Malaysia PDPA 2010 STD-4: Standard 2015 para. 4: security standard for personal data processed electronically (fourteen items)

For electronic processing the data controller must: register all staff involved in processing; remove access on resignation, dismissal, end of contract or reorganisation; control and limit staff access for collection, processing and storage; issue user IDs and passwords to authorised staff and cancel them immediately when staff stop handling the data; set physical security procedures (controlled entry to storage sites, safe unexposed locations, CCTV and 24-hour guarding where necessary); keep backup and recovery systems and anti-virus up to date; protect systems against malware; permit transfers by removable media or cloud services only with written approval of an officer authorised by top management, and record every such transfer; make cloud transfers comply with Malaysian principles and other countries' data protection laws; keep periodic access records producible to the Commissioner; ensure staff keep data confidential; and bind any appointed third party processing the data by contract.