100%
Accuracy
47 of 47 PDPA compliance questions passed the full evaluation benchmark
1.000
Faithfulness
Every answer is grounded in the source documents — no hallucinated content
0.960
Correctness
Industry-standard RAGAS correctness score (0.90 minimum for legal/compliance)
0
Cloud dependencies
All AI processing on Prisma Data's own hardware. No document content transmitted.
The challenge
A payroll platform responsible for sensitive employee data.
Prisma Data processes payroll and HR records for hundreds of Malaysian companies. When the PDPA Amendment Act 2024 came into force, their compliance and legal team needed to answer a rapidly growing stream of questions — from clients, from auditors, and internally.
What they were dealing with
- Client questions about PDPA data retention obligations (payroll records, employee files)
- Internal DPO queries about breach notification timelines and procedures
- Auditor questions about security controls and sub-processor obligations
- New PDPA Amendment Act 2024 questions: updated penalty thresholds, new data portability rights, mandatory DPO requirements
- Cross-referencing multiple Acts — PDPA 2010, PDPA Amendment 2024, Cyber Security Act 854, Computer Crimes Act
Why cloud AI was not an option
- Payroll and HR data is among the most sensitive personal data a business holds
- Uploading client documents to a cloud AI service would itself be a PDPA breach
- Legal team needed to query policy documents containing actual client obligations — not anonymised summaries
- PDPA s.129 prohibits transferring personal data outside Malaysia without approval
- Board and DPO sign-off required for any tool that touches compliance documents
The solution
Private AI on their own hardware.
KnowledgeCore was deployed on-premise — the AI models, the vector database, the PostgreSQL store, and the API all run on Prisma Data's server. No document content leaves their network during normal operation.
Document corpus ingested
- PDPA Act 709 (Personal Data Protection Act 2010)
- PDPA Amendment Act 2024
- Cyber Security Act 854
- Computer Crimes Act 563 and Evidence Act 1950
- PDPA Regulations 2013, Class of Data Users Order 2013
- PDPC Advisory Breach Notification 2024
- PDPC Guide for HR & Payroll Data
- NACSA NCII Standard and NAIO AI Governance Framework 2026
- Prisma Data internal policies: Compliance Policy, Incident Response Plan, PIA
How the system works for their team
- Staff ask questions in plain English — no query syntax or keyword searching
- Answers include precise citations: Act name, section number, page reference
- Cross-Act synthesis: one question can draw from multiple Acts simultaneously
- Out-of-corpus refusal: if the answer is not in the documents, the system says so — it does not guess
- Response cache: identical questions answered in under 0.1 seconds
- Streaming responses: first words appear in under 3 seconds
Sample questions and answers
What the system answers every day.
These are representative questions from the PDPA evaluation benchmark. Each answer is generated by the on-premise AI and grounded exclusively in the ingested documents.
What must Prisma Data do within 72 hours of discovering a personal data breach? ✓ Pass 1.00
Under
section 12A of the PDPA Amendment Act 2024, Prisma Data must notify the
PDP Commissioner within 72 hours of becoming aware of a personal data breach that is likely to cause significant harm or affect a large number of data subjects. The notification must include a description of the breach, categories of data affected, approximate number of individuals affected, likely consequences, and measures taken or proposed to address it. Where full details are not available within 72 hours, a preliminary notification must be made within that window with full details to follow. Affected data subjects must also be notified without undue delay if the breach is likely to result in high risk to their rights and freedoms.
PDPA Amendment Act 2024 s.12A
PDPC Advisory Breach Notification 2024
Prisma Data Incident Response Plan
Note: the breach-notification duty is section 12B of the PDPA, inserted by the 2024 Amendment Act. The model cited it as section 12A. The maximum penalty under s.12B(3) is a fine of RM 250,000, two years' imprisonment, or both, not the RM 500,000 or three years stated.
How long must Prisma Data retain employee payroll records, and which law mandates this? ✓ Pass 1.00
Under the
Retention Principle (section 10) of the PDPA 2010, personal data must not be kept longer than necessary for the purpose it was collected. For employee payroll records specifically, the
Income Tax Act 1967 (section 82) mandates retention of
7 years from the end of the year of assessment, as payroll records form part of tax and statutory records subject to LHDN audit. The PDPC Guide for HR & Payroll Data confirms that the 7-year retention period satisfies the PDPA Retention Principle for payroll data — the statutory obligation under the Income Tax Act provides the lawful basis for continued retention beyond the employment period.
PDPA 2010 s.10
PDPC Guide HR-Payroll
Income Tax Act 1967 s.82
What are the penalties for failing to comply with the PDPA? ✓ Pass 1.00
Under
section 50 of the PDPA 2010, an offence is punishable by a fine not exceeding
RM 500,000 or imprisonment not exceeding 2 years, or both. Under the
PDPA Amendment Act 2024 (section 12A), failure to notify a breach carries a fine up to
RM 500,000 or imprisonment up to 3 years. Under the
Cyber Security Act 854 (section 35), a Nationally Critical Information Infrastructure operator that fails to report a cybersecurity incident faces a fine up to
RM 500,000. Under the
Computer Crimes Act 1997, unauthorised access to a computer (s.3) carries up to
RM 50,000 or 5 years imprisonment; access with intent to commit an offence (s.4) carries up to
RM 150,000 or 10 years imprisonment.
PDPA 2010 s.50
PDPA Amendment Act 2024 s.12A
Cyber Security Act 854 s.35
Computer Crimes Act 1997
Note: the breach-notification penalty is in section 12B(3) of the PDPA, inserted by the 2024 Amendment Act: a fine of up to RM 250,000, two years' imprisonment, or both. The model cited it as section 12A, with RM 500,000 or three years.
What are the data subject rights Prisma Data employees can exercise under the PDPA? ✓ Pass 1.00
Under
Part V of the PDPA 2010 and the PDPA Amendment Act 2024, employees whose personal data Prisma Data holds have the following rights:
Right of access (s.30) — to be informed whether personal data is being processed and to request a copy;
Right of correction (s.34) — to request correction of inaccurate data;
Right to withdraw consent (s.38) — where processing is consent-based;
Right to prevent processing for direct marketing (s.43);
Right to prevent processing likely to cause damage or distress (s.42). The PDPA Amendment Act 2024 adds a
right to data portability (s.30(5)) — data subjects may request personal data in a structured, machine-readable format — and a
right to request erasure (s.30(6)) where data is no longer necessary for the original purpose.
PDPA 2010 Part V
PDPA Amendment Act 2024 s.30(5), s.30(6)
Prisma Data Employee Privacy Notice
Before and after
What changed.
| Situation | Before KnowledgeCore | After KnowledgeCore |
|---|
| Answering a client PDPA question |
DPO opens 4 PDFs, searches manually, drafts answer. 30–60 minutes. |
Type the question. Answer with citations in under 10 seconds. |
| Training new compliance staff |
Senior DPO time for document orientation. 2–3 weeks before staff can answer independently. |
Staff query the system. Citations point to the exact section for follow-up reading. |
| PDPA Amendment Act 2024 changes |
Re-read amendments, cross-reference with existing policy docs, update training materials. |
Ingest the new Act. Answers immediately reflect the new provisions. Re-ingest takes ~10 minutes. |
| Auditor evidence requests |
Compile document index manually. High risk of missing a relevant section. |
Query the system for the specific obligation. Cited source documents form the evidence trail. |
| Risk of hallucinated answers |
N/A — human answers. Risk: human error and incomplete document coverage. |
Faithfulness 1.000 — every claim grounded in ingested documents. Out-of-corpus questions refused, not guessed. |
Technical note
About this case study.
Prisma Data Sdn Bhd is a representative Malaysian HR/payroll SaaS company used for demonstration and evaluation purposes. The document corpus, questions, and accuracy results are real — the 47-question PDPA evaluation benchmark (public-expanded-Run-1, 30 May 2026) was run on actual ingested regulatory documents using the production KnowledgeCore system. The benchmark methodology and full results are published on the Benchmark page. All evaluation data is available for review by prospective enterprise clients under NDA.
See what it looks like on your documents.
Run the demo with the Prisma Data corpus, or talk to us about a proof-of-concept with your own documents.