Malaysia PDPA 2010 STD-5: Standard 2015 para. 5: security standard for personal data processed non-electronically

For paper and other non-electronic processing the data controller must: register staff handling the data before access; remove access on exit or reorganisation; control and limit access; file records in order, keep files in locked places, keep keys safe with a key register, and store data in safe unexposed locations; keep periodic access records producible to the Commissioner; ensure staff confidentiality; record conventional transfers (post, hand delivery, fax); destroy used paper and printouts thoroughly, for example by shredding; and run awareness programmes where necessary.