for it.

Ask what the service level agreement actually promises. Response and resolution times by severity, support hours in Malaysian time, and a remedy when they miss. An uptime percentage with nothing attached to it is decoration.

Ask what they will do to help you leave. A transition period at agreed rates, data and documentation returned, cooperation with whoever comes next.

Security, without needing to be technical

You do not have to understand the answers. You need to notice whether there is one.

Do all your staff use multi-factor authentication on our systems. How quickly do you apply critical security patches, and a number of days beats "when we can". When did you last restore a backup, and can we watch the next one. Who can reach our data, and how is access removed when somebody leaves.

On certifications, ISO/IEC 27001 and SOC 2 are real and mostly out of reach for a small Malaysian vendor, so their absence tells you little. A genuine certificate names the certifying body, the scope and an expiry date, and you can verify it with that body. A logo on a website is not a certificate.

What to keep checking

Signing is the start.

Every month, look at whether backup jobs are reporting success, what the patch status is, and whether the invoice matches what you actually use.

Every quarter, restore something for real. Remove leavers and dormant accounts. Audit licences and seats. Check the sub-processor list for quiet additions. CIS Controls v8 puts it plainly under Safeguard 11.5: test backup recovery quarterly, or more often, for a sample of assets. A backup nobody has restored is an assumption.

Twice a year, check domain, certificate and subscription expiry dates, and give each renewal a named owner. Spot-check the documentation against what is actually running.

Once a year, do a full recovery exercise, read the data processing agreement against current law, review how the service level actually performed, and look up the company on SSM again.

Then there are the moments that do not follow a calendar. Someone leaves on either side, so access goes the same day. The vendor gets acquired or loses a key person, so you check the contract and whether handover would actually work. A new integration or AI tool appears, so the sub-processor list and the agreement need updating. A renewal or price rise arrives, so you reread the exit terms before signing again.

When to walk away

They will not sign a data processing agreement. They register your domain in their own name. They will not put code ownership in writing. Nobody is responsible for data protection where the law requires somebody to be. They quote without a written scope. They cannot show you documentation for systems they already run. One person holds every password and there is no record of it. They discourage you from checking their registration or calling references.

If you are using a grant

The MSME Digital Grant MADANI covers 50 per cent of the invoice up to RM5,000, and you must buy from a Digitalisation Partner registered with MDEC. Per BSN's own FAQ, you need at least 60 per cent Malaysian ownership, registration with SSM, a local authority or SKM, six months of operation, and annual turnover of at least RM50,000. It is one application per business, though you may pick up to three types of digital service. Anyone who received the earlier Digital Matching Grant cannot apply.

Grant rules will push you towards a listed vendor. A listed vendor is still a vendor, and every question above still applies.

One last thing

None of this requires you to be technical or suspicious. It requires you to write things down and to check them occasionally.

If you want a second opinion on a contract or an arrangement you already have, we are happy to look at it. That includes telling you it is fine, which it often is.