How to choose a learning platform in Malaysia

Before choosing a learning platform, check eight things: the language each person sees, how the price is counted, what parents or managers receive, how levels are set, who receives the fees, where the data goes and how you leave, who checks the AI, and whether it works on a phone. The list fits a tuition centre, a school, a corporate training team and a certification body alike. Ask each vendor to show you every answer on screen, not in a brochure.

Does every person get their own language?

Staff, learners and parents or managers in one organisation rarely share a language. Check that each person chooses Bahasa Melayu, English or Chinese for themselves, and that reports and emails follow that choice. Ask whether what your teachers write is ever machine-translated: a translated question nobody has read can change its meaning mid-test.

Section 7(3) of the Personal Data Protection Act 2010 (PDPA) requires the written notice about personal data to be in the national and English languages, so the privacy notice and consent screens should be in both.

How is the price counted, and what happens when numbers drop?

Ask who counts as a billable learner: everyone enrolled, everyone who signed in, or everyone with an active subscription that month. Ask whether a learner in two programmes counts once or twice, what the monthly minimum is, whether there are setup or per-branch fees, and whether SST is included. Numbers fall after exams, in school holidays and when a cohort finishes: a monthly count lets the bill fall with them; an annual seat commitment does not.

What do parents or managers receive?

A parent wants to know how their child is doing; a manager wants to know who has finished required training. Ask to see a real report: what it contains, such as level, strengths and weaknesses, how often it goes out, in which language, and whether a teacher comments first. For corporate training, check that the completion record can be exported.

For learners under 18, regulation 3(3) of the Personal Data Protection Regulations 2013 requires consent from a parent, guardian or person with parental responsibility, and regulation 3(1) requires consent in a form that can be recorded and kept. Ask how the platform records who consented, to which version of the notice, and when.

How does it place learners and set levels?

Look for a placement test at the start and a written rule for moving up, such as a pass mark for each level. A good test: can a teacher explain a learner’s level to a parent or manager in one sentence? Check that a teacher or trainer can change a level by hand, with the change recorded. A certification body will also want employers able to check a certificate.

Who receives the money that families or sponsors pay?

Some platforms collect fees for you and pay you later, less a percentage. Others let payers pay straight into your organisation’s own account. Ask whose account the money lands in, what fees apply, and whether staff can still record cash and transfers. Card details should be typed only on a payment provider’s own page. A school or company that bills its own way should be able to switch billing off.

Where is the data kept, and what happens when you leave?

The PDPA applies to personal data processed in commercial transactions (section 2) and not to the Federal and State Governments (section 3). Where it applies, your organisation is the data controller, the 2024 amendment’s name for the data user, and a platform that processes data solely on your behalf is a data processor. Since 1 April 2025, under the commencement order, a data processor must itself comply with the Security Principle. You stay responsible, so ask four questions.

Where does the data go? Ask for every country where data is stored or processed, including media, payments and AI. The amended section 129 allows a transfer outside Malaysia where the destination has a law substantially similar to the PDPA or an adequate level of protection, or where another condition such as consent applies. The Commissioner’s cross-border transfer guideline describes a transfer impact assessment you may carry out.

How fast will you hear about a breach? Since 1 June 2025, a data controller must notify the Commissioner of a personal data breach as soon as practicable (section 12B). The Commissioner’s breach notification guideline asks for that notice within 72 hours, and says a controller should require its processors, by contract, to tell it of a breach promptly.

Does the vendor use the data for itself? If learner data is used for the vendor’s own purposes, such as training AI models, ask whether that rests on a separate consent people can refuse.

How do you leave? Ask in what format you can export everything, and for how long after the contract ends. The Retention Principle (section 10) says personal data must not be kept longer than necessary and must then be destroyed or permanently deleted: ask when the vendor deletes it. Since 1 June 2025, a person can also ask you to send their data to another controller, subject to technical feasibility (section 43A), so check that one person’s data can be exported.

How is AI used, and who checks it?

AI may draft questions, mark written answers, write report text or set levels. For each, ask who checks it before a learner sees it, whether the AI’s original is kept beside the teacher’s correction, what learner data reaches an AI model provider and where, and whether the feature can be switched off.

The Personal Data Protection Department’s guideline on automated decision-making and profiling, issued on 30 April 2026, gives a decision affecting a person’s access to education, such as university admission, as an example of a significant effect. Among the good practices it lists for AI in such decisions: AI should not be the only factor in a decision about a person, and trained staff can be appointed to review its use.

Does it work on a phone?

The Department of Statistics Malaysia reports that mobile phone use by individuals reached 99.6 per cent in 2025. Test every role on a phone, not only the learner’s: a teacher taking attendance, a parent reading a report and paying, an administrator searching a long list. Do it in each language: longer labels are where text overflows.

A checklist for each demo

• Each person picks a language; the privacy notice is in Bahasa Melayu and English.
• Who is billable, the minimum and the notice period.
• A real report, and who checks it.
• The written rule for levels.
• Whose account receives payments.
• Where data goes, breach notice, export and deletion.
• What AI does, and who checks it.
• Every role on a phone, in each language.

How AI Teacher answers these

Every screen is in Bahasa Melayu, English and Chinese, each person chooses their own, and what a teacher writes is never machine-translated. The price is per billable learner per month, counted once however many programmes they take, with a monthly minimum, and a learner whose subscription has ended is not billed from the following month. A placement test sets the level and AI never decides one (how it works); by default, every AI draft waits for a teacher to publish it. A monthly report is released once the teacher has written its comment. Families pay your organisation directly, and AI Teacher takes no cut. The database and application servers are in Singapore, erasure requests and data export are on every plan, and after the plan ends your data can be exported for 90 days. Every learner, guardian and teacher screen works on a phone. The details are on the pricing page.

This article is general information, not legal advice.