top of page

Legal

Data Protection.

How we safeguard the data clients trust us with, from first assessment to production.

01 Our commitment

AI work runs on data, and much of it is sensitive. We treat its protection as part of the engineering, not an afterthought. This page sets out the controls that apply across our engagements, under Malaysia’s PDPA, the GDPR where applicable, and the terms agreed with each client.

For how we handle personal data about website visitors, contacts and candidates, see our Privacy Policy.

02 Principles

Every processing activity is held to seven principles:

  • Lawfulness, fairness and transparency. Processing has a clear legal basis and is explained plainly.

  • Purpose limitation. Data is used only for the purpose agreed.

  • Data minimization. We collect and use only what the work requires.

  • Accuracy. Data is kept correct and, where needed, up to date.

  • Storage limitation. Data is kept no longer than necessary.

  • Integrity and confidentiality. Data is protected against unauthorized access, loss and damage.

  • Accountability. We can demonstrate compliance with each of the above.

03 Client data in engagements

When we process personal data on a client’s behalf, we act as a data processor under a written data processing agreement. We follow the client’s documented instructions and do not use the data for any other purpose.

04 Minimization and pseudonymization

We reduce exposure before data reaches a model or a developer:

  • Tokenization. Direct identifiers are replaced with reference tokens, with the lookup held separately under restricted access.

  • Encryption. Sensitive fields are encrypted with AES-256, and keys are managed separately from the data.

  • Hashing. One-way hashing (SHA-256) is used where values need to be compared but never reversed.

Pseudonymized data is the default in testing and development environments, analytics and reporting, and any approved sharing with third parties.

05 Security controls

  • Encryption of data at rest and in transit

  • Role-based access, granted only to those who need it

  • Resilient systems with tested backup and recovery

  • Regular testing and evaluation of technical and organizational controls

  • Data protection training for everyone who works with us

06 Impact assessments

We carry out a Data Protection Impact Assessment before processing that poses higher risk to individuals, including:

  • Automated decision-making with legal or similarly significant effects

  • Large-scale processing or systematic monitoring

  • Special categories of data, or data about vulnerable people

  • New technologies or processing techniques

Each assessment covers necessity, risks to individuals and the measures that address them. It is reviewed by our Data Protection Officer and approved by senior management before work begins.

07 Subprocessors and transfers

Every subprocessor is vetted before engagement and bound by a data processing agreement with obligations equivalent to ours. Our primary cloud infrastructure is Microsoft Azure.

​

For transfers across borders, we use safeguards such as the European Commission’s Standard Contractual Clauses and carry out a transfer impact assessment covering the receiving country’s legal framework and any supplementary measures required.

08 Incident response

A dedicated response team, led by our Data Protection Officer, handles suspected breaches.

​

Internal escalation, assessment and containment begins

  • Timeline: Within 4 hours of discovery

Notification to the relevant authority, where required

  • Timeline: Within 72 hours

Notification to affected clients and individuals

  • Timeline: Without undue delay

​

Every incident is recorded in a breach register, along with its impact and the actions taken.

09 Retention and deletion

Client data is kept for the period agreed in the engagement, then returned or securely deleted. Digital data is removed using secure deletion tools; physical media is destroyed through certified methods. Deletion is documented and checked through periodic audit.

10 Accountability

We maintain records of processing activities, review our data holdings regularly, and make our records available to supervisory authorities on request.

11 Contact us

Clients and prospective clients can request further detail on our controls, including our data processing agreement, from our Data Protection Officer.

Sentient Concepts Sdn. Bhd.

Unit 3003, Spaces Kuala Lumpur, Level 30, Menara Prestige, No. 1 Jalan Pinang, 50450 Kuala Lumpur, Malaysia

Email: dpo@sentientconcepts.com

bottom of page