CHAN & NGOH (“we”, “us”, or “our”) is committed to protecting the privacy and security of personal data collected through our website at [WEBSITE URL] (the “Website”) and in the course of our legal practice. This Privacy Notice is issued in accordance with the Personal Data Protection Act 2010 (“PDPA”) and explains how we collect, use, disclose, and protect your personal data when you visit the Website, submit any form, engage us for legal services, or otherwise interact with us.
This Privacy Notice should be read together with our Website Terms and Conditions of Use. By submitting your personal data to us through the Website, you acknowledge that you have read and understood this Privacy Notice.
1. Scope and Application
The PDPA regulates the processing of personal data in respect of commercial transactions. This Privacy Notice applies to personal data collected from:
- Visitors to the Website;
- Persons submitting enquiries through our Contact/Enquiry Form;
- Subscribers to our newsletter or mailing list;
- Applicants for employment, pupillage, or internship via our Job Application Form;
- Clients and prospective clients in the course of the provision of legal services.
Where personal data is processed in the course of, and for the purpose of, a lawyer-client relationship, such processing is also subject to our professional obligations of confidentiality and privilege under the Legal Profession Act 1976, the Legal Profession (Practice and Etiquette) Rules 1978, and applicable Bar Council rulings, which operate in addition to, and where relevant prevail over, this Privacy Notice in respect of privileged or confidential client information.
2. Personal Data We Collect
We may collect the following categories of personal data, depending on how you interact with the Website:
Category of Personal Data
Name, email address, phone number, company/organisation
Responding to general enquiries submitted via the Contact/Enquiry Form
Consent; performance of pre-contractual steps; legitimate interest in communication
Sending newsletters, updates and marketing information
Newsletter Subscription Form
Name, contact details, CV/resume, academic and employment history, references, and other information provided voluntarily
Processing job applications, assessing suitability for employment; recruitment management
Consent; performance of pre-contractual steps; legitimate interest in recruitment
IP address, browser type, device information, pages visited, cookies
Website analytics, automated collection and tracking/data security, fraud prevention
Automated collection (via cookies, analytics tools, server logs)
Consent (where required); legitimate interest in website security and optimisation
Information disclosed in the course of seeking or receiving services (e.g. a lawyer-client or consultancy relationship)
Provision of legal services, conflict checking and compliance with regulatory obligations
Engagement and service delivery (e.g. emails, meetings, the Website)
Performance of a contract; compliance with legal obligations; legitimate interest in providing professional services
We do not knowingly collect sensitive personal data (as defined under the PDPA, including data relating to health, religious beliefs, political opinions, or the commission of an offence) through the Website, save where you voluntarily provide such information in the course of an enquiry or engagement, in which case we will seek your explicit consent where required by law.
3. How We Collect Personal Data
- Directly from you, when you complete and submit any Form on the Website (Contact/Enquiry, Newsletter Subscription, or Job/Internship Application);
- Automatically, through cookies, log files, and similar tracking technologies when you browse the Website [insert detail on actual cookie usage, e.g. analytics, session cookies];
- From third parties, such as referrals, recruitment platforms, or publicly available sources, where relevant and permitted by law;
- In the course of a lawyer-client engagement, directly from you and from third parties relevant to your matter (e.g., counterparties, regulators, witnesses).
4. Purposes of Processing
We process your personal data for the following purposes:
- To respond to and manage enquiries submitted through the Website;
- To assess and process job, pupillage, or internship applications, including conducting reference and background checks where applicable;
- To send newsletters, legal updates, and event/seminar invitations to subscribers, where consent has been given;
- To perform conflict-of-interest checks and client due diligence prior to accepting any engagement;
- To provide legal services to clients, including drafting, advising, representation, billing, and matter administration;
- To comply with applicable legal, regulatory, and professional obligations, including under the Legal Profession Act 1976, Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (where applicable to legal practitioners performing scheduled activities), and directions of the Malaysian Bar;
- To maintain, operate, and improve the security, functionality, and performance of the Website;
- To protect our legal rights and interests, including in connection with any dispute, claim, or legal proceeding;
- For internal record-keeping, audit, training, and administrative purposes.
5. Legal Basis for Processing
We process your personal data on one or more of the following bases, consistent with the PDPA’s General Principle and Notice and Choice Principle:
- Your consent, which you may withdraw at any time (see Section 10 below), subject to the legal or contractual consequences of withdrawal;
- Where necessary to take steps at your request prior to entering into a contract with you (e.g., assessing a prospective engagement or job application);
- Where necessary to perform a contract to which you are a party (e.g., an engagement letter or contract of service/pupillage);
- Where necessary to comply with a legal or regulatory obligation to which we are subject;
- Where necessary for our legitimate interests in operating our practice and the Website, provided such interests are not overridden by your rights.
6. Disclosure of Personal Data
We do not sell or rent your personal data. We may disclose your personal data to the following classes of recipients, where necessary for the purposes set out above and in compliance with the Disclosure Principle under the PDPA:
- Partners, associates, and staff of CHAN & NGOH on a need-to-know basis;
- Counsel, experts, translators, or other professional advisers engaged in connection with a client matter;
- Courts, tribunals, regulators, statutory bodies, and law enforcement agencies, where required by law or court order;
- The Malaysian Bar, relevant State Bar Committees, or professional indemnity insurers, where required for regulatory or insurance purposes;
- Third-party service providers engaged to support our operations, such as IT service providers, cloud storage/hosting providers, email and newsletter distribution platforms, and recruitment platforms, who process personal data on our behalf and are contractually bound to protect it;
- Any actual or prospective acquirer in connection with a merger, restructuring, or transfer of all or part of our practice, subject to confidentiality obligations.
Where you submit an enquiry that does not proceed to a formal engagement, we will retain such information only for so long as reasonably necessary for record-keeping and conflict-check purposes, and will not disclose it to third parties save as required by law.
7. Cross-Border Transfer of Personal Data
[To be confirmed: if the Website’s hosting provider, email service provider, or any other data processor stores or processes personal data outside Malaysia, this section should specify the relevant countries and confirm compliance with section 129 of the PDPA, which restricts transfer of personal data outside Malaysia unless an applicable exception applies (e.g., the recipient jurisdiction has been gazetted by the Minister, or one of the statutory exceptions under section 129(3) applies, such as user consent, necessity for performance of a contract, or the data user having taken reasonable steps to ensure the data will not be processed in a manner inconsistent with the PDPA).]
Where we engage service providers located outside Malaysia (for example, cloud-based hosting or email platforms), we will take reasonable steps to ensure such providers offer a standard of protection comparable to that required under the PDPA.
8. Data Security
We implement reasonable practical, technical, and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction, in accordance with the Security Principle under the PDPA. These measures include [insert actual measures, e.g.: access controls, encryption of data in transit, restricted staff access on a need-to-know basis, secure storage of physical files]. Notwithstanding such measures, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and thereafter in accordance with our internal retention policy, applicable professional conduct rules (including file retention requirements under Bar Council rulings), limitation periods under the Limitation Act 1953, and other applicable law. [Insert specific retention periods, e.g.: client files retained for a minimum of 7 years from conclusion of a matter; unsuccessful job applications retained for 12 months; newsletter subscriber data retained until withdrawal of consent.] Upon expiry of the relevant retention period, personal data will be securely deleted or anonymised.
10. Your Rights Under the PDPA
Subject to the PDPA and any applicable exceptions, you have the following rights in respect of your personal data:
- Right to access your personal data held by us, upon written request;
- Right to request correction of personal data that is inaccurate, incomplete, misleading, or outdated;
- Right to withdraw consent to the processing of your personal data, by written notice to us, subject to any legal or contractual restrictions on such withdrawal;
- Right to limit or prevent the processing of your personal data for purposes of direct marketing or solicitation (for example, you may unsubscribe from our newsletter at any time);
- Right to be informed of the data we hold about you, the purposes for which it is processed, and the persons to whom it may be disclosed.
We may charge a prescribed fee for processing an access request, as permitted under the PDPA and its subsidiary regulations. We will respond to any request within the timeframe prescribed under the PDPA (currently 21 days for acknowledgement of an access request and a further 14 days to comply, subject to extension as permitted by law).
Please note that where personal data forms part of a client file subject to legal privilege or professional confidentiality obligations, our ability to disclose, amend, or delete such data may be restricted notwithstanding a request made under this Section.
11. Cookies
[To be confirmed based on actual Website implementation.] The Website may use cookies and similar tracking technologies to enhance user experience, analyse traffic, and remember preferences. You may disable cookies through your browser settings; however, doing so may affect the functionality of certain features of the Website. [If a cookie banner/consent management tool is implemented, insert details of categories of cookies used (strictly necessary, performance/analytics, functional) and how consent is obtained and managed.]
12. Children's Data
The Website is not intended for, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have inadvertently collected personal data from a minor without appropriate parental or guardian consent, we will take reasonable steps to delete such data.
13. Third-Party Links
The Website may contain links to third-party websites. This Privacy Notice does not apply to such third-party websites, and we encourage you to review the privacy policies of any third-party website you visit.
14. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, the Website, or applicable law. The updated version will be posted on the Website with a revised “Last updated” date. We encourage you to review this Privacy Notice periodically.
15. Contact Us / Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Notice or the processing of your personal data, including any access, correction, or withdrawal of consent request, please contact our Personal Data Protection Officer at:
Personal Data Protection Officer
2nd Floor, 64, Jalan Rosmerah 3/2,
81100 Johor Bahru, Johor.
Email: general_jb@cnlaw.com.my
Telephone: +607-3642479 / +6012-529 2964
