GDPR + Malaysia PDPA

Status: engineering controls map — not a certification, not legal advice.
EdgeCMS implements concrete privacy hooks (inventory, export/delete, retention, consent recording, residency notice). Counsel must still review the draft legal pack under apps/website/legal/ before any customer-facing claim.

Companion code: apps/api/src/privacy/. Machine inventory: GET /api/privacy/inventory. Notice: GET /api/privacy/notice.

#Scope (honest)

Malaysia PDPA 2010 (as amended) and GDPR share notice, purpose limitation, access/correction, and deletion themes. Where PDPA requires a specific consent form, the draft Privacy Policy is the notice and legal_acceptances records the tick — once signup wires SU-04.

#Roles

Customers remain the controller for content they store. EdgeCMS does not invent a legal basis for that content; the customer does.

#Data inventory

Authoritative list lives in code (PRIVACY_DATA_INVENTORY) and is served at GET /api/privacy/inventory. Summary:

#Limits that stay true

• Personal data typed into content fields is not searched or changed on user deletion.
• Rows in a dedicated tenant D1 are not pseudonymized by HS-13.
• Webhook payloads, operator logs and backups outside D1 are host-owned.
• Pseudonymized ≠ anonymized: someone holding the old user id can still match audit digests.

#Rights → product hooks

Details of export/delete behaviour: Operations and security — Personal data requests.

#Retention

Central knobs: apps/api/src/privacy/retention-policy.ts (PRIVACY_RETENTION).

Content hook used by write paths: contentRetentionHooks.enforceEntryVersions (wraps retentionService).

#Consent and legal documents

Drafts (not in force): apps/website/legal/.

POST /api/me/legal-acceptance is idempotent per (userId, document, version). Signup UI that requires the checkbox before account creation is SU-04 Planned — do not claim it is live on the website until that ships.

#Locale and data residency

• Content locales (localeCatalog, collection supportedLocales, public locale provenance headers) are editorial/i18n features, not a residency control.
• ABAC locale attribute gates who may edit a locale; it does not move bytes.
• Cloudflare runs a global edge. D1/R2/KV locations follow the Cloudflare account configuration. This product does not offer a per-tenant “store only in MY” switch.
• Hosts set a customer-facing sentence via host.privacy.dataResidencyNotice or PRIVACY_DATA_RESIDENCY_NOTICE. Example: jurisdiction of the operating entity + SCC posture for EU transfers. Exposed at GET /api/privacy/notice.
• Cross-border transfers for EU/UK customers need SCCs (or equivalent) with subprocessors — see draft Subprocessors. Malaysia PDPA transfer rules need counsel review for the operating entity.

#Host composition

createApp({
  host: {
    privacy: {
      dataResidencyNotice:
        'Operating entity in Malaysia; primary Cloudflare account region APAC; EU transfers under SCCs.',
      onPrivacyEvent: async (event) => {
        // enqueue ticket / SecOps notify — never block the request on slow I/O
        console.log(event.action, event.userId)
      },
    },
  },
})

onPrivacyEvent fires after a successful HS-13 export or deletion. Errors are logged and never fail the request.

#Related requirements

#Tests

bun test --isolate \
  apps/api/src/tests/privacy/privacy.service.test.ts \
  apps/api/src/tests/privacy/privacy.controller.test.ts \
  apps/api/src/tests/privacy/data-inventory.test.ts \
  apps/api/src/tests/privacy/legal-acceptance.test.ts