NEW ERA UNIVERSITY COLLEGE
VENDOR AND DATA PROCESSOR
PERSONAL DATA SECURITY POLICY

 

1. Policy Statement

This Vendor and Data Processor Personal Data Security Policy (“Policy”) is issued as an extension of Clause 7, Security of Personal Data, in the New Era University College (“NEUC”) Vendor Privacy Policy.

At New Era University College (“NEUC”, the University College, “we”, “our”, or “us”), a private higher education institution fully owned by New Era Edu Sdn. Bhd., we are committed to ensuring that all vendors, contractors, consultants, cloud providers, service providers, outsourced service providers, and other third parties processing personal data on behalf of NEUC implement appropriate personal data protection and security measures.

This Policy applies to vendors and individuals acting on behalf of or associated with vendors (“vendor representatives”), including external parties who process, access, store, transmit, host, support, maintain, or otherwise handle personal data for or on behalf of NEUC.

As the data controller, NEUC is responsible for personal data under its control, including personal data processed by vendors or data processors on its behalf. Vendors and data processors are required to implement appropriate technical, administrative, organisational, and physical security measures to safeguard personal data against loss, misuse, unauthorised access, unauthorised disclosure, alteration, modification, destruction, accidental exposure, and cybersecurity threats.

This Policy supports and should be read together with the NEUC Vendor Privacy Policy, applicable contracts, procurement documents, data processing agreements, service agreements, confidentiality undertakings, and other applicable NEUC policies or procedures.

 

2. Purpose

The purpose of this Policy is to:

1. establish minimum security requirements for vendors and data processors handling personal data on behalf of NEUC;
2. protect the confidentiality, integrity, and availability of personal data processed by vendors and data processors;
3. support NEUC’s compliance with the Personal Data Protection Act 2010 (“PDPA”), its amendments, regulations, guidelines, codes of practice, and other applicable legal or regulatory requirements;
4. ensure vendors and data processors process personal data only for authorised, lawful, contractual, operational, and documented purposes;
5. define the responsibilities of vendors, vendor representatives, contractors, consultants, service providers, data processors, subprocessors, and authorised personnel;
6. reduce legal, operational, reputational, contractual, cybersecurity, and data breach risks;
7. support secure vendor onboarding, procurement, contract administration, service delivery, payment processing, access control, and vendor management; and
8. ensure proper detection, reporting, investigation, containment, mitigation, retention, return, deletion, or disposal of personal data.

 

3. Scope

This Policy applies to all external parties that process, access, receive, store, transmit, host, maintain, support, or otherwise handle personal data for or on behalf of NEUC, including but not limited to:

1. vendors and suppliers;
2. vendor representatives and authorised contact persons;
3. contractors and consultants;
4. IT vendors, system vendors, software providers, and cloud service providers;
5. outsourced service providers;
6. maintenance, support, and facilities service providers;
7. payment, finance, audit, legal, insurance, payroll, background screening, verification, courier, delivery, event, recruitment, and professional service providers;
8. research partners or project partners handling personal data on behalf of NEUC;
9. data processors and approved subprocessors; and
10. any third-party handling NEUC personal data or personal data collected, processed, or maintained for NEUC.

This Policy covers:

1. personal data processed electronically;
2. physical and non-electronic records;
3. personal data stored internally, externally, in cloud systems, in vendor systems, or on portable media;
4. personal data accessed remotely or on-site;
5. personal data transferred within or outside Malaysia; and
6. personal data retained, archived, returned, deleted, or disposed of by vendors or data processors.

 

4. Types of Personal Data Covered

Personal data protected under this Policy may include, but is not limited to:

1. personal data of students, employees, job applicants, customers, visitors, donors, alumni, vendors, vendor representatives, and other data subjects whose personal data is processed by or on behalf of NEUC;
2. identification details, including name, NRIC number, passport number, staff ID, student ID, vendor representative details, designation, signature, and authorisation records;
3. contact information, including address, email address, phone number, and business contact details;
4. business, company, procurement, and operational data, including company information, registration number, date of incorporation, contractual records, purchase orders, invoices, payment records, bank account details, tax-related information, and transaction records;
5. service performance records, due diligence records, vendor evaluation records, communication records, service reports, and operational coordination records;
6. system or operational access logs, user account records, support records, remote access records, security logs, and audit records;
7. site access records, access control records, vehicle records, CCTV footage, visitor logs, and safety-related records where applicable;
8. documents, databases, files, images, recordings, emails, forms, reports, or other records containing personal data; and
9. sensitive personal data where applicable, including biometric data, financial information, health or safety-related information, and other sensitive personal data required strictly for site access, safety, biometric access systems, statutory declarations, financial due diligence, legal compliance, or other authorised purposes.

Sensitive personal data shall only be processed where necessary, with explicit consent where required by the PDPA, and shall be subject to enhanced protection and restricted access controls.

 

5. General Security Principles

Vendors and data processors shall implement reasonable, practical, and appropriate security measures by considering:

1. the nature, category, and sensitivity of the personal data;
2. the purpose and scope of processing authorised by NEUC;
3. the risk of harm arising from unauthorised access, disclosure, misuse, loss, alteration, destruction, or accidental exposure;
4. the location, method, and medium of storage;
5. the security technologies, safeguards, and procedures available;
6. the reliability, integrity, and authorisation level of personnel handling personal data;
7. the security of data transmission, sharing, and transfer methods;
8. the involvement of subcontractors, subprocessors, cloud providers, or other third parties;
9. applicable contractual, legal, regulatory, audit, and institutional requirements; and
10. emerging cybersecurity threats, operational risks, and legal or regulatory changes.

Vendors and data processors shall process personal data only in accordance with NEUC’s documented instructions, approved purposes, contracts, data processing agreements, and applicable laws.

 

6. Vendor Due Diligence and Onboarding

Before engaging or onboarding a vendor or data processor that may process personal data on behalf of NEUC, NEUC may request and review relevant information to assess the vendor’s suitability, including where appropriate:

1. the vendor’s data protection, privacy, cybersecurity, or information security policies;
2. technical, administrative, organisational, and physical security controls;
3. data processing locations and cross-border transfer arrangements;
4. use of subcontractors or subprocessors;
5. incident response and breach notification procedures;
6. retention, return, deletion, and secure disposal practices;
7. certifications, audit reports, compliance documents, or security questionnaires;
8. business continuity, backup, and disaster recovery arrangements; and
9. any other information reasonably required for procurement, due diligence, compliance, audit, or risk management purposes.

NEUC may decline, suspend, or terminate engagement with vendors that do not meet NEUC’s personal data protection or security requirements.

 

7. Data Processing Agreement and Contractual Controls

All vendors and data processors that process personal data on behalf of NEUC shall be subject to appropriate contractual terms, confidentiality obligations, and, where necessary, a Data Processing Agreement (“DPA”) or equivalent written arrangement before accessing or processing NEUC personal data.

Such agreement or arrangement may include:

1. the purpose, scope, nature, and duration of processing;
2. the categories of personal data and data subjects involved;
3. confidentiality obligations;
4. technical, administrative, organisational, and physical security requirements;
5. access control and personnel security requirements;
6. data breach and security incident notification obligations;
7. audit, inspection, and compliance review rights;
8. data retention, return, deletion, and destruction requirements;
9. cross-border transfer restrictions and safeguards;
10. subprocessor appointment restrictions and approval requirements;
11. cooperation obligations in relation to data subject requests, investigations, audits, and regulatory enquiries;
12. restrictions on unauthorised disclosure, reuse, sale, sharing, or secondary use of personal data; and
13. NEUC’s right to suspend access, require remediation, terminate services, or seek remedies for non-compliance.

No vendor or data processor shall process NEUC personal data except as authorised by NEUC and subject to appropriate contractual or written obligations.

 

8. Security Measures for Electronically Processed Data
 

8.1 Access Control

Vendors and data processors shall:

1. restrict access to personal data to authorised personnel only;
2. apply role-based access and the principle of least privilege;
3. maintain records of personnel or user groups authorised to access personal data;
4. review access rights periodically;
5. immediately amend, suspend, or revoke access when personnel resign, transfer, change role, complete engagement, or no longer require access;
6. restrict administrator, privileged, remote, and support access to authorised personnel only;
7. prevent shared, generic, or uncontrolled accounts unless technically necessary and approved with compensating controls; and
8. ensure access to NEUC systems, vendor systems, cloud systems, databases, and support tools is properly controlled.
    

8.2 User Authentication

Vendors and data processors shall:

1. assign unique user IDs and secure passwords to authorised users where applicable;
2. require users to keep login credentials confidential;
3. prohibit password sharing and credential misuse;
4. enforce strong password or secure authentication requirements;
5. implement multi-factor authentication for privileged access, remote access, cloud systems, and higher-risk systems where appropriate; and
6. monitor suspicious or abnormal login activities where reasonably practicable.
    

8.3 System and Network Security

Vendors and data processors shall implement appropriate system and network security controls, including where applicable:

1. antivirus, anti-malware, endpoint detection, or endpoint protection measures;
2. firewalls and network security controls;
3. regular software updates and security patches;
4. vulnerability management and remediation practices;
5. secure configuration of systems, applications, databases, cloud services, and network services;
6. protection against malware, ransomware, phishing, unauthorised access, and other cyber threats;
7. monitoring of systems and networks for suspicious or unauthorised activities;
8. segregation of environments where appropriate, including production, testing, and development environments; and
9. restriction of unauthorised software, unauthorised tools, and insecure services.
    

8.4 Data Protection, Storage, and Backup

Vendors and data processors shall ensure that personal data is:

1. protected against unauthorised access, use, disclosure, alteration, loss, or destruction;
2. stored only in approved systems, locations, environments, or platforms;
3. encrypted during transmission where appropriate;
4. encrypted, masked, pseudonymised, or otherwise protected during storage where appropriate, especially for sensitive personal data;
5. backed up securely where necessary for service continuity;
6. protected against unauthorised access to backup data;
7. subject to backup verification or recovery testing where appropriate; and
8. not duplicated, downloaded, exported, or retained unnecessarily.
    

8.5 Data Transfer Security

Vendors and data processors shall:

1. use secure and authorised methods when transferring personal data;
2. restrict the use of removable media, personal email, unauthorised cloud services, public file-sharing services, or unapproved communication channels;
3. apply encryption, password protection, secure links, access restrictions, or other safeguards where appropriate;
4. verify recipients before disclosing or transferring personal data;
5. maintain records of significant or higher-risk data transfers where necessary;
6. transfer personal data only to locations, recipients, systems, or subprocessors authorised by NEUC; and
7. promptly notify NEUC of any misdirected, unauthorised, failed, suspicious, or compromised transfer involving personal data.
    

8.6 Logging and Monitoring

Vendors and data processors shall, where appropriate:

1. maintain logs of access to personal data, critical systems, and administrative activities;
2. monitor unauthorised access attempts, abnormal activities, and security alerts;
3. retain logs for audit, investigation, compliance, and security purposes;
4. protect logs against unauthorised alteration or deletion; and
5. provide relevant logs or reports to NEUC upon request for investigation, audit, or compliance review.
    

8.7 Workstation, Device, and Remote Access Security

Vendor personnel handling NEUC personal data shall:

1. use secured workstations, laptops, mobile devices, and portable storage media;
2. lock or log off devices when unattended;
3. use password-protected screen locking mechanisms;
4. prevent unauthorised persons from viewing confidential information;
5. avoid storing NEUC personal data on unauthorised personal devices, personal email accounts, messaging applications, or unapproved cloud storage;
6. secure laptops and portable devices containing personal data;
7. protect remote access with appropriate security controls; and
8. promptly report lost, stolen, compromised, or suspected compromised devices containing NEUC personal data.

 

9. Physical and Non-Electronic Data Security

Where vendors and data processors handle physical records containing personal data, they shall implement appropriate safeguards.
 

9.1 Physical Access Control

Vendors and data processors shall:

1. restrict access to physical records containing personal data to authorised personnel only;
2. store records in locked cabinets, secure rooms, restricted areas, or other controlled locations where appropriate;
3. maintain access records where appropriate;
4. protect storage areas from theft, unauthorised access, fire, flood, water damage, and other physical risks where reasonably practicable; and
5. ensure unauthorised persons do not access restricted storage or work areas.
    

9.2 Clean Desk and Secure Handling

Vendor personnel shall:

1. handle physical records containing personal data securely;
2. prevent unauthorised viewing, copying, photographing, removal, or disclosure of records;
3. avoid leaving confidential documents unattended in public, shared, or unsecured areas;
4. clear confidential documents from desks, counters, meeting rooms, printers, photocopiers, scanners, and shared workspaces after use;
5. keep printed records to the minimum necessary; and
6. return records to secure storage after use.
     

9.3 Printing, Copying, and Scanning

When printing, copying, or scanning personal data, vendors and data processors shall:

1. collect printed documents promptly;
2. check printers, photocopiers, and scanners to ensure no confidential documents are left behind;
3. avoid unnecessary printing or duplication;
4. ensure scanned copies are stored in approved locations; and
5. securely dispose of unwanted or duplicate copies.
     

9.4 Physical Transfer of Records

Where personal data is transferred physically by hand, mail, courier, delivery service, internal dispatch, or other authorised methods, vendors and data processors shall take reasonable steps to:

1. package and label documents securely;
2. verify the intended recipient and delivery address;
3. use reliable delivery methods where appropriate;
4. maintain records of significant or sensitive physical transfers where necessary; and
5. promptly investigate and report missing, delayed, damaged, wrongly delivered, or compromised records.
    

9.5 Secure Disposal of Physical Records

Vendors and data processors shall securely dispose of physical records containing personal data when they are no longer required and where disposal is authorised by NEUC.

Secure disposal methods may include shredding, pulping, secure destruction, or other approved disposal methods that prevent reconstruction, recovery, or unauthorised use of the records.

Vendors and data processors shall provide destruction confirmation to NEUC upon request.

 

10. Personnel and Confidentiality

Vendors and data processors shall ensure that:

1. only authorised personnel handle NEUC personal data;
2. personnel access personal data only on a need-to-know basis;
3. personnel are subject to confidentiality obligations before accessing personal data;
4. confidentiality obligations continue after the end of employment, appointment, contract, or engagement where applicable;
5. personnel receive appropriate PDPA, privacy, confidentiality, and cybersecurity awareness training;
6. personnel are instructed not to use personal data for unauthorised, personal, unrelated, or secondary purposes;
7. personnel promptly report actual or suspected data breaches, security incidents, unauthorised access, loss, theft, or accidental disclosure; and
8. personnel comply with this Policy, applicable contracts, data processing agreements, and NEUC’s instructions.

 

11. Subprocessors and Third Parties

Vendors and data processors shall not appoint, replace, or allow any subcontractor, subprocessor, related company, cloud provider, outsourced provider, or other third party to process NEUC personal data without NEUC’s prior written approval, unless otherwise authorised in writing.

Where NEUC approves the use of a subprocessor, the vendor or data processor shall ensure that:

1. the subprocessor is subject to equivalent personal data protection, confidentiality, and security obligations;
2. the subprocessor processes personal data only for authorised purposes;
3. the subprocessor does not further disclose, transfer, or appoint another subprocessor without appropriate authorisation;
4. appropriate security safeguards are implemented;
5. breach notification obligations are imposed on the subprocessor;
6. cross-border transfer restrictions are complied with; and
7. the vendor or data processor remains responsible to NEUC for the acts and omissions of its subprocessors.

 

12. Cross-Border Transfer of Personal Data

Vendors and data processors shall not transfer, store, access, host, or process NEUC personal data outside Malaysia without NEUC’s prior written approval, unless such transfer has been expressly authorised under the applicable contract or data processing agreement.

Where cross-border transfer is authorised, vendors and data processors shall ensure that:

1. the transfer complies with applicable PDPA requirements;
2. a comparable level of protection is provided for the personal data;
3. appropriate contractual, technical, organisational, and security safeguards are implemented;
4. the location of processing, hosting, storage, access, or support is disclosed to NEUC where required;
5. subprocessors or overseas recipients are subject to equivalent obligations; and
6. NEUC is promptly informed of any material change affecting cross-border processing arrangements.

 

13. Data Breach and Security Incident Management

Vendors and data processors shall immediately notify NEUC of any actual or suspected personal data breach or security incident involving NEUC personal data.

A personal data breach or security incident may include:

1. unauthorised access to personal data;
2. unauthorised disclosure, sharing, or transfer of personal data;
3. loss or theft of files, devices, storage media, documents, or systems containing personal data;
4. accidental sending of personal data to the wrong recipient;
5. malware, ransomware, phishing, system compromise, or cyberattack involving personal data;
6. unauthorised alteration, deletion, or destruction of personal data;
7. unauthorised access to cloud systems, databases, user accounts, logs, or support tools;
8. breach involving a subprocessor or third party; or
9. any other incident that may affect the confidentiality, integrity, or availability of personal data.

Upon becoming aware of an actual or suspected breach or incident, the vendor or data processor shall:

1. notify NEUC without undue delay and, where contractually required, within the specified notification timeframe;
2. contain and mitigate the incident promptly;
3. preserve relevant evidence, logs, records, and affected materials;
4. investigate the cause, scope, timeline, affected data, affected systems, and potential impact;
5. provide NEUC with relevant information required for assessment, investigation, notification, remediation, and reporting;
6. cooperate fully with NEUC, the DPO, auditors, regulators, and authorised investigators;
7. not notify data subjects, regulators, media, or third parties on behalf of NEUC unless authorised by NEUC or required by law;
8. implement corrective and preventive measures; and
9. provide incident reports, root cause analysis, remediation plans, and closure reports where requested.

NEUC’s DPO will record, investigate, implement or coordinate security measures, assess whether notification to the Personal Data Protection Commissioner, Jabatan Perlindungan Data Peribadi (“JPDP”), is required where necessary, and notify affected data subjects and reporters where applicable.

 

14. Data Retention, Return, Deletion, and Disposal

Vendors and data processors shall retain NEUC personal data only for the approved duration, authorised purpose, and contractual or legal requirement.

Upon completion, expiry, termination, or written request by NEUC, vendors and data processors shall, according to NEUC’s instructions:

1. return personal data to NEUC;
2. securely delete or destroy personal data;
3. anonymise personal data where authorised;
4. securely dispose of physical records and electronic records;
5. delete personal data from live systems, storage locations, backup systems, portable devices, and user accounts where practicable and authorised;
6. ensure deleted data cannot be reconstructed or recovered through ordinary means; and
7. provide written confirmation or evidence of deletion, destruction, return, or disposal upon request by NEUC.

Vendors and data processors shall not retain copies of NEUC personal data after completion or termination of services unless retention is required by law or expressly authorised by NEUC.

 

15. Audit, Compliance Review, and Cooperation

NEUC reserves the right to conduct or request audits, compliance reviews, security assessments, questionnaires, inspections, evidence reviews, or investigations relating to the vendor’s or data processor’s processing of personal data.

Vendors and data processors shall:

1. cooperate with NEUC’s audits, investigations, compliance reviews, and security assessments;
2. provide reasonable evidence of compliance upon request;
3. provide relevant policies, procedures, certifications, reports, logs, or control evidence where appropriate;
4. remediate identified weaknesses, gaps, or non-compliance within a reasonable timeframe agreed with NEUC;
5. notify NEUC of material changes affecting personal data processing or security controls; and
6. support NEUC in responding to data subject requests, regulatory enquiries, audits, investigations, or legal obligations.

 

16. Use of Artificial Intelligence Tools and Online Large Language Models

Where artificial intelligence tools, generative AI tools, online large language models, automated processing tools, AI-assisted transcription tools, translation tools, image generation tools, analytics tools, or similar digital technologies (“AI Tools”) are used by vendors or data processors in connection with services provided to NEUC, such use shall be subject to appropriate personal data protection and security controls.

Vendors, data processors, subprocessors, and their personnel shall not upload, enter, paste, share, or submit NEUC personal data, sensitive personal data, confidential records, identification documents, student records, employee records, customer records, visitor records, donor records, vendor records, payment records, bank account details, invoices, contracts, access logs, CCTV footage, images, audio recordings, video recordings, system logs, support tickets, correspondence, or other non-public NEUC information into public or unauthorised AI Tools, unless prior written approval has been obtained from NEUC and appropriate safeguards are in place.

Where AI Tools are used, vendors and data processors shall ensure that:

1. the AI Tool has been reviewed and approved for the relevant purpose before use;
2. the use of AI Tools is limited to lawful, authorised, necessary, and contractually permitted purposes;
3. personal data is anonymised, pseudonymised, masked, redacted, or minimised before being entered into an AI Tool, where practicable;
4. sensitive personal data is not processed using AI Tools unless necessary, authorised, and protected by appropriate safeguards;
5. confidential or restricted NEUC records are not uploaded to public AI platforms, personal AI accounts, unauthorised browser extensions, or unapproved third-party tools;
6. AI-generated outputs are reviewed by authorised personnel before being used for service delivery, reporting, communication, publication, decision-making, or record purposes;
7. contracts, terms of service, data processing terms, retention practices, security measures, confidentiality commitments, and cross-border transfer implications of AI Tool providers are reviewed where necessary;
8. prompts, uploaded files, transcripts, summaries, generated outputs, and AI-assisted records containing NEUC personal data are stored, retained, deleted, or archived securely in accordance with NEUC’s instructions and applicable retention requirements;
9. AI Tools are not used to bypass NEUC’s approved systems, access controls, procurement procedures, contractual obligations, confidentiality obligations, or personal data protection requirements; and
10. any suspected unauthorised disclosure, accidental upload, misuse, loss, or exposure of personal data through AI Tools is reported immediately as a data breach or security incident.

The use of AI Tools shall not reduce the vendor’s or data processor’s responsibility to protect personal data under the PDPA, this Policy, the NEUC Vendor Privacy Policy, applicable contracts, and any data processing agreement.

 

17. Prohibited Activities

Vendors, data processors, subprocessors, and their personnel shall not:

1. process personal data for unauthorised purposes;
2. use personal data for their own commercial, marketing, analytics, training, profiling, product development, or unrelated purposes without NEUC’s written authorisation;
3. disclose personal data to unauthorised persons or third parties;
4. appoint subprocessors without required approval;
5. transfer personal data outside Malaysia without required approval;
6. store personal data in unapproved systems, locations, devices, or platforms;
7. share user accounts, passwords, or access credentials;
8. disable, bypass, or interfere with security controls, monitoring, logging, or audit functions;
9. copy, download, export, retain, or print personal data unnecessarily;
10. combine NEUC personal data with other datasets except where authorised;
11. use personal data for AI training, machine learning, testing, or model improvement without NEUC’s written authorisation; or
12. retain personal data after completion or termination of services unless authorised or required by law.

 

18. Responsibilities of Vendor Representatives

Vendor representatives and authorised personnel shall:

1. provide accurate, complete, and updated personal data to NEUC where required for vendor registration, onboarding, access, payment, due diligence, safety, or compliance purposes;
2. maintain confidentiality of NEUC personal data and confidential information;
3. access personal data only for authorised purposes;
4. comply with this Policy, the NEUC Vendor Privacy Policy, applicable contracts, data processing agreements, and NEUC’s instructions;
5. protect passwords, access credentials, devices, files, and records;
6. report suspected unauthorised access, data breaches, security incidents, loss, theft, or accidental disclosure immediately;
7. cooperate with NEUC’s investigations, audits, compliance reviews, and corrective actions; and
8. ensure that their personnel, agents, contractors, and approved subprocessors comply with equivalent obligations.

 

19. Non-Compliance

Failure to comply with this Policy may result in appropriate action, including:

1. requirement to remedy or improve security controls;
2. suspension or restriction of access to NEUC systems, premises, records, or personal data;
3. suspension of procurement, onboarding, payment, or service activities where appropriate;
4. contract termination;
5. removal or replacement of vendor personnel;
6. claims for losses, damages, costs, penalties, or liabilities;
7. reporting to relevant authorities where required; and
8. legal, regulatory, contractual, or enforcement action where applicable.

 

20. Template Contract Clause

Where appropriate, the following clause may be included in contracts, purchase orders, service agreements, data processing agreements, or other vendor documents:

“The Vendor/Data Processor shall implement appropriate technical, administrative, organisational, and physical security measures to protect personal data from unauthorised access, disclosure, loss, misuse, alteration, destruction, accidental exposure, and cybersecurity threats. The Vendor/Data Processor shall process personal data only for authorised purposes and in accordance with NEUC’s documented instructions, the Personal Data Protection Act 2010, its amendments, applicable regulations, this Policy, and any applicable data processing agreement.

The Vendor/Data Processor shall ensure that all employees, representatives, contractors, agents, and approved subprocessors handling personal data are bound by confidentiality and equivalent data protection obligations. The Vendor/Data Processor shall not disclose, transfer, store, process, or provide access to personal data to any third party or outside Malaysia without NEUC’s prior written approval, unless otherwise authorised in writing.

The Vendor/Data Processor shall immediately notify NEUC of any actual or suspected personal data breach or security incident, cooperate fully with NEUC’s investigation, provide relevant information and evidence, and implement corrective and preventive measures. Upon completion, expiry, termination, or request by NEUC, the Vendor/Data Processor shall return or securely delete/destroy all personal data and provide confirmation upon request. NEUC reserves the right to audit or review the Vendor/Data Processor’s compliance with these obligations.”

 

21. Policy Review

NEUC shall review this Policy periodically or whenever necessary due to:

1. changes in the PDPA or other applicable legal or regulatory requirements;
2. changes to the NEUC Vendor Privacy Policy;
3. changes in NEUC’s procurement, vendor management, systems, technologies, operations, contracts, or data processing activities;
4. emerging cybersecurity threats or operational risks;
5. audit findings, security assessments, due diligence findings, or compliance reviews; or
6. significant data breaches or security incidents.

NEUC reserves the right to amend this Policy from time to time. The latest version should be read together with the latest NEUC Vendor Privacy Policy.

 

22. Contact Information

For matters relating to this Policy or the protection of personal data, please contact:

Data Protection Officer (DPO)
New Era University College

Address:
Blocks B & C, Lot 5, Seksyen 10, Jalan Bukit,
43000 Kajang, Selangor, Malaysia

Tel: 603-8740 6392/8210 3709

Email:
For PDPA-related enquiries:        dpo@newera.edu.my
For vendor-related enquiries:       general@newera.edu.my

 

 

(Revised and Approved by Administration Meeting on 20th May 2026)