In this article 6 sections
“Will my manager know what I say?” For an employee considering EAP, this question may matter more than the number of sessions available. For HR, a provider’s assurance that “everything is confidential” should begin a practical discussion about how information is collected, used and protected.
Malaysia’s 2025 personal-data-protection developments make that discussion especially relevant. The aim is not to turn HR into a clinical-record reviewer. It is to establish clear responsibilities while allowing employees to understand the service they are considering.
What changed, and what should not be assumed?
The Personal Data Protection Department’s DPO registration manual confirms that Data Protection Officer appointment requirements took effect on 1 June 2025. They apply where specified processing criteria are met; not every organisation is required to appoint a DPO. The department also publishes data-breach notification guidance supporting duties under section 12B of the Personal Data Protection Act 2010.
These developments do not mean that every EAP arrangement has the same legal structure, or that appointing a DPO automatically makes a programme compliant. Assess the organisation’s actual processing and applicable obligations. This article focuses on questions HR can use when reviewing a commercial EAP arrangement.
Map the information before discussing the dashboard
Ask the provider to explain the journey from eligibility checks and booking through service delivery, billing and employer reporting. Each stage may need different information and access arrangements. A payment reference does not automatically justify access to what was discussed in a session.
Use a simple working map: what information is collected, why it is needed, who receives it, where it is held and when it is removed or retained. Ask how the employer’s and provider’s data-controller or processor roles are determined for each activity. Do not assume that calling a supplier a “processor” in a contract resolves every part of the relationship.
Include subcontractors and the platforms used for appointments or online sessions in the conversation. If information crosses borders, ask which safeguards and legal assessment support that arrangement. These are due-diligence questions, not a declaration that a particular platform is unlawful.
Agree what employer reports can contain
For programme review, a practical starting point is aggregate information that helps the organisation understand service access without exposing identifiable counselling content. Even aggregate reporting needs care: a category containing one person in a small team may reveal more than its label suggests.
Consider this illustrative request: “Please break down stress-related sessions by department, job title and month.” Combining these fields could make a participant recognisable. Discuss whether broader categories, longer reporting periods or suppression of small groups would better protect privacy. There is no universal safe reporting threshold established by this article.
Agree the reporting format before launch. Managers should know how to seek advice about workplace support without requesting clinical notes or asking the provider to confirm what a particular employee disclosed.
Explain confidentiality accurately to employees
Employee-facing information should answer ordinary questions: Can I contact the provider directly? What will the employer receive? Who can answer a privacy question? How are records retained? What exceptions or disclosures could apply?
Avoid an absolute promise that information can never be disclosed. The provider should explain applicable legal and professional limits, including how serious safety concerns are handled. Information sharing for a particular workplace adjustment should have an appropriate basis and a clear, limited purpose; it should not become routine access to the whole clinical record.
Check that the written privacy information, the contract and the provider’s actual practice tell the same story. A reassuring launch presentation cannot compensate for contradictory forms.
Prepare an incident route before something goes wrong
A misdirected appointment email or an exposed report requires a clear response route. Identify who receives the initial concern, who coordinates containment and assessment, and who determines any regulator or affected-person notification obligations. Use current official requirements and appropriate privacy advice when setting deadlines.
Rehearse a fictional incident without using real employee records. Can the provider and employer reach the right people promptly? Can they explain what happened without circulating the affected information more widely? This exercise tests an operational process; it is not a substitute for a legal assessment.
Build trust through specific answers
Before signing or renewing an EAP arrangement, ask for an employee privacy notice, a sample employer report and a documented responsibility and incident-response process. Assess these together, rather than relying only on a confidentiality statement.
For employee-support planning, explore MY Psychology’s EAP services or the EAP Resource Library. Confirm the precise confidentiality, reporting and service arrangements for the programme your organisation selects.
References and further reading
- Personal Data Protection Department: DPO registration manual (2025)
- Personal Data Protection Department: Data Breach Notification guidelines
Sources checked on 25 October 2026. This article provides general workplace education, not organisation-specific legal advice, clinical assessment or certification of compliance. Scenarios are illustrative; adapt the recommendations to actual arrangements and applicable law.
