Most companies' first AI problem isn't the technology — it's that staff are already using AI tools, with no rules. Governance doesn't need to be heavy. It needs to answer a few clear questions. This guide is general information, not legal advice; check requirements with your legal and compliance advisers.
Why the PDPA matters
Malaysia's Personal Data Protection Act 2010 (PDPA) governs how personal data is collected, used and disclosed in commercial transactions. When staff paste customer, candidate or employee details into an AI tool, that is processing of personal data, so your existing PDPA obligations apply. Ask your legal team how the Act's principles — such as notice, purpose limitation, security and retention — apply to the AI tools you use.
Five steps to start
- Classify your data. Public, internal, confidential, personal data. Decide what is allowed in which tool.
- Approve the tools. Name the AI tools and plans the company allows, and the settings required (for example, business plans with admin controls).
- Write a short AI-use policy. Plain rules: what may be shared, what must be reviewed, what is off-limits, how to disclose AI use where it matters.
- Require human review. Anything customer-facing, legal, financial or affecting people gets checked by an accountable person.
- Train the people. Rules nobody understands don't work.
What a good AI-use policy covers
- Approved tools and who administers them.
- Data rules by classification.
- Review and sign-off requirements.
- Handling of mistakes and incidents.
- Intellectual property and confidentiality expectations.
- Who owns the policy and when it is reviewed.
The risks to manage
- Data leakage into tools not approved for that data.
- Inaccurate output used without checking.
- Bias in decisions affecting people.
- Over-reliance and loss of skills.
Governance is a skill, not just a document
Staff need to recognise sensitive data, check output properly and know when to escalate. That is why governance and responsible use is a domain of the CCAO-F exam and a module of our CCAO-F workshop, and why the AI Forward CXO Program gives leaders an AI usage policy starting point.