Found cheaper? We match it — see conditions. Incorporation and secretary transfer also carry a 30-day money-back guarantee.
Something is stopping your launch until this one document exists.
A generic one will pass the form. It won't protect you after.
20 min
is what this actually takes
What the law actually asks for
Four things, and only four
PDPA
The law
Collect personal data in business, and you need notice and consent.
Update
What changed
Stricter consent rules. Breach notification is now mandatory, in some cases.
Policy vs terms
Different jobs
Policy: what you do with data. Terms: what users can't do.
E-commerce
Needs more
Refund, return and shipping policies, payment disclaimer — usually the gateway's rule, not just the law's.
+ customised to where you operate — not a global claim
What it looks like
The PDF is the thing you are paying for.
What's actually true
The twenty minutes where someone asks what you actually collect is the thing that matters.
A generator produces a PDF too. It can't produce the twenty minutes — nobody there has ever seen your business.
And a document doesn't transfer the risk
The PDPA doesn't ask what your policy says. It asks what you actually do with data.
Personal Data Protection Act (Malaysia), as amended — notice, consent and breach-notification duties attach to how a business actually handles personal data, not to the wording of whatever policy it has published. True however the document was written, and whoever wrote it.
The one question that decides this
Anyone can generate a policy. Almost nobody can make it true.
What a regulator would actually find
Today, a free generator and OCTIS both produce a policy that passes the form; the difference only shows up if a regulator later asks what your business actually collects:
What actually goes in yours
If the website or online store this policy covers is already built in your OCTIS account, we can see what's actually installed on it and write the document around that, instead of guessing from a generic template:
What they do well
A generator gets you a document today, and it will pass the form.
What their shape can't reach
It has never seen your business, so it can describe what's typical — never what's actually yours.
RM 0
Ongoing fee. This is a one-off document set, not a subscription.
Included, not unlimited — a further pass is a new intake. This page makes no money-back claim: the published guarantee covers two other services, and what it actually covers is on the guarantee page.
What are you launching
The three prices are for three different launches — website, mobile app, or online store — not three budget tiers; pick by what you're actually launching:
Website
RM 3,000RM 599
- Privacy policy
- Website terms and conditions
- Legal disclaimer
Mobile App
RM 3,000RM 599
- Privacy policy
- Terms of use
- App disclaimer and in-app consent wording
E-Commerce
RM 6,000RM 2,999
- Everything in the Website set
- Refund, return and shipping policies
- Payment disclaimer
Three platforms, not three budgets. Pick by what you're launching.
Applies to you
Yes, if you collect personal data in business
The PDPA has no small-business exemption.
Length
Generally up to 10 pages per document
Revisions
One intake call, one round — two on the e-commerce set
Not covered
- Not one of the two services covered by the published money-back guarantee — that page lists what actually is.
- Global coverage is not claimed. Tell us where you operate; the jurisdictions we can cover are confirmed at intake.
- A revision round beyond what's included is a new intake, not a free redo.
Do I legally need a privacy policy?
Yes — if your business collects personal data in the course of commercial activity, the PDPA requires notice and consent, and a privacy policy is the standard way to give it. There's no small-business exemption.
Will a free generator work instead?
It will usually pass the form — that's real, and we won't pretend otherwise. What it won't do is describe your actual data flows, name your actual third parties, or reflect the current PDPA position. That only matters on the day something goes wrong, but it matters completely then.
We operate in more than one country. Is that covered?
Tell us where you operate and we customise accordingly. We don't claim global coverage on this page — which jurisdictions we can cover is confirmed at intake, not asserted upfront.
Does this come with a money-back guarantee?
No. This document set isn't one of the two services the published guarantee covers. What's real: one intake call and one revision round are included (two on e-commerce) before a further round becomes a new intake.
You're not stuck on a document. You're stuck on nobody reading the form yet.
Tell us what you're launching and what it collects — we'll read the form for you.