Helping Start-Ups and SMEs Understand Legal Compliance
So you have completed the first phase of starting up and have jumped through all the start-up hoops such as registration of your company, licensing, funding, dealing with shareholders and investors and setting up your supply chain and customer base. Your startup is now up and running. Congratulations on having come this far.
Now as you progress and start to grow, you will realize that your company will become more visible and you will begin to have more dealings with business partners, employees and third parties. Issues may start to surface (i.e. employment legal issues, partnership/shareholder dispute, contractual matters, compliance with regulations - some of which you have not even heard of) and you may find that from time to time, you will need legal advice. You may look for advice by reading or joining some legal online forums, but such advice found publicly tend to be general and you stand the risk of acting based on incomplete/misguided information, which may in turn land you in deeper trouble. You should always seek out qualified and legitimate legal practitioners if you require legal advice.
In this article, we would like to bring your attention to 5 areas of legal compliance that start-ups and SMEs typically overlook but should take into account to avoid unnecessary costs to your company.
1. Compliance with Employment Law
Companies deal with their employees more than any other parties. As a start-up and SME, it is advisable to have your template employment agreements reviewed by a lawyer for compliance with employment and contract laws. Employment contracts can be tricky especially if you are also hiring employees on a contractual basis or is seconding/assigning your employees to other locations. Probation and termination clauses should ideally be drafted clearly and other important issues, usual terms and those unique to your company be addressed in the employment contract. Unless you have a discussion with your lawyer, you may not be aware that certain practices require the agreement or consent of your employees. Additionally, using a generic template employment agreement that has not been vetted by a lawyer is highly discouraged. In the event that you need to fall back on what has been signed, the employment agreement executed may not adequately protect your interests.
As a start-up or SME with limited resources, even if no liability is owed to the employee, spending time to straighten out disputes can be costly to the company. The company would preferably want to avoid expending costs, which are avoidable in the first place, to compensate an employee. Time spent by your human resource personnel and managers on employment legal disputes could be used for more productive activities.
The following are some employment issues faced by start-ups and SMEs which could be addressed in an employment contract:-
- employees leaving and is in possession of the company’s confidential information;
- employee with confidential information is joining competitor, customer or other third party;
- employing a person only for the duration of a project;
- transfer of employees or secondment of employees to the other location/customer’s location;
- employees inducing other employees to leave/join competitors;
- terminating an employee on probation; and
- ownership of intellectual property; among others.
It is also advisable for all companies to have an Employee Handbook to set out the standards, policies and procedures of the company. The Employee Handbook should also ideally be reviewed for legal compliance by a legal practitioner.
2. Compliance with Personal Data Protection Law
Companies are required to comply with the Personal Data Protection Act 2010 (“PDPA”). The PDPA applies to the processing of personal data in all commercial transactions. Depending on the offence, the penalty for breaching the personal data protection principles as set out under the PDPA can range from a fine of up to RM500,000 and/or imprisonment up to 2/3 years.
It is to be noted that the PDPA makes it mandatory to obtain consent from the data subject (the person you are collecting information on) for the processing of his/her personal data and requires that explicit consent of the data subject be obtained prior to the processing of sensitive data such as health-related data, religious and political belief, etc. This would mean that when your company collects information from job applicants, employees, customers and/or business associates which are personal data, the company should ensure that it is compliant with the PDPA. Briefly, the processing of personal data includes the collection, use and/or retention of personal data.
Additionally, SMEs and start-ups should be aware that certain categories of businesses are required to register themselves with the Personal Data Protection Authority if they belong to certain classes of data users. Classes of data users include licensees and certain businesses as set out in the Personal Data Protection (Class of Data Users) Order 2013 (“2013 Order”). They may include, among others, licensees in communication, postal, banking and financial institutions, insurance, healthcare, tourism and hospitality, air transportation, education, direct selling industries and services companies such as legal, audit, accountancy, engineering or architecture, retail and wholesale dealings, private employment agency, housing developers and utility companies. For details of the 2013 Order, please visit https://www.pdp.gov.my/jpdpv2/akta-709/perundangan-subsidiari/perintah-perlindungan-data-peribadi-golongan-pengguna-data/)
3. Compliance with Competition Law
Competition law is one of the areas of legal compliance which has not been given adequate and due attention by start-ups and SMEs. It is a misconception that only MNCs or GLCs are required to comply with competition law. Competition law in Malaysia applies to all commercial activities, both within and outside Malaysia which have an effect on competition in any market in Malaysia. All entities engaging in commercial activities including start-ups and SMEs are subject to this law. Anyone including the public, your customers, business associates or competitors may lodge a complaint with the Malaysian Competition Commission (“MyCC”) in respect of a suspected infringement of the Competition Act for consideration/investigation by the MyCC.
The following are some recent investigations on SMEs by the MyCC:
| Recent | SMEs | Fines Imposed |
| 2021 | Langkawi Ro-Ro Operators | ~ RM2.2 million |
| 2021 | 7 Warehouse Operators | ~ RM1.0 million |
| 2021 | Dagang Net Technologies Sdn Bhd | ~ RM10 million |
| 2020 | General Insurance Association of Malaysia and its 22 members | ~ RM170 million |
| 2019 | 8 Enterprises involving Procurement of IT Services | Investigated |
| 2018 | 7 Tuition and Daycare Centres fines over RM33,000 | ~ RM33,000 |
| 2016 | Container Depot Operators | ~ RM645,000 |
| 2015 | 24 Ice Manufacturers | ~ RM250,000 |
Source: Malaysian Competition Commission (https://www.mycc.gov.my/case)
Ideally, a company should avoid infringement of competition law and investigation by the authorities. Once a company is subjected to investigations, the company may likely experience disruptions to its business and operations. Resources would have to be channelled to assist in the investigation or to defend the company’s position. Aside from the burden on resources and disruptions to operations, inconvenience and loss of reputation/integrity may also impact the company. Your business partners and customers may lose confidence in your company upon hearing the news that your company is being investigated for competition matters such as price-fixing, cartel practices, bid-rigging, collusion with your business partners, collusion with trade association members or other such competition-related infringements.
Competition law may apply to contracts your company executes such as contracts with suppliers, customers, contractors, partners and/or competitors. It can also apply to verbal discussions, oral communication, agreements, and other business practices carried out by your company or which your company participates in as part of a group or association etc. Start-Ups and SMEs are advised to seek legal assistance to understand their obligations under competition law so that your company and your employees do not inadvertently infringe the law and expose your company to investigations or liabilities under the law.
4. Compliance with Anti-Corruption Law
Malaysian anti-corruption law makes offences such as bribery, false claim and abuse of power illegal in Malaysia. By and large, most people have some understanding of corruption and bribery. Up until recently, only individuals can be liable under anti-corruption laws in Malaysia. However, with the amendment of the Malaysian Anti-Corruption Act 2009 (“MACC Act”) to add in Section 17A for corporate liability, a company and the persons concerned with the management of the company (i.e. directors, top management, managers etc) can be found liable for corrupt acts committed for the benefit of the company by other person(s) related to the organization.
Section 17A states that:-
“A commercial organisation commits an offence if ANY PERSON ASSOCIATED with the commercial the organisation commits a corrupt act in order to obtain business or retain business advantage for the commercial organisation.”
This means that if any person associated with the company (i.e. the directors, partners, your employees (regardless of functions or status), agents, distributors, subsidiaries, 3rd party consultants, etc) commits an act of corruption for the benefit of the company, the directors/top management of the company can be found personally liable. The penalty under Section 17A is a maximum fine of 10 times the sum of gratification involved or RM1 million, whichever is higher; and a maximum jail term of 20 years; or both.
Once the person associated with the company is proven to have committed an act of corruption, the company and its top management will be automatically deemed liable unless the company/he/she has a defence. The burden is placed on the top management to show that the corrupt act was done without their consent/knowledge and that he/she had exercised due diligence to prevent the commission of the offence. The company will need to show that as a commercial organization, it has put in place adequate procedures to prevent the persons associated with the commercial organization from committing the act of corruption.
As such, it is important to obtain advice on what it means to put in place adequate procedures in your SMEs to prevent the occurrence of corruption. Essentially, adequate procedures will entail establishing anti-bribery and corruption policy, programmes and procedures within your SMEs and ensuring that such policy and programmes embody the recommended anti-corruption principles proposed under the Guidelines of Adequate Procedures published by the Prime Ministers Department (https://giacc.jpm.gov.my/garis-panduan-tatacara/)
Please take note that reasons such as "If only we'd known that it would be regarded as a bribe…", "the only way to compete is to pay bribes….”, “that's the way things work here, it's different and it would be bad for business relations to insult local practice..." or “we did not know the person was going to pay a bribe to get the business….” are not acceptable defences. The only defence applicable to Section 17A is that the SMEs has put in place adequate procedure within the company against corruption.
5. Compliance with Website, Internet and E-Commerce Law
Many SMEs may be contemplating entering into the e-commerce space if it has not already done so. The last few years of the pandemic has forced many companies to venture online to stay afloat. Start-ups and SMEs should take note that there are various laws that govern e-commerce in Malaysia such as:-
- Consumer Protection Act 1999;
- Consumer Protection (Electronic Trade Transactions) Regulations 2012 (“2012 Regulation”)
- Electronic Commerce Act 2006;
- Sale of Goods Act 1957;
- Trade Description Act 2011;
- Multimedia and Communication Act 1998;
- other applicable acts such as industry specific acts which may apply to your specific products or business.
For example, a person who operates a business through a website or an online marketplace is required under the 2012 Regulation to display on its site, among others, the registration number of the business or company, if applicable, the e-mail address, telephone number, address, a description of the main characteristics of the goods or services, the full price of the goods or services including transportation costs, taxes and any other costs, the method of payment, the terms and conditions and the estimated time of delivery. The 2012 Regulation also obligates the vendor to provide the appropriate means to enable the purchaser to rectify any errors prior to the confirmation of the order and to provide acknowledge receipt of the order without undue delay.
The Electronic Commerce Act 2006 coupled with the requirements provided for under the Sale of Goods Act 1957 lays down requirements on the formation and the validity of an e-sale contract/online agreement including the applicability of online and e-signatures. There are also various types of agreements online such as browse-wrap, click-wrap or sign-in wraps agreements and if such methods are adequate to satisfy the requirements under the various commercial and e-commerce laws.
SME’s venturing online should also note that the Trade Description Act 2011 prohibits false trade descriptions and false or misleading statements, conduct and practices in relation to the supply of goods and services. The Trade Description Act 2011 sets out what trade description is and what constitutes false and misleading descriptions. It is highly advisable that SMEs engage a legal professional to conduct a legal review of its website, e-commerce store, mobile store or mobile application to ensure compliance with relevant laws
.
Summary
Legal compliance may seem like an imposition to SMEs until legal issues arise and it may be too late for the SME to make the rectification without having to expend funds. Compliance is always preferable compared to remedying the breach, paying a hefty fine or facing the prospect of imprisonment/imprisonment, if the law calls for such sanction.
For further information or inquiries, you may contact Kirsten Toh at kirsten@tohlaws.com or 016-206-8128.