1.0 Objective and Purpose
This Personal Data Protection Policy (“Policy”) outlines Bandai Namco Studios Malaysia Sdn. Bhd.’s (“the
Company”) commitment to protecting personal data in accordance with the Personal Data Protection Act
2010 and its 2024 Amendments. This Policy aims to ensure legal compliance, build stakeholder trust, and
promote transparency in data processing activities.
2.0 Scope
This Policy applies to all employees, job applicants, contractors, vendors, customers, and other individuals
whose personal data is collected, stored, processed, or transferred by the Company.
3.0 Effective Date
1 June 2025
4.0 Definitions
- Personal Data: Any information that identifies or can reasonably identify an individual (e.g., name,
NRIC/passport number, contact information, employment or financial details). - Sensitive Personal Data: Includes biometric data, health information, religious beliefs, etc.
- Data Controller: The Company, which determines how and why personal data is processed.
- Data Processor: A third party that processes personal data on behalf of the Data Controller.
- Data Subject: The individual to whom the personal data relates.
- Data Protection Officer (DPO): Appointed person responsible for ensuring compliance with PDPA
obligations.
5.0 Principles of Data Protection
The Company adheres to the following data protection principles:
- General Principle – Personal data must not be processed without the individual’s consent.
- Notice and Choice Principle – Individuals must be informed of the purpose of data collection and given
the option to opt out. - Disclosure Principle – Personal data will not be disclosed to third parties without consent or legal basis.
- Security Principle – Adequate measures shall be taken to protect personal data.
- Retention Principle – Personal data shall not be retained longer than necessary.
- Data Integrity Principle – Personal data must be accurate, complete, and up to date.
- Access Principle – Individuals have the right to access and correct their personal data.
6.0 Rights of Data Subjects
Under the 2024 Amendments, data subjects have the right to:
- Access their personal data
- Request correction of inaccurate data
- Withdraw consent for data processing
- Request deletion of data (“right to be forgotten”)
- Request data portability (to transfer data to another organization)
7.0 Collection, Use, and Purpose of Data
Personal data is collected and processed only for lawful and necessary purposes, including:
- Recruitment and employment administration
- Employee benefits and payroll
- Project and vendor management
- Customer support and services
- Legal and regulatory compliance
- Marketing and communication (with consent)
8.0 Disclosure of Personal Data
The Company may disclose personal data to the following parties, with appropriate safeguards:
- Government or regulatory bodies
- Legal and professional advisors
- Third-party service providers (e.g., payroll processors, IT vendors)
- Related companies within the Bandai Namco group (if necessary)
9.0 Cross-Border Transfers
Personal data may be transferred outside of Malaysia only to countries with adequate data protection
standards and subject to appropriate contractual or legal safeguards.
10.0 Data Breach Notification
In the event of a data breach:
- The DPO must notify the Personal Data Protection Commissioner within 72 hours of becoming aware
of the breach. - Affected individuals must also be informed without undue delay.
- The Company will document all breach incidents and corrective actions taken.
11.0 Appointment of Data Protection Officer (DPO)
The Company has appointed a Data Protection Officer responsible for:
- Overseeing compliance with PDPA
- Handling data access and correction requests
- Conducting staff training and awareness
- Liaising with the PDPA Commissioner’s Office
12.0 Policy Review and Updates
This Policy will be reviewed annually or as required to ensure alignment with regulatory changes and
operational needs. Updates will be communicated to all relevant stakeholders.
