DATA PROTECTION & CONFIDENTIALITY GOVERNANCE

Yayasan Mohd Khairi

1.0 DEFINITIONS & INTERPRETATIONS

1.1 Defined Terms

In this Data Protection & Confidentiality Governance Policy, unless the context otherwise requires, the following terms shall have the meanings assigned below:

1. “Act” or “PDPA” means the Personal Data Protection Act 2010 [Act 709], as amended from time to time.
2. “Board” or “Board of Trustees” means the collective body of Trustees of Yayasan Mohd Khairi.
3. “Confidential Information” means all non-public, proprietary, financial, legal, donor, beneficiary, operational, or strategic information belonging to YMK.
4. “Data Subject” means any individual whose personal data is collected, recorded, held, or processed by YMK (including donors, beneficiaries, staff, and partners).
5. “Foundation” or “Yayasan” means Yayasan Mohd Khairi (abbreviated as “YMK”).
6. “Official Email Address” means the single, mandatory electronic mail address for all official business, operational data, and external correspondence, explicitly being info@ymk.org.my.
7. “Official Matter” means any formal, legal, statutory, regulatory, financial, operational, governance, contractual, or official communication sent to or issued by YMK, excluding Whistleblowing Reports.
8. “Personal Data” means any information in respect of commercial or charitable transactions that relates directly or indirectly to a Data Subject.
9. “Whistleblowing Dedicated Email Address” means the independent intake channel designated exclusively for reporting data misuse, breaches of confidentiality, or corruption, being legal@alkhairi.com.my.

1.2 Rules of Construction

1. Words importing the singular include the plural and vice versa.
2. Headings and clause titles are inserted for convenience only and shall not affect interpretation.
3. References to statutory provisions include amendments or re-enactments.

2.0 STATUTORY BASIS, OBJECTIVES & SCOPE

2.1 Legal & Constitutional Framework

This Policy is promulgated pursuant to the Personal Data Protection Act 2010 [Act 709], statutory duties under the Companies Act 2016 [Act 777], and the internal constitutional framework of YMK. It sets out the governance structure required to protect individual privacy, maintain data integrity, and prevent unauthorized disclosure of Foundation records.

2.2 Scope of Application

This Policy applies strictly and comprehensively to:

1. All members of the Board of Trustees;
2. All Executive Officers, employees, interns, and volunteers;
3. Members of any standing or ad hoc sub-committees established by the Board; and
4. All external partners, donors, contractors, and third-party data processors engaging in any Official Matter or confidential disclosure with YMK.

3.0 PERSONAL DATA PROTECTION PRINCIPLES (PDPA 2010)

3.1 Personal Data Processing Principles

YMK strictly adheres to the core data protection principles set out under Malaysian law:

1. General Principle: Personal data shall only be processed with explicit consent for lawful, direct charitable or administrative purposes.
2. Notice & Choice Principle: Data Subjects must be informed via a written PDPA Notice regarding data collection purposes, retention, and third-party disclosures.
3. Disclosure Principle: Personal data shall not be disclosed to third parties without consent, except where mandated by statutory law or regulatory authority.
4. Security Principle: Technical and organizational security measures must be implemented to safeguard personal data from loss, unauthorized access, or modification.
5. Retention Principle: Personal data shall not be kept longer than necessary for the fulfillment of its designated purpose.
6. Data Integrity Principle: Reasonable steps must be taken to ensure personal data is accurate, complete, and up to date.
7. Access Principle: Data Subjects retain statutory rights to request access to and correction of their personal data.

3.2 Data Subject Rights & Consent Framework

1. Written or explicit digital consent must be obtained prior to collecting sensitive personal data from donors, beneficiaries, or employees.
2. Data Subjects may withdraw consent or request data correction by submitting a formal request via info@ymk.org.my.

4.0 CONFIDENTIALITY & NON-DISCLOSURE OBLIGATIONS

4.1 Duty of Confidentiality

Every Trustee, Executive Officer, staff member, and contractor owes a strict legal duty of confidentiality to YMK. Confidential Information acquired during service must be held in absolute trust and confidence.

4.2 Handling of Proprietary & Board Information

1. Non-public Board documents, financial records, donor lists, and strategic plans must not be copied, shared, or disclosed to external parties without explicit Board authorization.
2. Personnel shall not use Confidential Information for personal gain or for the benefit of any Connected Person or third party.

4.3 Exceptions to Confidentiality

The obligation of confidentiality shall not apply where:

1. The information is or becomes publicly available through no breach of this Policy;
2. Disclosure is required by valid statutory obligation, law enforcement, or court order; or
3. Disclosure is made pursuant to a valid whistleblowing report under Section 9.0.

5.0 DATA SECURITY, STORAGE, ACCESS CONTROL & TRANSMISSION

5.1 Technical & Organisational Safeguards

1. All digital systems containing YMK data must be protected by access credentials, role-based authorization and encryption protocols.
2. Physical documents containing personal and/or confidential data must be stored in locked filing cabinets with restricted access control.

5.2 Dual-Format Archival & Storage Redundancy

To ensure administrative compliance, structural redundancy, and business continuity, all critical Foundation records, confidential documentation and legal policies must be strictly maintained in four (4) mandatory copies:

1. Physical Copies (2 Sets): Exactly two (2) identical hard copies of official documents must be printed, signed and retained in separate secure physical locations/filing cabinets within YMK facilities under restricted physical access.
2. Soft Copies (2 Sets): Exactly two (2) electronic storage copies must be maintained, comprising:
   1. One (1) primary secure cloud based storage system utilizing high-grade encryption; and
   2. One (1) offline encrypted physical hard drive stored in a secure location for emergency disaster recovery.

5.3 Role-Based Access Eligibility

1. Access to digital databases, cloud drives, external hard drives and physical filing cabinets containing Personal Data and/or Confidential Information is restricted strictly on a need-to-know basis.
2. Only personnel at Management Level and above including Advisors, Executive Officers and the Board of Trustees are eligible to hold administrative privileges, digital decryption keys or physical keys to access, review, modify and/or export Confidential Information and Foundation records.
3. Junior staff, operational personnel, interns, and external contractors are explicitly prohibited from accessing core confidential archives unless temporary, role-specific clearance is formally granted in writing by Executive Management.

5.4 Mandatory Channels for Official Data Exchange

1. info@ymk.org.my is established as the sole, official and exclusive electronic mail address for transmitting operational data, donor documentation, vendor contracts and external legal correspondence.
2. Transmitting YMK operational and/or personal data through personal email accounts or unsecured messaging platforms is strictly prohibited.

5.5 Data Retention & Secure Disposal

1. Personal and operational data shall be retained for a minimum of seven (7) years to comply with statutory and tax requirements.
2. Upon expiration of the retention period, physical records must be shredded, and digital data securely purged.

6.0 DATA BREACH INCIDENT MANAGEMENT & MITIGATION PROTOCOL

6.1 Breach Identification & Internal Escalation

1. Any suspected or actual data leak, unauthorized access or system compromise must be reported immediately to the Legal & Compliance Officer via muhammadthaqif@alkhairi.com.my.
2. An immediate containment protocol and risk assessment shall be initiated.

6.2 Response, Statutory Reporting & Data Subject Notifications

Where a data breach poses significant operational, reputational or financial risk to Data Subjects, the Board shall oversee notifications to relevant statutory authorities and affected individuals within mandated legal timelines.

6.3 Information Leak Mitigation Plan & Enforcement Procedures

In the event of a confirmed or suspected information leak, breach of confidentiality, or unauthorized dissemination of YMK data, YMK shall enforce an immediate, structured mitigation protocol:

1. Legal & Compliance Officer shall immediately revoke access privileges, reset cloud and administrative credentials, isolate affected drives and lock physical storage rooms to prevent further unauthorized access or exfiltration.
2. Compliance Officer shall trace data logs, audit access entries and gather evidence regarding the breach source.
   1. Where internal personnel (management, employees or officers) are implicated in an unauthorized leak, YMK shall issue a formal Show Cause Notice, suspend access privileges and convene a formal Domestic Inquiry (DI) in compliance with standard employment laws and internal disciplinary procedures.
3. The Compliance Officer shall immediately draft and lodge formal breach notification reports with relevant regulatory bodies and law enforcement agencies where criminal exfiltration or cybercrime is suspected.
4. YMK shall issue direct, formal written notifications to affected Data Subjects, donors, partners and financial institutions detailing the nature of the exposure, mitigation actions undertaken and actionable steps to minimize personal risk.
5. YMK reserves the unreserved legal right to initiate civil lawsuits for breach of fiduciary duty, breach of contract and injunctive relief as well as seek monetary damages against any internal or external party responsible for unauthorized data leaks.

7.0 DATA SECURITY, ACCESS CONTROL & TRANSMISSION

7.1 Technical & Organisational Safeguards

1. All digital systems containing YMK data must be protected by access credentials, role-based authorization, and encryption protocols.
2. Physical documents containing personal or confidential data must be stored in locked filing cabinets with restricted access control.

7.2 Mandatory Channels for Official Data Exchange

1. info@ymk.org.my is established as the sole, official, and exclusive electronic mail address for transmitting operational data, donor documentation, vendor contracts, and external legal correspondence.
2. Transmitting YMK operational or personal data through personal email accounts or unsecured messaging platforms is strictly prohibited.

7.3 Data Retention & Secure Disposal

1. Personal and operational data shall be retained for a minimum of seven (7) years to comply with statutory and tax requirements.
2. Upon expiration of the retention period, physical records must be shredded, and digital data securely purged.

8.0 DATA BREACH INCIDENT MANAGEMENT

8.1 Breach Identification & Internal Escalation

1. Any suspected or actual data leak, unauthorized access, or system compromise must be reported immediately to the Legal & Compliance Officer via info@ymk.org.my.
2. An immediate containment protocol and risk assessment shall be initiated by the IT & Data Security Unit.

8.2 Regulatory & Data Subject Notification

Where a data breach poses significant operational, reputational, or financial risk to Data Subjects, the Board shall oversee notifications to relevant statutory authorities and affected individuals within mandated legal timelines.

9.0 CONFIDENTIAL REPORTING & WHISTLEBLOWING INTEGRITY

9.1 Separation of Data Intake Channels

1. To safeguard confidentiality, independence, and protection against internal tampering, disclosures concerning data misuse, unauthorized leaks, financial malfeasance, or breach of fiduciary duty shall bypass general administrative channels (info@ymk.org.my).
2. Whistleblowing disclosures must bypass management/general secretariat channels and go directly to the Audit and Risk Management Committee via a segregated, confidential channel.

9.2 Dedicated Confidential Intake Email

1. All whistleblower reports, disclosures, or confidential allegations regarding data breaches or confidentiality violations shall be transmitted exclusively to legal@alkhairi.com.my.
2. Access to legal@alkhairi.com.my shall be restricted solely to the Chairman of the Audit and Risk Management Committee and designated independent members, ensuring complete operational segregation from general staff and executive management.

10.0 GOVERNANCE OVERSIGHT, AMENDMENT & REVIEW

10.1 Periodic Policy Review

This Policy shall be formally reviewed by the Board, upon recommendation by the Nomination and Governance Committee, every two (2) years or immediately upon any material legislative amendment to the Personal Data Protection Act 2010 or tax laws.

10.2 Custody and Record Retention

The Company Secretary or designated Compliance Officer shall retain custody of this Policy, non-disclosure agreements, and all historical audit logs for a minimum period of seven (7) years in accordance with statutory retention requirements. Any material breach of this Policy shall constitute serious misconduct and may result in disciplinary action, termination of service, or legal proceedings.