Malaysia software delivery: PDPA, MyInvois, DuitNow and three languages

OutsourcingVN is operated by Netbase JSC, so this guide is written by a supplier that would like your project. It sets out what Netbase can evidence for a Malaysian brief, points to the official references your own advisers should read in full, and names the decisions that stay with you. The guides index lists guides for other markets, and the market index compares the first question each one raises.

Contents

• What makes a Malaysia-facing build different?
• What can Netbase evidence for a Malaysian brief?
• Which steps come before a Malaysia-facing launch?
• Worked scenario: an FPX payment that times out
• What has Netbase built that is relevant to a Malaysian brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

What makes a Malaysia-facing build different?

Four design choices come up in almost every Malaysia-facing brief, and each has a different owner.

• Data protection under the amended PDPA. Malaysia's Personal Data Protection Department (JPDP) administers the Personal Data Protection Act 2010 (Act 709) and, following its 2024 amendment, publishes guidance on data controller registration, data protection officer appointment and data breach notification duties.
• Phased e-invoicing through MyInvois. The Inland Revenue Board (HASiL) runs e-Invoice in stages, covering business-to-business, business-to-consumer and business-to-government transactions, through either the MyInvois Portal or an API integration built against HASiL's published software development kit.
• DuitNow and FPX at checkout. PayNet, Malaysia's national payment network operator under Bank Negara Malaysia's oversight, runs DuitNow for real-time transfers by mobile number or QR code and FPX for direct online banking payments; most Malaysian consumer checkouts expect at least one of them alongside cards.
• Malay, English and Chinese content. Consumer-facing copy, legal notices and support scripts commonly need some mix of Bahasa Malaysia, English and Chinese, which changes forms and generated documents, not just a translation pass at the end.

A buyer's legal, finance and product owners should settle each of these with their own advisers before discovery starts; engineering then turns the decisions into registration records, an invoicing integration, a payment flow and a language boundary.

What can Netbase evidence for a Malaysian brief?

Procurement and security reviewers tend to ask for the same statements. These are the ones Netbase can give, set against what a Malaysia-facing brief actually needs decided.

Netbase JSC holds ISO 27001 certification for information security management, a company-level certification never extended to a specific product or hosting arrangement built for a client. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam; delivery communication is in English, with the Hanoi office working Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7).

Worked scenario: an FPX payment that times out

An online retailer adds FPX alongside DuitNow and cards so business customers can pay directly from their bank accounts.

A proposal that cannot describe steps 3 and 5, specifically what happens when a bank redirect does not return, has not yet scoped Malaysian payments for this product.

What has Netbase built that is relevant to a Malaysian brief?

The closest published evidence for a Malaysian brief is regional commerce work, presented here as Singapore delivery, not as Malaysian work. Netbase's most substantial Singapore record is the redevelopment of an online print store for a large-format inkjet printing company in Singapore: over several phases and more than a year, Netbase redeveloped the store's user experience, interface and most of its system, including a function that converts uploaded PDF artwork into high-resolution, editable pages mapped to the sides of a product. The large-format print store redevelopment record has the detail; the client is not named. Netbase has also built web-to-print stores with online design tools for print businesses in Singapore (vinyl sticker cutting and large-format printing, with specialist, production and designer roles), France, the Netherlands and South Korea; the four-country web-to-print record covers the design-tool scope. The e-commerce and ERP integration solution sets out how a catalogue, payments and back-office systems connect for a Malaysian storefront.

Which questions should you ask a supplier?

• Who registers under the amended PDPA, and who is the data protection officer? It should be your organisation, with the supplier advising rather than registering on your behalf.
• Which MyInvois route have you actually integrated, the portal or the API? Ask for a real submission reference, not a slide.
• What happens when an FPX redirect does not return? Look for a status check and a fallback, not a second charge.
• Who holds the DuitNow and FPX merchant relationships after handover? It should be your organisation.
• Which languages do you expect us to supply, and which do you draft? A good proposal separates legal and marketing copy your organisation approves from interface labels the supplier drafts for review.
• What is out of scope for the first release? A good proposal names it rather than leaving it implicit.

What usually goes wrong?

• PDPA registration and officer duties left undecided. Signal: no named data protection officer or breach process exists when a real incident happens. Owner: the data protection lead.
• MyInvois treated as a one-off form. Signal: the integration cannot handle a second invoice format or a cancellation. Owner: the finance systems owner.
• Only one payment method tested end to end. Signal: a bank redirect failure leaves an order stuck with no fallback. Owner: the product owner.
• Chinese or English content added as an afterthought. Signal: generated documents and support scripts are translated late and inconsistently. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide uses the Personal Data Protection Department's own site and its Act 709 guidance, the Inland Revenue Board's e-Invoice implementation page, Bank Negara Malaysia's payments section and PayNet's own description of DuitNow and FPX, all accessed on 2026-10-13, together with Netbase delivery records approved in the OutsourcingVN claim register. It is written for product, technology and operations leads preparing a brief. It does not decide whether a specific product must register under the amended PDPA, or which MyInvois integration route fits your transaction volume; those decisions stay with your advisers. Netbase's only office is in Hanoi, Vietnam, and Malaysia-facing work is delivered remotely from that base.

Plan the first release

Bring your PDPA registration decision, your MyInvois integration route, your DuitNow and FPX scope and the names of your legal, finance and product owners. The e-commerce and ERP integration solution shows how payments and catalogue data connect to back-office systems, and time zone collaboration in Vietnam sets out how an overlap window and escalation route are agreed. For neighbouring markets, the Singapore guide covers phased redevelopment and identity data, the Indonesia guide covers electronic-system registration and QRIS, and the Philippines guide covers National Privacy Commission registration.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your registration and payment questions, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions