How to review a supplier's data security after a third-party breach

1 November 2026 · How-to · Tech & digital

Start by listing every supplier that stores or processes your customers' or staff's personal data, then check each contract for incident-notification terms, security evidence and exit rights. The Amadeus incident that affected Malaysia Airlines this week shows how a supplier breach becomes your problem, and a cybersecurity provider can run the review if you lack in-house staff.

Why supplier risk needs its own review

Malaysia Airlines said on 31 October that customer data handled by its reservation provider may have been exposed, even though its own systems were not breached. Most companies now hand customer and employee data to outside platforms for payroll, CRM, e-commerce, e-invoicing and cloud hosting. A breach at any of them can reach your customers, so supplier security deserves the same attention as your own.

Malaysia's Personal Data Protection Act places obligations on organisations that control personal data, including when processing is done by others on their behalf. The Department of Personal Data Protection publishes guidance, and your legal adviser can explain how it applies to your business.

Step 1: build a supplier data map

List every outside system that holds personal data: payroll, HR, CRM, booking, e-commerce, marketing email, cloud storage, IT support tools.
Note what data each holds, roughly how many records, and where it is hosted.
Mark the suppliers whose breach would force you to contact customers. These go to the top of the review.

Step 2: check contracts and evidence

Incident notification: how quickly must the supplier tell you, and through which channel?
Security evidence: ask for a current ISO 27001 certificate, SOC 2 report or recent penetration test summary.
Access control: who at the supplier can see your data, and is multi-factor authentication enforced?
Sub-processors: which other companies does the supplier pass your data to?
Exit: can you export and delete your data if you leave?

Step 3: plan for the day it happens, and get help if needed

Agree internally who decides whether to notify customers, who drafts the message and who answers questions. Keep a short template ready that warns customers about follow-up phishing, which is the most common next step after leaked booking or contact data.

If your company is in a sector designated as national critical information infrastructure under the Cyber Security Act 2024, NACSA sets additional requirements, and some services must be bought from licensed providers.

Smaller companies often do not have staff to chase security evidence from a dozen suppliers. A managed IT or cybersecurity provider can run a one-off supplier review and set up a yearly check. Ask for a fixed scope, a sample report, and confirmation of who on their team holds recognised testing or audit certifications.

Related rankings and guides

Sources

Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach — Malay Mail
Cyber Security Act 2024 (Act 854) — National Cyber Security Agency (NACSA)
Department of Personal Data Protection — JPDP Malaysia

Editorial summary written by Best Malaysia Services. Not legal, tax or financial advice; check the original sources.