Task 5 — Retention Periods & Transfers

How long do you keep it — and does it leave the country or the group?

Complete each processing activity with its retention period and its transfers. They are the basis for the retention schedule in Workshop 6 and the transfer checks in Workshop 10.

What to document

Retention period: a fixed period or the criteria to determine it, and the event that starts it (e.g. end of contract)
Transfers to other countries: the recipient countries, including cloud services and support teams with access from abroad
Transfers within the group: e.g. a shared HR or CRM system run by the parent company

In ResGuard: transfers are recorded in Supplier Management, the module for third parties and vendors. Create each recipient there, such as a vendor, a group company or another third party, with its country, and link it to the processing activity in the RoPA.

Transfers in your jurisdiction

Malaysia

Since the 2024 amendment, the whitelist of countries has been removed: personal data may be transferred abroad if the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or if an exception applies (e.g. consent or the performance of a contract). The Commissioner's cross-border transfer guidelines expect a transfer impact assessment.

Example: retention and transfers

Processing activity	Retention period	Transfers
Payroll	Period required by tax and social security law, from the end of the year	Payroll provider in the same country
Recruitment	A few months after the position is filled, longer only with the applicant's consent	None
Newsletter	Until consent is withdrawn	E-mail marketing service hosted abroad
CRM	Duration of the customer relationship plus statutory periods	Group CRM operated by the parent company

The exact periods depend on your tax, accounting and employment laws — record the law next to each period.