Category 4 investment firms must ensure that the outsourcing arrangement is in compliance with the Personal Data Protection Law (PDPL) and the outsourcing provider implements adequate safeguards and procedures to protect client data confidentiality. Category 4 investment firms must ensure that they retain title under any outsourcing agreements for data, information and records that form part of the prudential records of the licensee.