Field guide · School data

PDPA privacy questions for a school platform vendor

Settle who answers for the records. Malaysia’s Personal Data Protection Department states that a data controller processes personal data, has control over the processing or authorises it, and that where one organisation processes data on another’s behalf the first is the controller and must ensure the processor guarantees security measures and complies with them. Then ask one question per principle, and write the answers down.

Published by EASY EDU SDN BHD · 14 Oct 2026

On this page

Who publishes this guide. EASY EDU SDN BHD, part of ES PRODUCATION GROUPS BERHAD, publishes this vendor-neutral guide. The timetable screens elsewhere on this site are illustrative design concepts, so apply these questions to Easy Edu exactly as you would to any other vendor, and ask for its current product record.

Method and scope. Prepared from the public sources listed below; they do not describe or endorse Easy Edu.

Key takeaways

What should a school ask about privacy in a first platform meeting?

01
The Personal Data Protection Department describes a data controller as an individual or organization that processes personal data, has control over the processing, or authorizes it.
02
Where one organisation processes data on another's behalf, the department's own worked example makes the first the data controller and the second the data processor, and requires the controller to ensure the processor guarantees security measures and complies with them.
03
The seven principles in Act 709 are the agenda. Ask one question per principle rather than asking the vendor to describe its security in general.
04
Ask where the data sits. Asked about data placed outside Malaysia, the department states that the organisation must ensure the place has in force a law substantially similar to the PDPA or with the same purpose, or that the place ensures an adequate level of protection at least equivalent to the PDPA's.
05
Write the answers down with a date and a name beside each one. Where a Data Protection Officer question arises, the department's published thresholds include processing involving "personal data exceeding 20,000 data subjects".

This guide is not legal advice; a school's own obligations under Act 709 should be checked with its own adviser and against the current text of the Act.

Who is responsible for student data once a platform is involved?

This is the first thing to settle rather than assume. The Personal Data Protection Department describes a data controller as an individual or organization that is processing personal data, has "control over the processing of personal data", or is "Authorizing the processing of personal data".

The department states that the Act protects "the personal information of an individual that is processed for the purpose of commercial transactions", that "All individuals and organizations that process personal data in their affairs must comply with the regulations set out in the Personal Data Protection Act 2010", and that "The Federal Government and State Governments are exempt", so a school establishes which of those describes it before applying anything below.

The department's own worked example is the one to take into the meeting. "If organization A obtains the services of organization B to process data on its behalf, then in this relationship, organization A is the data controller while organization B is the data processor." It then states what the Act requires of organization A in that pairing: the Act "requires organization A to ensure that organization B guarantees to take security measures to protect the data it processes", and "Organization A is also required by the Act to ensure that organization B complies with the measures".

Data controller: The party that decides what is collected, why, and who may see it.
Data processor: The party that processes the records on the controller's instructions.
What the Act asks of the controller: To ensure the processor guarantees security measures, and to ensure it complies with them.

"The vendor handles privacy" is not an answer a school can rely on. The first meeting is where the checking starts, not where it is handed over.

Which questions come straight out of the seven principles?

The department states that "The Personal Data Protection Act contains seven principles of information handling practices that must be followed", and lists them as the General Principles, the Principles of Notice and Choice, the Principle of Revelation, the Safety Principles, the Storage Principles, the Principles of Data Integrity and the Access Principles. Each one turns into a question with a checkable answer.

GeneralNotice and choiceDisclosureSecurityStorageData integrityAccess

One question per principle, for the first meeting. The principle names are the department's own; the questions are ours.
Principle	Question to ask
General	What personal data does the platform process, and on whose instruction is each item collected?
Notice and choice	Which notice does a parent or guardian see, where does it appear, and who writes it, the school or the vendor?
Disclosure	Who outside the school can see a record, including sub-processors, support staff and analytics services?
Security	Which measures protect the data in storage and in transit, and how is that stated in writing?
Storage	How long is each class of record kept after a student leaves, and what triggers deletion?
Data integrity	How is a wrong record corrected, who may correct it, and what happens to the earlier version?
Access	How does a parent or guardian see what is held, and how long does that take?

Two of those come with the department's own wording behind them, on its principles page. On security it describes taking steps "to ensure that the data is secure, not modified, misused or given to unauthorized parties". On storage it states that "personal data is not allowed to be stored in a processing for more than the necessary time limit". The security and storage principles are statements about what the Act requires of the party processing the data, not about what a product brochure says.

The access and correction questions have the same backing. The department describes the access principle as a person being "given the right to access his personal data held by a data user and also be able to correct his data so that it is up-to-date", and the data integrity principle as each record being "accurate, complete, not confusing and up-to-date in accordance with the purpose for which the data is stored and processed".

The department also states that the Act defines sensitive personal data as information about an individual's "health or physical or mental condition, political opinions, religious beliefs and other beliefs of a similar nature", and that such processing "must be with the express consent of the data subject". Easy Edu's guide on school software data export and governance questions carries the export and deletion side of the same conversation.

What has to be written into the agreement rather than said in the meeting?

The contract is where one of the department's own answers lands. Answering a question about how insurance agents and other third parties are liable for breaches of the PDPA, it states: "If the data controller clearly states in its contract with the third party the responsibility to comply with the PDPA when processing personal data on their behalf, any breach by the third party may be subject to fines/imprisonment or both."

Read the department's contract answer as an instruction about drafting, not as reassurance. A school asking for the obligation to appear in the agreement is asking for the ordinary thing, not an unusual concession. Four items are worth naming in the written record of the meeting.

The compliance obligation itself, stated as the processor's responsibility when processing on the school's behalf.
The security measures the processor guarantees, in enough detail that the school can tell whether they are being complied with.
Sub-processors: who else touches the data, and what happens when that list changes.
Exit: what is exported, in what format, and what is deleted, with the timing of each.

Easy Edu's guide to data ownership, export and deletion sets out the exit evidence to ask for, and the school platform evaluation guide puts these answers next to the workflow and status checks from the rest of the process.

Where will the data sit, and does that change anything?

It changes what the school has to establish. Asked about data placed outside Malaysia, the department states that "you must ensure that there is in that place outside Malaysia in force any law which is substantially similar to the PDPA, or which has the same purpose as the Act; or the place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection provided by the PDPA".

So the question in the meeting is specific rather than technical. Name the country the data sits in, and name the basis. A vendor that can say where the records are held, and on which of those two grounds, has answered it. A vendor that says only that the service is "cloud hosted" has not yet started.

The same answer matters for the processing definition the department publishes, which is wider than most people assume: processing "means doing something to the data including collecting, recording, holding, storing, organizing, changing, disclosing and destroying", and "Just by reading or accessing information is already considered" processing. Support access counts. So does a vendor engineer opening a record to investigate a fault.

Easy Edu's guide on checking role-based access covers how to test who can see what inside the product, which is the other half of this question.

Does a Data Protection Officer have to be involved?

The department publishes the thresholds the duty turns on. It describes a Data Protection Officer as "an individual appointed by an organization in accordance with Section 12A of the Personal Data Protection Act 2010 [Act 709] to ensure compliance with Act 709", and states that the appointment "will take effect from" "1 June 2025".

It also states that "Not all organizations are required to appoint a Data Protection Officer", and that a data controller or data processor must appoint one or more where the processing involves "personal data exceeding 20,000 data subjects", "sensitive personal data including financial information data exceeding 10,000 data subjects", or "activities that require regular and systematic monitoring, such as online user behavior tracking".

The Data Protection Officer thresholds are counted on the processing, not on the organisation's size, so a platform serving many schools can be above a line that each school is below. Two questions follow: has the vendor appointed a Data Protection Officer, and if so, how is that person reached? The department states that a controller which meets the conditions "must notify the appointment to the Commissioner within twenty-one (21) days from the date of appointment", and that changes "must be updated no later than fourteen (14) days from the effective date of the new appointment".

One point is worth carrying back to the school's own management. The department states that the officer "is not personally responsible for data protection compliance" and that "The responsibility for ensuring compliance with Act 709 remains with the data controller or data processor". Appointing someone does not move the duty.

What should the school write down before the meeting ends?

Before a first privacy meeting with a school platform vendor ends, the school should have the answers written down: a privacy answer that is not recorded is not evidence at renewal. Keep it to one page, with a date and a name against each line.

Roles: Which party is data controller, which is processor, and whether the vendor agrees in writing.
Data map: What is collected, by whom, and which items are sensitive personal data.
Location: The countries the data sits in, and the basis for each.
Access: Who can reach a record on the vendor's side, and how that access is logged.
Retention: How long each class of record is kept, and what triggers deletion.
Contact: The named person for data questions, and the Data Protection Officer where one has been appointed.
Open points: Everything answered as "we can look into that", with an owner and a date.

None of these questions is a test the vendor can fail politely. The school platform privacy questions above are either answered or they are not, and the unanswered ones are the agenda for the second meeting. Easy Edu's evaluation session agenda shows where this sits in a full evaluation, and the demo question guide covers the workflow half of the same visit.

Quick answers

Frequently asked questions about school platform privacy

Does a school stop being responsible once a platform processes the data?

Not automatically. In the Personal Data Protection Department's own example, the organisation that obtains another's services to process data on its behalf is the data controller, and the Act requires it to ensure the processor guarantees security measures and complies with them.

What counts as sensitive personal data in a school?

The department states that the Act defines sensitive personal data as information about an individual's health or physical or mental condition, political opinions, religious beliefs and other beliefs of a similar nature. It also states that processing it is not allowed except for the purposes specified in the Act, and must be with the express consent of the data subject.

Does our school need a Data Protection Officer?

The department publishes thresholds; a school checks them against its own processing and takes its own advice. It states that not all organizations are required to appoint one, and names processing involving personal data exceeding 20,000 data subjects, sensitive personal data including financial information exceeding 10,000 data subjects, or activities requiring regular and systematic monitoring. Ask the vendor the same question about its own processing.

Can a school platform hold our records outside Malaysia?

Only on a stated basis. The department's answer to a similar question is that the organisation must ensure the place outside Malaysia has in force a law substantially similar to the PDPA or with the same purpose, or that the place ensures an adequate level of protection at least equivalent to the PDPA's. Ask for the country and the basis, in writing.

Is a vendor's privacy page enough evidence?

It is a starting point, not the answer. The questions above ask what the platform does with a school's records, who can reach them, where they sit and how long they are kept.

External context

Which sources does this guide rely on?

Personal Data Protection Department, Malaysia: Frequently Asked Questions, read 14 October 2026: the purpose of the Act, who must comply and the Federal and State Government exemption; the seven principles; the definition of processing; data controller and data processor, with the organisation A and organisation B example; the contract wording for third parties; sensitive personal data and express consent; data held outside Malaysia; and the Data Protection Officer provisions, including Section 12A, the 1 June 2025 effective date, the appointment thresholds, the 21-day notification and 14-day update periods, and that the officer is not personally responsible for compliance.
Personal Data Protection Department, Malaysia: Principles of Personal Data Protection, read 14 October 2026: the department's own descriptions of the security, storage, data integrity and access principles.

These sources give evaluation and legal context only. They do not describe, assess or endorse Easy Edu. This guide is not legal advice; a school's own obligations under Act 709 should be checked with its own adviser and against the current text of the Act.

Next move

Send the privacy questions in writing

Send the questions from this guide to Easy Edu's published enquiry email, without student records, and ask for written answers to the ones that matter most to your school.

Email the privacy questions Read the evaluation guide

EVERYTHING ON THIS SITE