Data Protection & Cybersecurity Policy

At Sabarudin Othman & Ho Receivables (“SOHO Receivables”, “we”, “our” or “us”), the responsible management of personal data and the security of our information environment forms an important part of how we conduct our operations.

This Data Protection and Cybersecurity Policy (“Policy”) sets out our approach in protecting personal data and maintaining the security of our systems, records, and digital resources used in connection with our website and receivables management activities.

Our security arrangements are intended to reflect the nature of information entrusted to us, the operational risks associated with its use, as well as the legal and regulatory requirements applicable to our business.

This Policy applies to the handling and protection of:

• Personal data obtained, accessed or processed through our website;
• Personal data and other information handled in the course of our receivables management activities;
• Systems, platforms, applications, devices and other digital resources supporting our operations; and
• Physical/electronic records under our control.

It also applies to employees, contractors, service providers and authorised representatives who are permitted to access our information or systems in the due course of their duties.

This Policy should be read alongside our Privacy Notice, which provides additional information on the purposes for which personal data may be collected, used, disclosed and/or retained.

Our approach to data protection and information security is guided by:

• The Personal Data Protection Act 2010 and all applicable subsidiary legislations;
• Relevant Standards, Codes of Practice/Conduct and guidance issued by the Personal Data Protection Commissioner, the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi); and
• Security practices considered appropriate to the nature, scale and sensitivity of our operations within the Financial Services Act (2013) and the receivables management sector.

We review developments in the applicable legal and regulatory framework and, where necessary, adjust our practices accordingly.

Responsibility for data protection and cybersecurity rests with SOHO Receivables’ management, supported by the personnel responsible for compliance and operational oversight.

Our governance framework is directed towards:

• Defining clear responsibilities for the proper handling and protection of information;
• Maintaining Internal Policies and Procedures appropriate to our operations;
• Encouraging accountability and security awareness throughout the organisation;
• Identifying and evaluating risks relating to Personal Data, Systems and Access Privileges;
• Monitoring Relevant Legal, Regulatory and Contractual Obligations; and
• Reviewing our controls to determine when/whether improvements are required.
  

Every relevant person granted access to information under our control is expected to observe the applicable Confidentiality, Data Protection and Security Requirements.

We use a combination of technical, organisational and physical controls to reduce the risk of unauthorised access, loss, misuse, alteration or disclosure of information.

The safeguards applied may vary according to the nature and sensitivity of the information, the purpose for which it is processed and the risks presented by the relevant system or activity.

5.1 Technical Controls

Appropriate technical controls include:

• Restricting system access according to assigned roles and responsibilities;
• Requiring authorised users to complete applicable authentication procedures;
• monitoring system activity for indications of unauthorised access, misuse or irregular behaviour; and
• applying measures intended to preserve the confidentiality, integrity and availability of information.

5.2 Organisational Controls

Our organisational controls may include:

• Confidentiality obligations for employees, contractors and relevant service providers;
• Data Protection and Security Awareness training;
• Defined procedures for approving and managing access to information;
• Appropriate supervision of personnel who handle personal data; and
• Separation of responsibilities in reducing the risk of error or misuse.

5.3 Physical Controls

Physical records, devices and workspaces are protected through measures which includes:

• Restricting access to offices, work areas and equipment;
• Securing physical files, records and electronic devices; and
• Applying appropriate procedures for the storage, movement, management and disposal of records and equipment.

For security reasons, we do not publicly disclose detailed information regarding our internal configurations, security architecture or incident-response procedures.

Access to personal data and information systems is granted only to authorised personnel who requires it for legitimate operational purpose.

Access privileges are intended to correspond with the individual’s role and responsibilities. They may be reviewed, amended, suspended or withdrawn when responsibilities change.

Anyone granted access to any form of data must only use it for authorised purposes, and ensure the prevention of unauthorised access, disclosure or misuse.

We may engage service providers, professional advisers, and other third parties to perform functions connected with our operations.

Where such an engagement involves access to personal data or confidential information, we seek to ensure that:

• Only the information reasonably required for the relevant purpose is disclosed;
• Appropriate Confidentiality, Data Protection and Contractual Obligations are established accordingly;
• Reasonable consideration is given to the third party’s ability to protect the information made available to it; and
• The third party is expected to maintain appropriate security safeguards to the nature of the information and the services performed.

Information disclosed by SOHO Receivables cannot be used by a third party for an unauthorised or unrelated purpose.

We maintain a strong internal process for reporting, evaluating and responding to suspected or confirmed security incidents, including incidents involving personal data.

Depending on the nature and circumstances of an incident, our response shall include:

• Taking steps to contain the incident and limit its effects;
• Assessing the information, individuals and systems that may have been affected;
• Preserving relevant records for investigation;
• Identifying and addressing the circumstances that contributed to the incident;
• Strengthening controls to reduce the likelihood of any recurrence; and
• Notifying affected individuals, clients, regulators or other relevant parties where notification is required.

Any required notification will be undertaken through the appropriate channels and within the period prescribed by the applicable legal, regulatory and/or contractual requirements.

Personal data and other records shall be retained for as long as they are required for the purposes for which they were obtained, or to meet applicable operational, legal, regulatory and contractual requirements.

Once the information is no longer required, measures will be taken to delete/destroy of it securely. 

Protecting information is a shared responsibility. Employees, contractors and authorised representatives who handle information on behalf of SOHO Receivables are expected to:

• Observe applicable data protection, confidentiality and security requirements;
• Access and use information only when/where authorised;
• Exercise appropriate care handling records, devices, system credentials; and
• Promptly report any suspected loss, unauthorised disclosure, misuse or security incidents through the appropriate channels.

Relevant training and guidance will be provided to support these responsibilities.

Cybersecurity threats, technologies and regulatory expectations continue to change. We therefore review these Policies and supporting controls periodically to assess when/whether they remain appropriate and effective.

Our policies, procedures, training and security measures will be revised and strengthened in response to any identified risks, operational developments, security incidents or changes in applicable requirements.

We may revise this Policy from time to time in reflecting changes to our operations, technology, security practices or applicable legal and regulatory requirements.

The current version of this Policy is readily made available on our website.

Questions or concerns regarding this Policy, the handling of personal data or our information security practices may be directed to: