Data privacy and cybersecurity penetration testing for fintech startups:

Duit Transfer Sdn Bhd is a start-up dealing with cross-border remittances that is in the final lap of obtaining approval from Bank Negara Malaysia for its operating licence. On the other hand, Kaya Robo-advisors Sdn Bhd, is a wealth technology start-up company that has submitted their application to the Securities Commission (SC) for their robo-advisory operating licence.

Discuss:

a. Whether the compliance with the Personal Data Protection Acts 2010 is required for both companies, one dealing with overseas transactions outside Malaysia (Duit Transfer) and the other is principally based in Malaysia (Kaya Robo-advisors)?

b. Whether cybersecurity penetration testing (pen testing) is required to be undertaken by both start-ups