For Online Retail · E-Commerce · Marketplaces · D2C Brands
Every tracker on your checkout page is a consent decision you already made.
Names, addresses, phone numbers, order history, payment tokens — your storefront collects all of it before the customer reads a word of your privacy notice. The PDPA 2024 Amendment raises the penalty to RM 1,000,000 and starts a 72-hour clock on every breach. AuditCore reads your storefront the way the regulator would.
Free Website Check →
See Plans
What the law expects from you
The obligations that apply specifically to online retail & e-commerce — with the statute doing the expecting.
PDPA s.7 — notice & choice
Your privacy notice must reach the customer at the point of collection, in both Bahasa Malaysia and English, and must name the purpose, the recipients, and how to reach you. A footer link in English only does not satisfy it.
PDPA s.6 — consent before processing
Analytics, remarketing pixels, and chat widgets process personal data. Firing them on page load — before the visitor has answered anything — collects first and asks afterwards.
PDPA s.10 — retention
Order histories, abandoned carts, and marketing lists cannot sit there forever. Personal data past its purpose must be destroyed, on a schedule you can show runs.
Electronic Trade Transactions Regulations 2012
Online sellers must disclose the business name, registration number, contact details, and a full price breakdown before checkout, and keep a record of every transaction.
What we usually find
The three most common findings when we audit online retail & e-commerce. All fixable — once they're visible.
Trackers that fire before consent
Analytics, advertising pixels, and chat widgets load on first paint, long before the consent banner appears. We inventory what your pages load and when they load it.
A privacy notice nobody can act on
English only, no retention period, no route to request access or deletion, and a contact address that bounces — four separate s.7 gaps on one page.
Keys shipped to the browser
Payment, analytics, and shipping-API keys left in the front-end bundle or in a committed .env file. The secrets checks find them in seconds; so does anyone with developer tools open.
The profiles that apply to you
A paid AuditCore scan runs your codebase and configuration against every check in these profiles — plus the core security set.
PDPA 2024 · 36 checks
OWASP Top 10 · 4 checks
Start with the free check — see your grade in 10 seconds
No account, no card. Your public website scored against the checks that matter for online retail & e-commerce —
then decide if the full codebase audit is worth it.
Run Free Check →
WhatsApp Us