The short version
A build replaces your site. The Sprint works on the one you have. Two things landed on Malaysian broker websites in the last eighteen months. One carries a number. The other carries the return.
The compulsory half, and the half that pays
One engagement, because both halves touch the same pages and the same reader.
| The half | What it rests on | What it is worth |
|---|---|---|
| Data protection | The Personal Data Protection (Amendment) Act 2024, Act A1727. Core obligations in force 1 June 2025. The maximum penalty for a principle breach rose from RM 300,000 to RM 1,000,000, a Data Protection Officer became mandatory for qualifying organisations, and a breach must be reported to the Commissioner within 72 hours. Every provision is now in force and there is no grace period left to sit inside. | An obligation. If the site carries a contact form, an enquiry form, a careers inbox or a tracking script, it processes personal data, and the notice next to it is doing legal work whether or not anyone has read it since it was written. |
| Credibility | Bank Negara's conduct rules for brokers, effective 1 January 2026. Paragraph 16.1 puts the latest audited accounts either at every branch or on the website. It is an either/or, and a broker who keeps copies at the counter is fully compliant with nothing online at all. | An opportunity, and only that. Six things a licensed broker does as a matter of course answer questions a corporate buyer is holding and rarely asks out loud. Almost no broker website in Malaysia says any of them. We read the policy document paragraph by paragraph and published what is in it. |
Nothing in the broker conduct document requires a website, or requires anything to be published online. The first half you have to do somewhere. The second half nobody can make you do, and that is usually where the return sits.
What two weeks actually buys
Five workstreams across ten working days, on your existing site and its existing hosting. No rebuild, no migration, no new platform.
Week one
What exists, who holds the logins, what the pages claim today
Week two
Your site stays where it is the whole time
| Workstream | What changes on the site | What you are left holding |
|---|---|---|
| 01 · Data protection | The privacy notice rewritten against the amended Act rather than the 2010 baseline. Consent handled where the data is actually collected. The Data Protection Officer route published if your organisation is one that has to appoint one. | The notice as published, carrying its own version date, so the next person to review it knows what it was written against. |
| 02 · Claim accuracy | Every factual statement on the site checked against your own registers and corrected where the two disagree. Founding years, licence descriptions, office addresses, named people, capabilities that have moved on. | A line-by-line record of what was checked, what was left alone, and what moved. |
| 03 · What you already do | The obligations you tell us you meet, written plainly on the pages a buyer actually reads, with each line traced back to the paragraph it rests on. | Copy you signed off, and the citation under every claim, so nothing on the page is unattributable a year from now. |
| 04 · Measurement | Analytics and Search Console connected and reading correctly, on accounts in your name. Most sites we open have one of the two, wired to something nobody at the firm can log into. | Administrative access in your own accounts. Ours is removed on handover unless you ask us to stay. |
| 05 · The technical baseline | Page weight, mobile layout, security headers, and the on-page structure a search engine and an AI answer engine both read before they decide what your firm is. | Before and after numbers on each, measured the same way twice. |
You keep a dated record, and for most firms that is half of what they are buying
A website change is invisible a month later, and the question always arrives at an unhelpful moment.
Every Sprint closes with a dated compliance review checklist: what the site said before, what it says now, and the source under each change. It is built to be handed upward to a compliance officer, a board paper, an insurer's due-diligence pack, or an auditor asking when the privacy notice was last reviewed.
Fixed scope, fixed price
Quoted against a written scope before anyone starts. If the requirement genuinely grows, it goes through a change order you approve first, and the original number does not move underneath you.
Ten working days
Two weeks, scheduled with a start date rather than a queue position. The work is bounded, which is what makes the price bounded.
Your site, your accounts
We work on the platform you already run, so the site stays where it is, the hosting bill stays what it is, and when the two weeks end you are free of us. Access is handed back at the end.
When a rebuild is the honest answer, we say so before you pay for this
The Sprint works on a site whose structure is sound and whose content has drifted. That is most sites. It is not all of them.
Where the underlying site cannot carry the changes, spending RM 5,000 on it buys two weeks of improvement to something that will be replaced inside a year, and we would rather say that at the start than discover it in week two. In that case the conversation moves to a build, which starts at RM 12,000, and you see a working version of your own homepage on your own screen before there is a contract. That process is set out here, phase by phase, and the fees are published in full.
It also runs the other way. A firm that arrives expecting to commission a build sometimes has a site that only needs two weeks, and saying so costs us the larger fee. We would rather be the studio that told you.
The questions that come up on the first call
Is any of this actually required, or is that the sales pitch?
Half of it is required and half of it is not, and we would rather draw the line ourselves than have you find it later. The data-protection half rests on the Personal Data Protection (Amendment) Act 2024, which is fully in force with a maximum penalty of RM 1,000,000 and no remaining grace period. The credibility half rests on nothing compulsory at all: Bank Negara's paragraph 16.1 is an either/or, and a broker keeping audited accounts at the branch counter is fully compliant with nothing published online. We do the second half because it is where the return is, never because a rule forces it.
We already have a privacy policy. Why would it need rewriting?
Most of the ones we open were written against the 2010 Act. The 2024 amendment renamed data users as data controllers, made a Data Protection Officer mandatory for qualifying organisations, introduced the 72-hour breach report to the Commissioner, added a right to data portability, and raised the ceiling to RM 1,000,000. A notice that predates all of that is not describing the law your site operates under. What changed, and what it means for a website, is set out here.
How do we know whether we have to appoint a Data Protection Officer?
That determination is yours and your advisers', and we will not make it for you. What we do is publish the contact route cleanly if you tell us you are required to appoint one, and leave the page correct if you tell us you are not. The website's job is to reflect the position your firm has taken, not to decide it.
Our site was built by someone else and we are not sure who has the logins.
That is the ordinary case rather than the awkward one, and finding out is the first thing we do. Week one starts with an access audit: what exists, who controls it, what the renewal dates are, and what is registered to a person who left. Firms occasionally discover during this that their domain is registered to a former supplier, which is worth knowing on a quiet Tuesday rather than on the day it expires.
Who owns everything afterwards?
You do, outright, and that includes the accounts. Analytics and Search Console are set up in your firm's name rather than ours, our access is removed at handover unless you ask us to keep maintaining the site, and the completed review checklist and change record are yours to file. Nothing in this engagement creates a dependency on us.