Legal

Personal Data & Privacy Notice

Last updated: 10 August 2026

Law Chambers of Jack & Lim (“the Firm”) is committed to protecting the privacy and confidentiality of personal data entrusted to us.

This Personal Data and Privacy Notice (“Notice”) explains how we collect, use, process, disclose, retain and safeguard personal data in accordance with the Personal Data Protection Act 2010 [Act 709] of Malaysia, as amended from time to time (“PDPA”), and other applicable laws and regulatory requirements.

This Notice applies to our clients and prospective clients, individuals connected with our clients or matters handled by the Firm, professional contacts, counterparties, business associates, consultants, service providers, event participants, subscribers, website visitors and any other individuals whose personal data may be processed by us. It also applies where you communicate or interact with the Firm through our website, email, telephone, messaging platforms, social media, meetings, events or otherwise.

Personal Data We Collect

In the course of our professional practice and dealings with you, we may collect and process personal data relating to you and, where relevant, other individuals connected with you, your organisation or the matter concerned (“Personal Data”).

Depending upon the nature of our relationship and the services concerned, Personal Data may include:

  • your name, preferred name, identification card or passport particulars, nationality, date of birth, age and gender;
  • residential, correspondence or business addresses, telephone numbers, email addresses and other contact information;
  • occupation, designation, employer, business and professional information;
  • financial, banking, transaction, payment and billing information;
  • information relating to your spouse, children, family members, directors, shareholders, employees, representatives, beneficial owners or other connected persons;
  • documents and information relevant to legal matters, transactions, disputes, investigations or proceedings handled by the Firm;
  • correspondence, communications, instructions and records of dealings with us;
  • technical or electronic information arising from your use of our website or electronic systems, including where applicable internet protocol addresses, browser information and similar technical data; and
  • such other information as may reasonably be required for the purposes of providing our services, complying with applicable law or administering our professional practice.

Where relevant to a matter or permitted by law, Personal Data processed by us may include sensitive personal data, including information relating to physical or mental health, political opinions, religious or similar beliefs, the commission or alleged commission of an offence, biometric data and such other categories prescribed by applicable law.

Sources of Personal Data

We may obtain Personal Data from various sources, including:

  • information provided directly by you when you engage or enquire about our services, communicate with our lawyers or staff, attend our events, subscribe to our communications or otherwise interact with the Firm;
  • information supplied by your representatives, directors, employees, agents, advisers or other persons acting on your behalf;
  • documents, correspondence, agreements, pleadings, affidavits, evidence, records and other materials provided to us in connection with legal advice, transactions, disputes or proceedings;
  • clients, counterparties, witnesses, professional advisers, experts, investigators, service providers and other persons connected with a matter;
  • courts, tribunals, governmental departments, regulatory authorities, statutory bodies and law enforcement agencies;
  • public registers, court records, publications, databases, websites and other publicly available sources; and
  • such other lawful sources as may be relevant to the purposes for which the Personal Data is processed.

Purposes for Which We Process Personal Data

We may collect, use and otherwise process Personal Data for purposes connected with the conduct and administration of our legal practice, including:

  • considering enquiries and determining whether we are able to accept instructions;
  • conducting conflict checks, client identification, verification, due diligence and other onboarding procedures;
  • providing legal advice, representation and other professional services;
  • preparing, reviewing, negotiating and completing agreements, legal documents, transactions and other deliverables;
  • conducting or managing litigation, arbitration, mediation, negotiations, investigations and other dispute resolution processes;
  • corresponding and liaising with clients, counterparties, courts, governmental authorities, regulators, professional advisers and other relevant persons;
  • administering and managing our professional and business relationships;
  • processing fees, payments, invoices and accounts;
  • maintaining files, records, databases and internal administrative systems;
  • managing our offices, personnel, information technology systems and professional practice;
  • conducting internal compliance, risk management, audit, quality-control and security procedures;
  • organising seminars, events, meetings, training programmes, networking activities and other professional activities;
  • providing legal updates, publications, invitations and information concerning the Firm and our services, where permitted by law;
  • responding to enquiries, requests, complaints or feedback;
  • protecting or enforcing the Firm’s legal rights and interests;
  • preventing or detecting fraud, misconduct, security incidents or unlawful activity;
  • complying with professional duties, court orders, regulatory requirements and obligations imposed by law; and
  • any other purpose which is reasonably related or incidental to the foregoing purposes or which has been notified to you.

Where required by applicable law, we will obtain the necessary consent before processing Personal Data for a particular purpose.

Provision of Personal Data

Whether the provision of Personal Data is obligatory will depend upon the circumstances and the nature of your dealings with the Firm.

Where Personal Data is identified as mandatory, or is reasonably required for us to provide our services or comply with applicable legal or professional obligations, failure to provide such Personal Data may result in our being unable to:

  • accept or continue your instructions;
  • provide the requested legal or professional services;
  • properly advise, represent or communicate with you;
  • perform or complete a transaction, matter or engagement;
  • establish, maintain or administer a professional or business relationship with you; or
  • comply with legal, regulatory, professional or administrative requirements applicable to the Firm.

Where Personal Data is provided for optional communications or activities, failure to provide such information may affect our ability to send you legal updates, publications, invitations or information concerning the Firm.

Disclosure of Personal Data

Personal Data entrusted to the Firm will be treated as confidential and will not be disclosed except where such disclosure is necessary or appropriate for the purposes described in this Notice, permitted or required by law, or otherwise authorised by you.

Subject always to applicable laws, professional obligations, duties of confidentiality and legal professional privilege, Personal Data may be disclosed to:

  • courts, tribunals, arbitrators, mediators and other dispute resolution bodies;
  • governmental departments, statutory authorities, regulators and law enforcement agencies;
  • the Malaysian Bar, Bar Council and other relevant professional or regulatory bodies;
  • counterparties and their solicitors or professional advisers where necessary in connection with a matter;
  • advocates and solicitors, foreign counsel, consultants, accountants, auditors, tax advisers, investigators, experts, valuers and other professional advisers;
  • banks, financial institutions, insurers and other parties involved in a transaction or matter;
  • vendors, contractors, information technology providers, cloud-service providers, document-storage providers and other third-party service providers engaged to support the Firm’s operations;
  • persons to whom disclosure is necessary for the establishment, exercise or defence of legal rights;
  • persons to whom the Firm is required or permitted to disclose Personal Data pursuant to any law, court order, regulatory requirement or lawful request; and
  • any other person where such disclosure is reasonably necessary for the provision of our services or has been authorised by you.

The Firm does not waive legal professional privilege or any duty of confidentiality by reason only of this Notice.

Transfer of Personal Data Outside Malaysia

Due to the nature of our practice, including matters involving international or cross-border elements, Personal Data may from time to time be transferred to, processed in or stored outside Malaysia.

Such transfers may occur where, for example:

  • a transaction, dispute, investment or other matter involves a foreign jurisdiction;
  • we engage or work with foreign counsel, overseas professional advisers, experts or service providers;
  • documents or information are required to be provided to foreign authorities, regulators, courts, counterparties or other relevant persons;
  • you or your organisation has operations, assets, counterparties, shareholders, affiliates or other interests outside Malaysia; or
  • we use information technology, cloud computing, data hosting, communications or other systems whose infrastructure or service providers are situated outside Malaysia.

Where Personal Data is transferred outside Malaysia, the Firm will do so in accordance with the requirements of the PDPA and applicable law, including the requirements governing cross-border transfers of personal data.

Recipients outside Malaysia may include clients, counterparties, professional advisers, foreign counsel, courts, governmental or regulatory authorities, service providers, contractors and technology or data-infrastructure providers involved in or supporting the relevant matter or our operations.

Security of Personal Data

We take reasonable and appropriate measures to safeguard Personal Data under our control.

Depending upon the circumstances, these measures may include administrative, organisational, physical and technical safeguards designed to protect Personal Data against:

  • loss or accidental destruction;
  • misuse or unauthorised processing;
  • unauthorised access, alteration or disclosure; and
  • other security risks associated with the processing of Personal Data.

Where third-party service providers process Personal Data on our behalf, we will take such reasonable steps as may be required under applicable law in relation to the security and protection of that Personal Data.

However, no method of electronic transmission or storage can be guaranteed to be completely secure, and accordingly the Firm cannot warrant absolute security in all circumstances.

Retention of Personal Data

We will retain Personal Data for so long as it is reasonably required for the purposes for which it was collected or processed, including for the provision of legal services, maintenance of professional records and compliance with legal, regulatory, taxation, accounting, insurance, risk-management and professional obligations.

Where Personal Data is no longer required for such purposes, we will take reasonable steps to securely destroy or permanently delete the Personal Data, subject to any requirement or entitlement to retain it under applicable law.

Your Rights in Relation to Personal Data

Subject to the PDPA, applicable law and any permitted exceptions or limitations, you may have the right to:

  • request confirmation as to whether we hold or process Personal Data relating to you;
  • request access to Personal Data held by us;
  • request correction of Personal Data which is inaccurate, incomplete, misleading or not up to date;
  • withdraw consent previously given for the processing of your Personal Data, where processing is based upon such consent;
  • request that we cease or restrict certain processing of your Personal Data in circumstances provided by law;
  • object to or prevent processing for direct marketing purposes;
  • request that we cease processing which causes or is likely to cause substantial damage or distress in circumstances provided under the PDPA;
  • make a request for the portability of your Personal Data to another data controller, subject to the requirements of the PDPA, technical feasibility and compatibility of the relevant data format; and
  • request information concerning our policies and practices in relation to Personal Data and the categories of Personal Data processed by us.

Certain requests may be subject to statutory exceptions, limitations, prescribed procedures or fees.

Withdrawal of consent will not affect processing already undertaken lawfully before the withdrawal and may affect our ability to continue providing particular services where the relevant Personal Data is necessary for those services.

The statutory right to data portability was introduced as section 43A of the PDPA and became operative on 1 June 2025, subject expressly to technical feasibility and compatibility of the data format.

Website and Cookies

When you access or use our website, certain technical information may be collected automatically, including your IP address, browser type, device information, pages accessed and similar usage information.

Our website may also use cookies or similar technologies to enable website functionality, enhance user experience, maintain security and understand how the website is used.

You may configure your browser to restrict or disable cookies. However, doing so may affect the availability or functionality of certain features of the website.

Changes to this Notice

We may amend, revise or update this Notice from time to time to reflect changes in our practices, technology, professional requirements or applicable laws and regulations.

The updated version will be published on our website and will take effect from the date stated in the updated Notice.

You are encouraged to review this Notice periodically.

Contact Us

You may contact us if you wish to:

  • request access to or correction of your Personal Data;
  • withdraw a consent previously provided;
  • exercise any applicable rights in relation to your Personal Data;
  • obtain further information concerning our personal data practices; or
  • make an enquiry or complaint concerning the collection, use, disclosure or other processing of your Personal Data.

Please write to us at office.jlc@jacklimlaw.com or call +60 12-542 8135. Our office is at 18-24-A3, Gurney Tower, Persiaran Gurney, 10250 Penang, Malaysia.