For Property Agencies · Developers · PropTech · Property Management
The tenant files you never deleted are the liability you cannot see.
Every viewing, every tenancy application, every loan referral leaves a copy of someone’s IC, payslip, and bank statement in an inbox or a shared drive. The PDPA 2024 Amendment raises the penalty to RM 1,000,000, and retention is the principle Malaysian agencies breach most often. AuditCore finds the copies before a complaint does.
Free Website Check →
See Plans
What the law expects from you
The obligations that apply specifically to property & real estate — with the statute doing the expecting.
PDPA s.10 — retention
Personal data must be destroyed once its purpose is served. An unsuccessful tenancy application has no ongoing purpose — keeping the documents is the violation, not losing them.
PDPA s.6 — consent & purpose
A tenancy application is consent to assess that tenancy. It is not consent to add the applicant to your next launch blast.
PDPA 2024 s.9 — processor liability
Listing portals, e-signature services, credit-check providers, and property-management SaaS all hold your clients’ data. Without a signed Data Processing Agreement, the liability boundary gets decided after the breach.
AMLA 2001 — reporting institutions
Estate agents are reporting institutions: customer due-diligence records must be kept for the period the Act requires. That is a separate retention schedule from your PDPA deletion duties — not an exemption from them.
What we usually find
The three most common findings when we audit property & real estate. All fixable — once they're visible.
Scanned ICs in a shared drive
Folders of IC, payslip, and bank-statement images with open link sharing, no expiry, and no record of who opened them. The most common property finding, and the most damaging.
Enquiry lists reused for launches
Viewing and enquiry data repurposed into marketing blasts with no lawful basis and no opt-out. Every send repeats the breach.
No deletion path when the deal dies
Failed applications, expired tenancies, and departed agents’ mailboxes keep working copies indefinitely. We check for a retention schedule and for evidence that it runs.
The profiles that apply to you
A paid AuditCore scan runs your codebase and configuration against every check in these profiles — plus the core security set.
PropTech · 9 checks
PDPA 2024 · 36 checks
Start with the free check — see your grade in 10 seconds
No account, no card. Your public website scored against the checks that matter for property & real estate —
then decide if the full codebase audit is worth it.
Run Free Check →
WhatsApp Us