Malaysia Personal Data Protection Act (PDPA) 2010

Why does it matter?

Since the 2024 amendment the Act is a modern accountability law. A controller must appoint a data protection officer (section 12A) and report a personal data breach to the Commissioner as soon as practicable (section 12B); data subjects can ask for their data to be transmitted to another controller (section 43A); processors must meet the Security Principle (section 5(1A)); and breaching a Personal Data Protection Principle carries a fine of up to RM1 million or imprisonment of up to three years, or both (section 5(2)). A business that cannot show its notice, consent records and breach register risks prosecution, not only a warning.

Key benefits include:

• Seven principles with criminal penalties

Section 5 binds every controller to seven principles in sections 6 to 12, and breach is an offence.

• Duties that reach processors

Section 5(1A) and the amended section 9 require processors to apply the Security Principle directly, not only through the controller.

• A named accountable person

Section 12A requires controllers and processors to appoint a data protection officer; the Commissioner's guideline sets the thresholds.

• A defined breach process

Section 12B and the 2025 guideline set a 72-hour notice to the Commissioner and a seven-day notice to data subjects for breaches that cause significant harm.

• Clear transfer rules

Section 129 as amended lets a controller transfer data abroad where the destination has a substantially similar law or adequate protection, or another listed condition applies.

How does it work?

Section 5 requires processing to follow seven Personal Data Protection Principles. The General Principle (section 6) requires consent unless a listed necessity applies, and processing must be for a lawful purpose, necessary and not excessive. The Notice and Choice Principle (section 7) requires a written notice in the national language and English, covering purposes, source, rights, third parties and whether supplying data is obligatory. The Disclosure (8), Security (9), Retention (10), Data Integrity (11) and Access (12) Principles follow.

Data subjects can request access, which the controller must meet within 21 days (sections 30 and 31), correct data (section 34), withdraw consent (section 38), and prevent processing likely to cause damage or distress (section 42) or for direct marketing (section 43). Sensitive personal data, now including biometric data, needs explicit consent or another listed condition (section 40). Controllers in classes specified by Ministerial order register with the Commissioner (sections 13 to 15). Transfers abroad follow section 129 and the Commissioner's cross-border guidelines.

Key Elements

• Personal Data Protection Principles (sections 5 to 12)

General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access, with the amended Security Principle applying to processors.

• Data protection officer (section 12A)

Appointment is notified to the Commissioner; the DPO guideline applies where processing involves over 20,000 data subjects, over 10,000 sensitive data subjects including financial data, or regular and systematic monitoring.

• Data breach notification (section 12B)

Notice to the Commissioner of a breach causing or likely to cause significant harm; the guideline treats over 1,000 affected data subjects as significant scale and requires notice within 72 hours.

• Data portability (section 43A)

A data subject may request transmission of personal data to another controller by electronic written notice, subject to technical feasibility and data format compatibility.

• Sensitive personal data (sections 4 and 40)

Health, political opinions, religious or similar beliefs, alleged offences and, since April 1, 2025, biometric data.

• Cross-border transfer (section 129)

The Minister's whitelist was removed; controllers rely on substantially similar law, adequate protection or listed conditions, and the 2025 guideline describes a transfer impact assessment valid for three years.

What does it cover?

The Act applies to commercial transactions: any person who processes personal data, or has control over or authorizes its processing, in respect of commercial transactions (section 2(1)). It covers a person established in Malaysia and a person not established in Malaysia who uses equipment in Malaysia for processing other than transit, who must nominate a Malaysian representative (section 2(2) and (3)). It excludes the Federal Government and State Governments (section 3(1)) and personal data processed outside Malaysia unless intended to be processed in Malaysia (section 3(2)). A data subject is a living individual after the 2024 amendment, which excludes deceased individuals (section 4).

What are its objectives?

The Act exists to regulate the processing of personal data in commercial transactions and protect the interests of data subjects.

Make controllers process personal data under the seven principles, each enforced by criminal penalties.

Give data subjects access, correction, consent withdrawal, portability and objection rights.

Require accountability through a data protection officer and breach notification to the Commissioner.

Keep personal data secure at controllers and processors alike.

Control cross-border transfers under section 129 and the Commissioner's guidelines.

Framework in Context

The Act covers private-sector commercial processing only, so it sits beside sector rules and codes of practice that the Commissioner registers, for example for banking and financial institutions, insurance and takaful, communications and private hospitals. Since the 2024 amendment it uses controller and processor roles, as the EU GDPR does, but it keeps its own seven principles, requires a written privacy notice in the national language and English (section 7(3)), excludes government bodies and applies only to commercial transactions. The amendments added DPOs, breach notification and portability, features that other privacy laws already had.

Common Framework Mappings

Organizations map the Act to the privacy frameworks below so that one set of notices, records and controls serves the Commissioner and other regulators.

Mapped frameworks include:

APEC PF

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

Singapore PDPA

Thailand Personal Data Protection Act (PDPA)