The 43-Point Gap: An AI-Assisted Documentary Analysis of 213 Malaysian Privacy Notices Under the PDPA 2010 and Amended Act A1727

This working paper reports an AI-assisted documentary analysis of 213 published Malaysian privacy notices, drawn from 209 organisations across twelve sectors and retrieved in July 2026. Each notice was read against two indicator sets: one derived from the Personal Data Protection Act 2010 principles assessed by Chua et al. (2017), and one derived from obligations introduced by the Personal Data Protection (Amendment) Act 2024 (Act A1727), whose final commencement phase took effect on 1 June 2025. Against a common internal reference threshold, 73% of notices cleared the line on the 2010 indicator set and 30% on the A1727 set — a 43-point difference. Five of Chua et al.'s seven headline conclusions re-appear a decade later, including their finding that government-classified notices receive the lowest documentary scores; the previously reported association between sensitive-data sectors and stronger scores does not. Scope and limitations. The study measures public-documentary alignment with selected indicators. It does not assess legal compliance or operational readiness, and no score should be represented as doing so. The A1727 indicator set combines obligations that must appear in a notice with obligations that need not, and has not been decomposed. The scoring engine has not been validated against independent human raters, and there was no second rater at any stage. The indicator lists, weights and denominators are not released with this version, and the sampling frame is undocumented, so no claim of representativeness is made. A manual audit of twenty notices found the retrieval step had missed content present on the organisation's website in eleven cases; all scores should therefore be read as lower bounds. The 43-point difference is a descriptive result produced by this instrument, not a calibrated estimate of relative statutory compliance. Published as Version 1.0 of an exploratory research programme. Not peer reviewed. The instrument is specified in the companion Methodological Codebook (DOI 10.5281/zenodo.21765006).

Authors

Publication Details

Journal
Zenodo (CERN European Organization for Nuclear Research)
Published
2026-08-03
DOI
https://doi.org/10.5281/zenodo.21764557
Primary Topic
COVID-19 Digital Contact Tracing
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
article

The 43-Point Gap: An AI-Assisted Documentary Analysis of 213 Malaysian Privacy Notices Under the PDPA 2010 and Amended Act A1727

Nicco Tan
Zenodo (CERN European Organization for Nuclear Research)
COVID-19 Digital Contact Tracing
article

The 43-Point Gap: An AI-Assisted Documentary Analysis of 213 Malaysian Privacy Notices Under the PDPA 2010 and Amended Act A1727

Nicco Tan
article en

Abstract

This working paper reports an AI-assisted documentary analysis of 213 published Malaysian privacy notices, drawn from 209 organisations across twelve sectors and retrieved in July 2026. Each notice was read against two indicator sets: one derived from the Personal Data Protection Act 2010 principles assessed by Chua et al. (2017), and one derived from obligations introduced by the Personal Data Protection (Amendment) Act 2024 (Act A1727), whose final commencement phase took effect on 1 June 2025. Against a common internal reference threshold, 73% of notices cleared the line on the 2010 indicator set and 30% on the A1727 set — a 43-point difference. Five of Chua et al.'s seven headline conclusions re-appear a decade later, including their finding that government-classified notices receive the lowest documentary scores; the previously reported association between sensitive-data sectors and stronger scores does not. Scope and limitations. The study measures public-documentary alignment with selected indicators. It does not assess legal compliance or operational readiness, and no score should be represented as doing so. The A1727 indicator set combines obligations that must appear in a notice with obligations that need not, and has not been decomposed. The scoring engine has not been validated against independent human raters, and there was no second rater at any stage. The indicator lists, weights and denominators are not released with this version, and the sampling frame is undocumented, so no claim of representativeness is made. A manual audit of twenty notices found the retrieval step had missed content present on the organisation's website in eleven cases; all scores should therefore be read as lower bounds. The 43-point difference is a descriptive result produced by this instrument, not a calibrated estimate of relative statutory compliance. Published as Version 1.0 of an exploratory research programme. Not peer reviewed. The instrument is specified in the companion Methodological Codebook (DOI 10.5281/zenodo.21765006).

Zenodo (CERN European Organization for Nuclear Research)
Peace, Justice and strong institutions
Openalex Percentile: Top 3%
COVID-19 Digital Contact Tracing
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.