NEW ERA UNIVERSITY COLLEGE
EMPLOYEE & JOB APPLICANT
PERSONAL DATA SECURITY POLICY

 

1. Policy Statement

This Employee & Job Applicant Personal Data Security Policy (“Policy”) is issued as an extension of Clause 7, Security of Personal Data, in the New Era University College (“NEUC”) Employee & Job Applicant Privacy Policy.

At New Era University College (“NEUC”, the University College, “we”, “our”, or “us”), a private higher education institution fully owned by New Era Edu Sdn. Bhd., we are committed to protecting the personal data of employees and job applicants in accordance with the Personal Data Protection Act 2010 (“PDPA”), its amendments, regulations, guidelines, codes of practice, and other applicable legal or regulatory requirements.

As the data controller, we shall implement appropriate technical, administrative, and physical security measures to safeguard employees’ and job applicants’ personal data against loss, misuse, unauthorised access, unauthorised disclosure, alteration, modification, destruction, accidental exposure, and cybersecurity threats.

This Policy supports and should be read together with the NEUC Employee & Job Applicant Privacy Policy. It explains the security measures, procedures, and responsibilities adopted by NEUC to protect personal data processed in electronic and non-electronic forms.

 

2. Purpose

The purpose of this Policy is to:

1. protect the confidentiality, integrity, and availability of employees’ and job applicants’ personal data;
2. support NEUC’s compliance with the PDPA and applicable personal data protection requirements;
3. provide practical security measures for the protection of employment-related and recruitment-related personal data;
4. define the responsibilities of employees, job applicants, staff, contractors, vendors, service providers, data processors, and authorised users in safeguarding personal data;
5. prevent unauthorised access, misuse, disclosure, loss, alteration, destruction, or accidental exposure of personal data;
6. support proper detection, reporting, investigation, containment, and mitigation of data breaches and security incidents;
7. protect employment, payroll, recruitment, performance, disciplinary, health, statutory, and other confidential HR-related records; and
8. promote responsible data governance, cybersecurity awareness, and confidentiality within NEUC.

 

3. Scope

This Policy applies to:

1. full-time and part-time employees of NEUC;
2. academic, administrative, management, and support staff;
3. contract employees, temporary employees, interns, trainees, secondees, and other personnel engaged by NEUC;
4. job applicants, recruitment candidates, interview candidates, and prospective employees;
5. former employees, where their personal data continues to be retained or processed by NEUC;
6. Human Resource personnel and other authorised staff handling employee or job applicant personal data;
7. heads of departments, supervisors, interview panel members, recruitment committees, and authorised personnel involved in employment or recruitment processes;
8. contractors, consultants, vendors, service providers, background screening providers, payroll providers, insurance providers, statutory service providers, cloud providers, system providers, and data processors handling employee or job applicant personal data on behalf of NEUC; and
9. all systems, applications, databases, devices, storage media, physical files, forms, registers, personnel files, payroll records, recruitment records, CCTV systems, access control systems, and communication records containing employee or job applicant personal data.

This Policy covers personal data processed electronically, physically, internally, externally, through authorised third-party service providers, or through approved cloud or digital platforms.

 

4. Types of Personal Data

Employee and job applicant personal data protected under this Policy may include, but is not limited to:

1. identification details, including name, NRIC number, passport number, date of birth, gender, and nationality;
2. contact information, including residential address, correspondence address, email address, and phone number;
3. employment-related information, including position, department, job title, employment status, employment history, contract details, salary, allowances, benefits, leave records, and other HR records;
4. academic and professional qualifications, including educational institutions attended, academic transcripts, certificates, grades obtained, professional memberships, licences, and training records;
5. recruitment and selection information, including application forms, curriculum vitae, resumes, interview records, assessment results, referee reports, recommendation letters, background screening results, and recruitment communications;
6. performance records, appraisal reports, promotion records, training records, disciplinary records, grievance records, investigation records, and related correspondence;
7. attendance records, working hour records, access logs, system usage records, and workplace access control records;
8. payroll, banking, tax, statutory contribution, EPF, SOCSO, income tax, insurance, reimbursement, claims, and financial administration records;
9. emergency contact details, including information of family members, dependents, next-of-kin, or other emergency contacts where relevant;
10. marital status, dependent information, and languages spoken, where relevant to employment administration;
11. images, audio recordings, video recordings, CCTV footage, event documentation, online meeting recordings, and video interview records;
12. driver’s licence details, vehicle-related information, or travel-related records where applicable;
13. health, medical, occupational safety, workplace accommodation, insurance, or benefit-related information where applicable;
14. biometric data or access control data where applicable; and
15. any other personal data voluntarily provided or required for recruitment, employment administration, post-employment administration, workplace safety, statutory compliance, or institutional operations.

Sensitive personal data, including health information, religious belief information, political opinion information, biometric data, financial information, or other sensitive personal data, shall only be processed where necessary, with explicit consent where required by the PDPA, and shall be subject to enhanced protection and restricted access controls.

 

5. General Security Principles

NEUC shall implement reasonable, practical, and appropriate security measures by considering:

1. the nature, category, and sensitivity of the personal data;
2. the purpose for which the personal data is processed;
3. the risk of harm arising from unauthorised access, disclosure, misuse, loss, alteration, or destruction;
4. the location, method, and medium of storage;
5. the security technologies, safeguards, and procedures available;
6. the reliability, integrity, and authorisation level of personnel handling the data;
7. the security of data transmission, sharing, and transfer methods;
8. the need for confidentiality, accountability, and auditability;
9. the involvement of payroll providers, insurance providers, statutory bodies, background screening providers, recruitment platforms, cloud providers, or other third-party service providers; and
10. emerging cybersecurity threats, operational risks, and legal or regulatory changes.

NEUC shall periodically review and improve its security measures to ensure continued protection of employees’ and job applicants’ personal data.

 

6. Security Measures for Electronically Processed Data

NEUC shall implement appropriate technical and organisational measures to protect electronically processed employee and job applicant personal data.
  

6.1 Access Control

NEUC shall:

1. restrict access to employee and job applicant personal data to authorised personnel only;
2. apply role-based access and the principle of least privilege;
3. maintain records of personnel or user groups authorised to access personal data where appropriate;
4. review access rights periodically;
5. amend, suspend, or revoke access when a user changes role, transfers department, resigns, is terminated, completes engagement, or no longer requires access;
6. restrict administrator or privileged access to authorised personnel only; and
7. prevent unauthorised access to HR systems, payroll systems, recruitment platforms, personnel records, performance records, disciplinary records, statutory records, and related databases.
    

6.2 User Authentication

NEUC shall:

1. assign unique user IDs and passwords to authorised users where applicable;
2. require users to keep login credentials confidential;
3. prohibit password sharing and credential misuse;
4. require strong passwords or secure authentication methods where appropriate;
5. implement multi-factor authentication for selected systems or higher-risk access where appropriate; and
6. monitor suspicious or abnormal login activities where reasonably practicable.
    

6.3 Workstation and Device Security

Employees and authorised personnel handling employee or job applicant personal data shall:

1. lock or log off workstations when unattended;
2. not leave devices displaying personal data unattended in public or shared areas;
3. use password-protected screen locking mechanisms;
4. take reasonable steps to prevent unauthorised persons from viewing confidential information;
5. ensure confidential documents or printed records are not left unattended;
6. secure laptops, portable devices, and storage media containing personal data;
7. avoid storing personal data in unauthorised personal devices, personal email accounts, messaging applications, or unapproved cloud storage; and
8. promptly report lost, stolen, compromised, or suspected compromised devices containing employee or job applicant personal data.
    

6.4 System and Network Security

NEUC shall implement reasonable system and network security controls, including where appropriate:

1. antivirus, anti-malware, and endpoint protection;
2. firewalls and network security controls;
3. regular software updates and security patches;
4. monitoring of systems and networks for unauthorised or suspicious activities;
5. protection against malware, ransomware, phishing, and other cyber threats;
6. restriction of unauthorised software installation; and
7. secure configuration of HR systems, payroll systems, recruitment platforms, employee portals, databases, and network services.
    

6.5 Data Storage and Backup

NEUC shall:

1. store employee and job applicant personal data in secure and controlled environments;
2. restrict access to storage locations, databases, folders, and backup systems;
3. maintain secure backup and disaster recovery arrangements where appropriate;
4. conduct backup verification or recovery testing periodically where practicable;
5. apply encryption, masking, or other protection measures for sensitive data where appropriate;
6. avoid unnecessary duplication of personal data; and
7. ensure backup data is protected against unauthorised access, loss, or corruption.
     

6.6 Data Transfer Security

NEUC shall:

1. use secure and authorised methods when transferring employee or job applicant personal data electronically;
2. restrict the use of removable media, personal email, unauthorised cloud services, or unapproved file-sharing platforms;
3. apply encryption, password protection, access restriction, secure links, or other safeguards where appropriate;
4. verify recipients before disclosing or transferring personal data;
5. maintain records of significant or higher-risk data transfers where necessary; and
6. ensure that cloud service providers, payroll providers, recruitment platforms, insurance providers, statutory service providers, background screening providers, or data processors provide appropriate protection for personal data.
    

6.7 Logging and Monitoring

NEUC shall, where appropriate:

1. maintain logs of access to critical systems and personal data;
2. monitor unauthorised access attempts, abnormal activities, and security alerts;
3. retain logs for audit, investigation, security, and compliance purposes; and
4. review logs or reports where necessary to support incident detection and investigation.
    

6.8 Vendor and Data Processor Security

Where third-party vendors, service providers, contractors, consultants, payroll providers, insurance providers, background screening providers, recruitment platform providers, statutory service providers, cloud providers, or data processors process employee or job applicant personal data on behalf of NEUC, NEUC shall take reasonable steps to ensure that such parties provide a comparable level of protection for personal data.

NEUC shall, where appropriate:

1. conduct reasonable assessment or due diligence before engaging vendors or data processors;
2. require appropriate contractual terms, confidentiality obligations, or data processing agreements;
3. require vendors and data processors to process personal data only according to NEUC’s instructions and for authorised purposes;
4. require adequate technical, administrative, and physical security measures;
5. restrict unauthorised onward disclosure or transfer of personal data;
6. require prompt reporting of actual or suspected data breaches or security incidents;
7. require secure return, deletion, or destruction of personal data upon completion or termination of services, where applicable; and
8. monitor or review vendor compliance where necessary.
    

6.9 Email, Online Platform, and Communication Security

When using email, HR systems, recruitment platforms, employee portals, online forms, cloud systems, video interview platforms, online meeting platforms, or other digital communication channels, NEUC staff and authorised users shall:

1. verify recipients before sending employee or job applicant personal data;
2. avoid sending unnecessary personal data;
3. use password protection, encryption, secure links, or access restrictions for sensitive attachments where appropriate;
4. avoid disclosing personal data through unauthorised messaging applications or public platforms;
5. use official or approved communication channels where possible;
6. ensure that video interviews, online meetings, and recordings containing personal data are stored and shared securely; and
7. report misdirected emails, accidental disclosures, or suspected unauthorised sharing promptly.
    

6.10 Use of Artificial Intelligence Tools and Online Large Language Models

Where artificial intelligence tools, generative AI tools, online large language models, automated processing tools, AI-assisted transcription tools, translation tools, image generation tools, recruitment screening tools, analytics tools, or similar digital technologies (“AI Tools”) are used in connection with NEUC’s recruitment, employment administration, HR management, performance management, training, communication, workplace operations, investigation, or institutional activities, NEUC shall ensure that such use is subject to appropriate personal data protection and security controls.

Staff, authorised users, contractors, vendors, service providers, and data processors shall not upload, enter, paste, share, or submit employees’ or job applicants’ personal data, sensitive personal data, confidential HR records, identification documents, employment contracts, salary records, payroll records, bank account details, EPF records, SOCSO records, income tax records, medical records, recruitment records, interview notes, referee reports, background screening records, performance appraisal records, disciplinary records, investigation records, attendance records, access logs, CCTV footage, images, audio recordings, video recordings, online meeting recordings, correspondence, or other non-public information into public or unauthorised AI Tools, unless prior approval has been obtained and appropriate safeguards are in place.

Where AI Tools are used, NEUC shall take reasonable steps to ensure that:

1. the AI Tool has been reviewed or approved by NEUC before being used for work-related purposes involving employee or job applicant personal data;
2. the use of AI Tools is limited to lawful, authorised, necessary, and relevant recruitment, employment, administrative, operational, or institutional purposes;
3. employee and job applicant personal data is anonymised, pseudonymised, masked, redacted, or minimised before being entered into an AI Tool, where practicable;
4. sensitive personal data, including health information, biometric data, religious belief information, political opinion information, financial information, payroll information, statutory contribution information, or other sensitive records, is not processed using AI Tools unless necessary, authorised, and protected by appropriate safeguards;
5. confidential or restricted HR, payroll, recruitment, disciplinary, investigation, performance, medical, or employment records are not uploaded to public AI platforms, personal AI accounts, unauthorised browser extensions, or unapproved third-party tools;
6. AI Tools are not used to screen, rank, reject, shortlist, evaluate, discipline, profile, monitor, or make decisions about employees or job applicants in a way that may significantly affect their recruitment outcome, employment, promotion, appraisal, benefits, disciplinary outcome, workplace access, rights, or interests, unless such use is authorised, lawful, transparent, and subject to appropriate human review;
7. AI-generated outputs are reviewed by authorised personnel before being used for recruitment decisions, employment decisions, HR communications, performance management, disciplinary management, investigation, publication, reporting, or record purposes;
8. contracts, terms of service, data processing terms, retention practices, security measures, confidentiality commitments, and cross-border transfer implications of AI Tool providers are reviewed where necessary;
9. access to approved AI Tools is controlled, limited to authorised users, and monitored where appropriate;
10. prompts, uploaded files, transcripts, summaries, generated outputs, and AI-assisted records containing employee or job applicant personal data are stored, retained, deleted, or archived securely in accordance with NEUC’s retention and disposal requirements;
11. AI Tools are not used to bypass NEUC’s approved systems, access controls, recruitment procedures, HR procedures, payroll procedures, confidentiality obligations, or personal data protection requirements; and
12. any suspected unauthorised disclosure, accidental upload, misuse, loss, or exposure of employee or job applicant personal data through AI Tools is reported immediately as a data breach or security incident.

Employees and job applicants are encouraged not to submit unnecessary personal data, sensitive personal data, confidential documents, identification documents, employment records, recruitment records, salary information, medical information, third-party personal data, login credentials, or NEUC’s non-public information into public AI Tools when communicating with NEUC, applying for employment, performing work duties, or engaging with NEUC-related systems and services.

The use of AI Tools shall not reduce NEUC’s responsibility to protect employee and job applicant personal data under the PDPA, the NEUC Employee & Job Applicant Privacy Policy, this Policy, and any applicable internal procedures.

 

7. Security Measures for Physical and Non-Electronic Data

NEUC shall implement appropriate safeguards for physical records containing employee or job applicant personal data.
 

7.1 Physical Access Control

NEUC shall:

1. restrict access to physical records containing personal data to authorised personnel only;
2. store records in locked cabinets, secure rooms, restricted areas, or other controlled locations where appropriate;
3. maintain access records where appropriate;
4. protect storage areas from theft, unauthorised access, fire, flood, water damage, and other physical risks where reasonably practicable; and
5. ensure that visitors or unauthorised persons do not access restricted HR, payroll, recruitment, or personnel record storage areas.
    

7.2 Clean Desk and Secure Handling

Employees and authorised users shall:

1. handle physical records containing employee or job applicant personal data securely;
2. prevent unauthorised viewing, copying, photographing, removal, or disclosure of records;
3. avoid leaving confidential documents unattended in public, shared, or unsecured areas;
4. clear confidential documents from desks, counters, interview rooms, meeting rooms, printers, photocopiers, and shared workspaces after use;
5. keep printed records to the minimum necessary; and
6. return personnel files, recruitment files, payroll records, interview notes, disciplinary records, investigation records, and other confidential documents to secure storage after use.
    

7.3 Printing, Copying, and Scanning

When printing, copying, or scanning employee or job applicant personal data, employees and authorised users shall:

1. collect printed documents promptly;
2. check printers, photocopiers, and scanners to ensure no confidential documents are left behind;
3. avoid unnecessary printing or duplication;
4. ensure scanned copies are stored in approved locations; and
5. securely dispose of unwanted or duplicate copies.
    

7.4 Physical Transfer of Records

Where employee or job applicant personal data is transferred physically by hand, mail, courier, delivery service, internal dispatch, or other authorised methods, NEUC shall take reasonable steps to:

1. package and label documents securely;
2. verify the intended recipient and delivery address;
3. use reliable delivery methods where appropriate;
4. maintain records of significant or sensitive physical transfers where necessary; and
5. promptly investigate missing, delayed, damaged, or wrongly delivered records.
    

7.5 Secure Disposal of Physical Records

NEUC shall securely dispose of physical records containing employee or job applicant personal data when they are no longer required, subject to applicable retention requirements.

Secure disposal methods may include shredding, pulping, secure destruction, or other approved disposal methods that prevent reconstruction, recovery, or unauthorised use of the records.

 

8. Responsibilities of Employees

All employees handling personal data shall:

1. access personal data only for authorised and legitimate purposes;
2. maintain the confidentiality of personal data;
3. comply with this Policy, the NEUC Employee & Job Applicant Privacy Policy, applicable procedures, and PDPA requirements;
4. process only the minimum personal data necessary for the relevant purpose;
5. ensure personal data is accurate and updated where they are responsible for maintaining such records;
6. handle electronic and physical records securely;
7. protect passwords, login credentials, access cards, and system access rights;
8. lock or log off workstations when unattended;
9. store portable devices and storage media securely when not in use;
10. avoid storing personal data in unauthorised devices, locations, applications, or accounts;
11. attend relevant PDPA, privacy, information security, or cybersecurity training where required;
12. report actual or suspected data breaches, security incidents, unauthorised access, loss, theft, or accidental disclosure immediately; and
13. cooperate with investigations, audits, corrective actions, and security improvement measures.

Employees shall not:

1. access personal data without authorisation;
2. share confidential information with unauthorised persons;
3. misuse NEUC systems, databases, applications, or records;
4. disable, bypass, or interfere with security controls or monitoring systems;
5. disclose personal data through unauthorised channels;
6. leave computers, systems, portable devices, or documents containing personal data unattended without appropriate security protection; or
7. use personal data for personal, unrelated, or unauthorised purposes.

 

9. Responsibilities of Job Applicants

Job applicants shall:

1. provide accurate, complete, and updated personal information to NEUC;
2. protect recruitment portal login credentials, verification codes, and account details where applicable;
3. submit personal data through official or authorised recruitment channels where possible;
4. avoid submitting unnecessary sensitive personal data unless requested or required for the recruitment process;
5. report suspicious activities, unauthorised access, phishing attempts, or suspected misuse involving their personal data; and
6. avoid submitting false, misleading, or unauthorised third-party personal data.

Job applicants’ personal data shall only be used for recruitment, selection, employment evaluation, onboarding, compliance, and related lawful purposes, unless otherwise permitted by law or consented to by the job applicant.

 

10. Data Breach and Security Incident Management

NEUC shall establish and maintain procedures to manage actual or suspected personal data breaches and security incidents involving employee or job applicant personal data.

A personal data breach or security incident may include:

1. unauthorised access to employee or job applicant personal data;
2. unauthorised disclosure or sharing of personal data;
3. loss or theft of personnel files, recruitment files, payroll records, devices, storage media, or documents containing personal data;
4. accidental sending of personal data to the wrong recipient;
5. malware, ransomware, phishing, system compromise, or cyberattack involving personal data;
6. unauthorised alteration, deletion, or destruction of personal data;
7. unauthorised access to HR, payroll, recruitment, performance, disciplinary, medical, or statutory records; or
8. any other incident that may affect the confidentiality, integrity, or availability of personal data.

Upon becoming aware of an actual or suspected personal data breach or security incident, NEUC shall take reasonable steps to:

1. record the incident;
2. contain and mitigate the incident promptly;
3. investigate the cause and scope of the incident;
4. assess the risk and potential impact on affected employees, job applicants, and other relevant persons;
5. implement corrective and preventive measures;
6. assess whether notification to the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi (“JPDP”), is required;
7. notify affected data subjects and relevant reporters where applicable; and
8. maintain appropriate records of the incident, investigation, decision, notification, and remedial actions.

Employees, job applicants, staff, vendors, service providers, and authorised users shall report actual or suspected breaches or security incidents involving personal data immediately to the DPO, Human Resource Department, or relevant department.

 

11. Data Retention, Archiving and Disposal

NEUC shall retain employee and job applicant personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required for legal, regulatory, audit, administrative, financial, tax, employment, contractual, dispute-resolution, statutory, post-employment, or institutional purposes.

Where personal data is no longer required and is not subject to any legal, regulatory, audit, dispute, financial, tax, employment, statutory, or operational retention requirement, NEUC shall take reasonable steps to securely delete, dispose of, anonymise, or archive such personal data.

Recruitment records of unsuccessful job applicants shall be retained only for the period necessary for recruitment, future employment consideration where consented or permitted, legal compliance, audit, dispute management, or legitimate institutional purposes.

Secure disposal shall apply to both electronic and physical records, including databases, backup media, personnel files, recruitment files, payroll records, statutory records, medical records, disciplinary records, investigation records, scanned documents, and storage devices where applicable.

 

12. Cross-Border Transfer of Personal Data

Where employee or job applicant personal data is transferred, stored, accessed, or processed outside Malaysia by NEUC’s authorised vendors, experts, service providers, cloud providers, payroll providers, recruitment platform providers, background screening providers, or data processors, NEUC shall take reasonable steps to ensure that such personal data is protected in accordance with the PDPA and that a comparable level of protection is provided.

Such measures may include contractual safeguards, security requirements, access restrictions, confidentiality obligations, encryption, due diligence, or other appropriate controls.

 

13. Recruitment Updates and Communications

Where NEUC sends recruitment updates, employment opportunities, or relevant announcements to job applicants or prospective candidates who have opted in to receive such communications, NEUC shall ensure that:

1. such communications are sent through authorised channels;
2. contact details are used only for authorised or consented purposes;
3. recipients are provided with a practical method to withdraw consent or opt out where applicable;
4. recruitment mailing lists or candidate databases are protected against unauthorised access or disclosure; and
5. withdrawal or opt-out requests are acted upon within a reasonable period, subject to applicable legal, operational, or contractual limitations.

 

14. Compliance and Non-Compliance

Compliance with this Policy is mandatory for all persons to whom this Policy applies.

Failure to comply with this Policy may result in appropriate action, including:

1. reminder, warning, or retraining;
2. restriction, suspension, or termination of system access;
3. disciplinary action in accordance with applicable NEUC rules or procedures;
4. contractual remedies against vendors, contractors, or service providers; and
5. legal, regulatory, or enforcement action where applicable.

 

15. Policy Review

NEUC shall review this Policy periodically or whenever necessary due to:

1. changes in the PDPA or other applicable legal or regulatory requirements;
2. changes to the NEUC Employee & Job Applicant Privacy Policy;
3. changes in NEUC’s operations, systems, technologies, HR systems, payroll systems, recruitment platforms, or data processing activities;
4. emerging cybersecurity threats or operational risks;
5. audit findings, security assessments, or compliance reviews; or
6. significant data breaches or security incidents.

NEUC reserves the right to amend this Policy from time to time. The latest version should be read together with the latest NEUC Employee & Job Applicant Privacy Policy.

 

16. Contact Information

For matters relating to this Policy or the protection of employee and job applicant personal data, please contact:

Data Protection Officer (DPO)
New Era University College

Address:
Blocks B & C, Lot 5, Seksyen 10, Jalan Bukit,
43000 Kajang, Selangor, Malaysia

Tel: 603-8740 6392/8210 3709

Email:
For PDPA-related enquiries: dpo@newera.edu.my 
For employment-related enquiries: hr@newera.edu.my

 

 

(Revised and Approved by Administration Meeting on 20th May 2026)