Adnan Sundra & Low

Syuhaini's main area of practice is data protection and governance, with a special focus in banking & payment services and fintech.

Syuhaini was called to the Malaysian Bar in January 2009 and practised as a litigation lawyer until 2013, before moving in-house. She was with Amanah Ikhtiar Malaysia (Koperasi Amanah Ikhtiar Malaysia Berhad) from 2013 to 2018, where she spearheaded the establishment of its legal department, before joining INTI University & Colleges (Laureate International Education Group) to lead the legal department from 2018 to 2021. She then took on a contract role as Anti-Bribery & Corruption Manager at Genting Berhad in 2021, before joining Fave (Fave Asia Technologies Sdn Bhd) as Legal Manager APAC from November 2021 to February 2025. Since April 2025, she has been Associate Director (Legal) & Data Protection Officer at Touch 'n Go Sdn Bhd.

Syuhaini has advised on a broad range of data protection and governance matters, including compliance with the Personal Data Protection Act 2010 and Bank Negara Malaysia's guidelines, the design and enhancement of privacy policies and monitoring frameworks, and the conduct of Transfer Impact Assessments and Data Protection Impact Assessments. She has also led incident response for data breaches and regulatory inquiries and served as primary liaison with regulatory and data protection authorities. Over the years, she has advised senior leadership and cross-functional stakeholders on integrating privacy into strategic decision-making and has vast experience delivering company-wide privacy training and building a culture of regulatory compliance.

Syuhaini is also experienced in payment services and fintech regulatory matters, having played a key role in a payment services licence application with the Monetary Authority of Singapore, and having advised on laws and guidelines governing payment services and merchant acquisition across multiple markets and legal entities. She holds an MSc in Islamic Finance from the Global University of Islamic Finance (INCEIF) and has vast experience advising on matters at the intersection of data protection, fintech, and Islamic finance.

Syuhaini is a Certified GDPR Provisional Data Protection Officer (PECB) and holds a Certified Information Privacy Manager (CIPM) certification with the IAPP.