SIRIM Smart Switch Malaysia: ST and PDPA Compliance Checklist
A sirim smart switch malaysia compliance guide — what to check before buying mains-powered gear, who may do the wiring under Act 447, and where PDPA applies.
Commercial & property
Commercial Access Control for Smart Buildings in Malaysia: Doors and After-Hours Cost
Answer up front — Automate the main entrance, the gates and the doors that are genuinely the building's, and leave the rest alone. After-hours lighting and aircon is a real recurring cost that presence-based control addresses directly. On CCTV and access-control integration, some manufacturers publish open API documentation and much consumer equipment does not — verify with the manufacturer, and never accept a claim of an official integration you have not seen documented.
Which doors, and what not to weaken
| Door type | What automation is for | What must not change | Watch out for |
|---|---|---|---|
| Main entrance / lobby | Credential issue, visitor log, door release, after-hours locking schedule | The door's agreed behaviour on power loss and fire alarm, as set by the fire safety design | The door people will tailgate. A reader alone does not stop that |
| Vehicle gates and barriers | Boom barrier control, credential or plate, safe interlock | The safety edge and the vehicle loop | Interlocking with the barrier's own safety devices |
| Loading bay / back of house | Scheduled release, occupancy sensing to stop a truck being trapped | Emergency egress | Shutter and door interlocks — a truck stuck between two is a real incident |
| Fire stairs and escape routes | Nothing. No locking, no automation, no scenes. | Free egress at all times, including power failure | A smart lock on an escape route is a compliance conversation you do not need |
| Tenant suite entrance | The tenant's own decision and their own system, in almost every case | Landlord access for inspection and emergency, which belongs in the lease | The consent issues in who actually pays |
Three failure modes to design against. Power loss — what is the door's default state, and is that state safe? Tailgating — a reader on a door that swings open is access control in name only. And alarm — a door released by a fire alarm is a life-safety system belonging to the fire safety design, not the automation vendor. If a vendor proposes a smart lock on a fire escape stair, that is the moment to end the evaluation.
After-hours operation: the real money, the boring mechanism
A twenty-floor office with one person working on level 14 is a common Tuesday night. In most buildings the lighting and aircon for the whole floor stay on, because the schedule says so and nobody can tell the building is otherwise empty. That is a genuine recurring cost, and it is the argument for presence-based control that survives harder scrutiny than most energy claims. The mechanism is unglamorous: someone is in the space, so the space runs. Nobody is in the space, so it does not.
The distinction that matters is motion versus presence. A meeting room where people sit still for twenty minutes is not motion, and a motion sensor there will switch the lights off on a live call — which is how the technology earns its reputation for being unreliable. The Aqara Presence Multi-Sensor FP300 is a wireless 5-in-1 presence sensor — it detects presence rather than movement, the correct instrument for a desk, meeting room or waiting area. The Motion Sensor P1 does the ordinary movement-detection job in a corridor or lobby, which is where it belongs.
The operating discipline that makes it work, and where implementations fail:
- Agree what "after hours" means per space. Not one global schedule. A car park needs light all night; a corridor can go dark; a server room never changes.
- Set a floor, not a switch, and set a maximum run time. A light that goes off entirely is a complaint generator; one that dims when the space empties is usually accepted and still cuts the load. If a space has been empty for two hours, put it to a defined state regardless of what the sensor thinks — that is what stops a stuck sensor becoming a permanent cost.
- Do not let it fight the cleaners. Back-of-house areas worked at night are not empty, and a schedule that assumes they are makes the building dark when it is busy. Use role-based schedules, not time-based ones.
Sizing this from your own baseline rather than from someone's percentage is covered in building a smart building business case.
Integrating with an existing access control and CCTV estate
The honest position, as at September 2026. We checked. Some manufacturers do publish open API or SDK documentation for parts of their range: Hikvision publishes an ISAPI developer portal and integration centre, Dahua operates a public API interface portal, Uniview publishes NVR API documentation, and TP-Link documents an OpenAPI for its VIGI NVR range. Those are real, checkable, vendor-owned developer resources.
What that does not mean: not every model in those ranges is covered (enterprise and professional lines are documented; much consumer-grade equipment sold in small kits is not, and support levels differ by model and region); the API is not necessarily stable, free, or supported in a way that suits a ten-year building asset; and there is no official Aqara API or verified integration partnership with any of these brands. We found no such thing, we are not claiming one, and if another vendor tells you there is one, ask to see the documentation.
So, practically: ask the manufacturer, not the reseller and not the automation vendor, and get the API or SDK documentation for the exact model numbers you own, in writing. If it does not exist for your model, that is the answer. Check the commercial terms too — licence, cost, support, and what happens on a firmware update. Where there is no API, use the techniques that do not need one:
| Technique | Needs an API? | What it is | Limitation to document |
|---|---|---|---|
| Relay-triggered event | No | Your system closes a contact, or receives one, and drives a defined action | Simple handshake only. It knows that something happened, not who or what |
| Dry contact / GPIO on the controller | No | Many controllers have a physical output for a door released or a request granted | Vendor-specific wiring. Check it exists on your model |
| Shared schedule or holiday calendar | No | Both systems follow one maintained calendar | Manual sync, and it drifts |
| Full API integration | Yes | Both systems exchange events and identities | Only where a supported, licensed API exists for the model |
Document what does not integrate. A one-page known-limitations sheet, given to your security team, prevents the night spent trying to make something work that was never going to. And keep the framing straight: an access control or CCTV system is a security system with compliance obligations. The smart layer is good at presence detection, occupancy, lighting and after-hours control; it is rarely the right place to put your door credentials or your video retention.
The compliance dimension: PDPA in a workplace
This part needs care, and your own compliance sign-off. It is a different discipline from the electrical and access work.
This article is general information, not legal advice. PDPA amendment commencement dates and penalties are set by gazette. Confirm current details with the Personal Data Protection Department (pdp.gov.my) or your legal adviser.
What is established. The Personal Data Protection Act 2010 (Act 709) regulates the collection, use and safeguarding of personal data in Malaysia in commercial activity. It has been amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), which comes into operation on dates appointed by gazette notification, with different dates able to be appointed for different provisions.
What we will not guess at. The commencement dates for each phase, transitional arrangements, penalty levels, and the precise scope of the amended Act as it applies to workplace cameras, employee monitoring and occupancy analytics in a commercial building. Those sit in the gazetted notification and subsidiary instruments, and getting them wrong in a published article would be worse than saying nothing. Take advice on the current position before you install anything that records or profiles people at work.
What we will say, because it is a design point rather than a legal claim: a device that counts people is a different proposition from a device that detects motion. Occupancy counting and analytics can create records about identifiable people in your workplace — where they were, when, how often. So decide, in advance, what the data is for and what it is not for ("we switch the lights off" is a different justification from "we track attendance"); who can see it and at what granularity (an aggregated floor count is a different item from a per-person log); and how long it is kept. Publish the fact, because staff notice cameras but notice less about sensors. Put the camera and occupancy questions in the same sign-off as the access control, not in a workstream that happens later.
The electrical and product side — SIRIM labels, Energy Commission approval, and who may legally do the work — is in SIRIM, Suruhanjaya Tenaga and PDPA compliance. For the estate and account side, see integrating Aqara into condo property management.
One commercial point to settle before you sign: an access control system only the original integrator can open is a building security problem. Get in writing who holds the credential database, who holds the admin account, and what the fallback is if the automation layer stops and the door still has to open that day. Escape routes must open in a power cut; everything above that is a convenience. Asset records and firmware discipline are in rolling out smart devices at scale.
