Journal
The organisation received a subject access request from a former employee. Legal knew the 21-day expectation under the PDPA 2010 practice they follow. HR knew the person had files. The document management application knew very little, because staff names lived in folder titles and scanned PDFs with no metadata.
Search returned the personnel file for the current year and missed the disciplinary letters stored under a manager’s name. Email archives were out of scope for our audit, but the HR vault alone took four working days of manual opening.
We were not engaged to answer the request. We were engaged afterwards, to say whether the application could support the next one. It could not, not without a content type for employee, a unique staff number as a required field, and a stop to folder-by-manager filing.
That kind of finding is uncomfortable because it asks people to change how they save, not only how they licence software. It is also cheaper than repeating a four-day hunt each time a request arrives.
Document application audits in Malaysia often land here: the legal duty is understood, the tool was bought, and the filing practice still belongs to a shared drive from 2014.