How the SME Privacy Index is made

What the Index measures, and what it does not

The Index reports what the public websites of businesses in Singapore and Malaysia, found through public map and search listings, showed on the day they were scanned: whether a consent banner was offered and honored, which tags and vendors loaded before consent, what the privacy notice says, and the overall band the Dxtra Privacy Scanner gave each website under the law it was graded against.

It is a diagnostic indicator, not a legal opinion. It does not state that any business complies, or fails to comply, with any law, and it estimates no penalty. It cannot see anything that is not public, such as registration with a regulator, internal policies or contracts, and it never infers them. No business is named anywhere in the Index.

Who is in the sample

The Index is meant to describe smaller businesses, but it does not measure size. Businesses were found through public map and search listings in seven sectors. Each was then screened on its own homepage, which is the source recorded for it, and kept only if it has a website on its own domain. Government-linked businesses, listed companies and subsidiaries of foreign multinationals were left out where this was stated or plain from the homepage. The Index does not check any business's size against the official definitions of Singapore or Malaysia, and does not describe any individual business as an SME.

The businesses in this Index were not drawn at random from every business in Singapore and Malaysia. They were found through public map and search listings, and each one has a website on its own domain, so the frame favors some businesses and misses others. Businesses that list themselves online and keep a website are over-represented. The smallest operators, businesses without a website and the newest businesses are under-represented. Size was established for very few businesses: where the part of a homepage that was read stated its own scale, such as a headcount or a number of outlets, that statement was recorded, and this applies to fewer than 5 percent of the sites. No business was tested against an official definition of a small or medium-sized enterprise. Sector was assigned from the listing and then checked against what the homepage shows. The results describe the businesses in this frame, not all businesses in either country.

Within each country, businesses were sorted into seven sectors and drawn by a published, reproducible rule: each candidate's position is the SHA-256 hash of a fixed seed, the country and the domain, lowest first. Each country has 1,000 businesses: 143 in each of six named sectors and 142 in Other. A website that could not be reached, refused automated access or was not a business was replaced by the next business in the same country and sector, and the replacements are reported by reason. A scan that failed on our side was retried, never replaced, and is reported separately.

How each website was scanned

Every website was scanned once, as an ordinary free scan, from inside its own country: Singapore websites through a Singapore residential address and Malaysian websites through a Malaysian one, so the scan sees what a local visitor sees. Each scan records the country its connection actually left from. Where that could not be confirmed and nothing on the site placed the business, Dxtra grades the website against no law (“no law established”); those websites are counted and reported, and they are kept out of the band figures.

Of the 2,000 places in the cohort, 1,000 in each country, 1,988 were filled with a measured website: 998 in Singapore and 990 in Malaysia. In three places, two in Singapore and one in Malaysia, a replacement website was measured as well as the website it was drawn to replace, and both are counted, so the figures in this edition rest on 1,991 websites: 1,000 in Singapore and 991 in Malaysia. Twelve places were not filled with a measured website, two in Singapore and ten in Malaysia; four of the ten are in Malaysian e-commerce and retail, where the reserve of replacement sites ran out. In two Singapore places, a reserve website was taken out of rank order; both are kept as measured.

85 of the 2,000 sites in the cohort (4%) could not be measured in the main run because of a failure on Dxtra's side. They were measured in a second pass on October 14, 2026, on a build that differs from the pinned build only in how the browser handles load. No measurement or scoring rule differs between the two builds. Because they were measured later, these sites' results reflect the sites as they stood on that date. Sites were measured on Dxtra's scanner, methodology v1.19.

A tag counts as loading “before consent” when it loaded after the page opened and before the scan's interaction step, in which the scan moves the pointer and scrolls without clicking anything, and before any consent choice. What loads during the interaction step is recorded separately and is not counted in these figures.

Three agents read each website: the Surface Agent reads the public pages, the Browser Agent loads the website in a real browser, chooses Reject All and sends a Global Privacy Control signal, and the Policy AI reads the privacy notice.

How privacy notices were read

Where the only privacy page the scan found belonged to another organization, the site is counted as having no privacy notice found on the site. Examples are the privacy policy of a security or anti-fraud service linked from the site, a regulator's guidance page, a privacy-seal validation page, and a website platform's or app vendor's own policy. A privacy notice link that leads to another website counts as a privacy notice on the site only where the page is the business's own notice (including one hosted on a related domain, an online store, a website platform or a notice generator), or a related company's notice whose text covers the business, by name or as part of a group the notice names. A link to a page that is not a privacy notice counts as no privacy notice on the site. For these reasons, 21 sites are counted as having no privacy notice found on the site: 15 whose only privacy page belonged to another organization, and 6 whose link to another website was reviewed and did not count.

Where the scan did not pick up a date printed in the privacy notice (for example “6th July 2026”, “October 2025”, “As of …”, or the Malay “Berkuatkuasa”), the date was read from the notice's text. Only dates the notice gives as its own, such as an effective or last-updated date, are used. Where it gives more than one, the latest is used. This step was applied to the stored notice text after the scan. In a check of 25 notices the scan had counted as undated, a person found a date in the text of 5; the reading of the text found those 5 dates and no date in the other 20.

The privacy-contact reading and the precision checks were done from an ordinary internet connection in Malaysia, not through a VPN. Some sites may show different content to visitors in other countries.

How a band is decided

The band is the one the scanner showed for the website, under Methodology v1.19. A finding moves the band only when Dxtra's own register of the law links it to a provision of the law Dxtra grades the website against, and each provision counts once. Where nothing is linked, the website carries “No overall band”, which is reported as its own category and never folded into Low. A website Dxtra graded against a law other than Singapore's or Malaysia's is kept out of the band figures and counted separately. In this edition 43 websites are kept out of the band figures: for 33, the scan could not confirm the country its connection left from and nothing on the site placed the business, so Dxtra grades the website against no law; the other 10 were graded against another country's law.

The full rules, in the words of the methodology as it stood: Methodology v1.19.

Which findings count

• Register-backed figures rest on a provision of the law Dxtra grades the website against.
• Observations are what the browser saw, such as a tag that loaded before consent, reported without a legal grade. A finding the register does not grade under Singapore or Malaysian law is reported as an observation and labeled as such.
• Inferred findings, which rest on the scanner's own uncertain reading, are excluded from every figure.
• Agent-coded, checked by a person on a sample: the privacy-contact series, described in the next section.
• Dxtra benchmark priorities are Dxtra's view of good practice, never a legal duty.

How the privacy contact was read

A reading agent read each website's public pages once, against a written checklist. A person then checked a sample: some websites drawn at random, and some the agent was unsure about where the answer decides whether a contact counts. In this edition a person drew 20 of the 1,991 websites and read 19 (one was not opened, for security reasons; it remains in the sample, counted under the rules below). The person agreed with the agent on 14 of the 19, and on 9 of the 10 drawn at random. Every disagreement was a website the agent had counted as offering a contact, and the rules below were tightened as a result.

A website counts as offering a contact where it publishes a named privacy officer, a privacy or data-protection role or mailbox, or a privacy request form, or where its privacy notice itself prints a general mailbox, phone, address or form and offers it for privacy requests or rights. A contact the privacy notice offers only for questions, a privacy notice that names no way to make a request, and general contact details elsewhere on the site do not count. A contact on another website counts only where that website's text covers this business and offers the contact for privacy matters. Where the agent was unsure whether the website offers a contact that counts, the website is counted as not offering one.

Websites the agent counted with confidence as offering a contact were not all re-read, so the share with no privacy contact is more likely to be understated than overstated. One website could not be read and is not counted; the shares are of the remaining 1,990.

The statistics

• Each figure is a share of businesses, with a 95% margin of error. Because the sample was not drawn at random from all businesses, a margin describes how precise a figure is for businesses like those in the sample, not for every business in either country. Where fewer than five businesses fall on either side of a figure, no margin is given, and the figure reads “too few to give a margin”.
• A figure based on fewer than 50 businesses is not published.
• A series whose input is not yet available is marked withheld, never shown as zero.
• Tracker figures leave out websites whose browser pass did not run through a residential address, or whose connection left from another country; every other figure keeps them.
• Findings that test a privacy notice for something it lacks are headline figures only after a person has checked a sample and the measured accuracy reaches the publication gate.

Metric definitions

Limitations

• The frame over-represents businesses that list themselves online and keep a website (see above).
• A website can show different visitors different things. The Index reports what a local visitor's browser saw, on one day.
• In the Malaysian e-commerce and retail sector, a large share of the businesses drawn are furniture retailers, because of how the listings ranked them.
• Size was established for very few businesses, so the Index does not report by business size.

Provenance and changes

Published October 16, 2026. Websites were scanned between October 12 and October 14, 2026; 85 of them were measured in a second pass on October 14, 2026. Revision 1.0.2.

Scanner build 562c60d16dee9e495a660551b28d8a17dfec203c. Methodology v1.19, snapshot SHA-256 8bc9466aa038ad0b3db342f263f29988ad7f4335bd94ca030b0566d832171fa3. Dxtra Regulator Reference v2.0 (Dxtra's own reference, not issued or reviewed by any regulator), register manifest SHA-256 fbb7bc07927f376f28635f4e721b0606f5169672e09bf99c74ac6d8ad6dd2d40. Data pack SHA-256 ef843a9e618b2afc9aa59191863216f25f76666480d3e28b53616deeefc5dc9b.

• 2026-10-14: final pack from run(s) idx-2026q4-full-v119, idx-2026q4-topup-589
• 2026-10-18: Revision 1.0.1: every share and margin is now kept exact and rounded once, half-up, from its count, so some figures move by 0.1 point (none of the headline figures); series labels as agreed (No privacy notice found on the site; No privacy-officer contact on the website; No date found on the privacy notice, now an observation). The counts, sample and method do not change.
• 2026-10-19: Revision 1.0.2: the vendors' stated home countries are published, from a table Counsel checked against each vendor's own privacy notice or terms (14 of the 15 vendors named; Hotjar withheld). "No date found on the privacy notice" now uses the same reading as the age chart: a notice counts as undated where no date was read from it, by the scan or from its text, whatever its language. The counts of every other series do not change.
• 2026-10-19: Display corrections; no count changes. No margin is given where fewer than five businesses fall on either side of a figure. The series on services not named in the privacy notice is labeled "Privacy notice does not name the third-party services seen receiving requests", with a note that it does not count large platforms or consent tools. Capability maturity is described as the privacy practices seen on a website's public pages, with its 71-point ceiling for a website scan and its base of websites where a privacy notice was read. The live-chat series' base is all businesses in the sample. The remainder of the vendor league is labeled "Other vendors (combined)" and is not ranked. A line under the age chart explains why it counts more notices as undated than "No date found on the privacy notice".