Personal Data Protection Act 2010 (PDPA)

· About Personal Data Protection Act 2010 (PDPA)

Key Takeaways

  • Malaysia’s Personal Data Protection Act 2010 (PDPA) applies to processing of personal data in commercial transactions and is enforced by the Personal Data Protection Commissioner under the Ministry of Digital.[1][2]
  • The Personal Data Protection (Amendment) Act 2024 was assented on 9 October 2024 and commenced in phases on 1 January 2025, 1 April 2025, and 1 June 2025 by ministerial notification.[2][5][11]
  • From 1 June 2025, controllers and processors in scope must appoint a Data Protection Officer, notify certain personal data breaches, and provide data portability where required.[1][5][15]
  • From 1 April 2025, the PDPA expanded the security obligation to data processors, widened sensitive personal data to include biometric data, and increased penalties for principle breaches.[5][6][12]
  • The amended cross-border transfer rules now allow transfers only where the destination provides substantially similar protection or an adequate level of protection equivalent to the PDPA.[5][6]
  • Maximum sanctions under the PDPA can reach RM 1,000,000 and/or imprisonment up to 3 years for certain offences, with additional fines and sanctions for non-compliance with registration and related obligations.[5][6]

What It Is

The PDPA is Malaysia’s main private-sector personal data statute for commercial transactions; it governs collection, use, disclosure, storage, retention, and transfer of personal data and is administered by the Personal Data Protection Commissioner.[1][2] The 2024 amendment package modernized the law by adding breach notification, data portability, mandatory DPOs, processor obligations, and updated cross-border transfer rules.[2][5][6]

The amendment law, Act A1727, received royal assent on 9 October 2024.[2] It was then brought into force in stages by Gazette notification: a first phase on 1 January 2025, a second phase on 1 April 2025, and a third phase on 1 June 2025.[5][11][12]

The practical result is that the most significant operational duties are now live, not merely proposed, and organisations that have not updated governance, contracts, incident response, and transfer controls since mid-2025 are out of step with the current law.[1][5][15]

Who Must Comply

The PDPA applies to data controllers—formerly called data users—who process personal data in respect of commercial transactions in Malaysia.[1][5] The amendment also extends the security principle directly to data processors, so vendors that process personal data on behalf of controllers now have express statutory duties.[5][6][12]

The law has extraterritorial practical reach where an overseas entity processes personal data in connection with commercial activities targeting Malaysia or acting for a Malaysian controller, because transfer, processor, and compliance duties can be triggered by the relationship and data flow rather than incorporation alone.[5][6] In practice, multinational groups and cloud/service providers should assume the PDPA can apply where Malaysian personal data is involved.[6][14]

The PDPA contains sectoral and statutory exclusions, but the core practical exemptions are limited and must be checked against the specific processing activity and entity type.[1][2] The amended regime also broadens what counts as sensitive personal data by including biometric data.[5][6]

Core Requirements

  1. Notice and lawful handling: Controllers must give notice and handle personal data in line with the PDPA’s principles, including lawful collection, limitation of purpose, disclosure controls, security safeguards, retention discipline, and data integrity obligations.[1][5]
  2. Data protection governance: Controllers and processors in scope must appoint a Data Protection Officer from 1 June 2025 and maintain accountability structures suitable to the scale and sensitivity of processing.[1][5][15]
  3. Breach notification: Certain personal data breaches must be notified under the new regime effective 1 June 2025, requiring internal detection, escalation, assessment, and external reporting procedures.[1][10][15]
  4. Processor security obligations: From 1 April 2025, processors must take practical steps to protect personal data from loss, misuse, unauthorized or accidental access, disclosure, alteration, or destruction.[5][12]
  5. Cross-border transfers: Transfers outside Malaysia are now tied to an adequacy-style test or substantially similar protection in the destination, replacing the former more permissive structure.[5][6]
  6. Data portability: From 1 June 2025, data subjects gained a right to data portability subject to the statutory framework and operational limits.[5][12]
  7. Registration and sector controls: Certain classes of data controllers remain subject to registration and related administrative rules, with updated commissioner circulars in 2025 and 2026.[1][3][4]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Royal assent | 9 October 2024 | The amendment act was approved and became law, pending commencement by staged notification.[2][11] | | First commencement phase | 1 January 2025 | Ancillary amendments, including administrative and drafting changes, took effect.[5][11][12] | | Second commencement phase | 1 April 2025 | Processor security duties, cross-border transfer changes, sensitive data expansion, and increased penalties took effect.[5][6][12] | | Third commencement phase | 1 June 2025 | DPO appointment, breach notification, and data portability rights took effect.[1][5][15] |

Maximum penalties include fines up to RM 1,000,000 and/or imprisonment up to 3 years for breaches of the personal data protection principles under the amended PDPA.[5][6][12] Other sanctions can include prosecution for specific statutory offences, compliance directives, and administrative consequences tied to registration and operational requirements.[1][3][4]

How to Comply

  1. Map all processing: Build a current record of processing activities covering data categories, purposes, recipients, retention periods, transfers, and processors; align it to PDPA principles and contract chains.
  2. Assign accountability: Appoint a qualified DPO and define escalation paths, reporting lines, incident ownership, and board-level oversight; this maps well to ISO 27001 governance controls and ISO 42001 accountability structures where automated decision systems exist.
  3. Update breach handling: Implement an incident response process with detection, triage, materiality assessment, evidence preservation, notification decisioning, and tested communications; this should align to NIST CSF 2.0 incident response and recovery functions.
  4. Harden vendor management: Amend controller-processor agreements to cover confidentiality, security controls, breach reporting, subprocessing, audit rights, return/deletion, and transfer restrictions.
  5. Review transfer mechanisms: Classify each outbound transfer, test whether the destination offers substantially similar or adequate protection, and document supplementary measures where needed.
  6. Embed privacy by design: Use DPIA-style assessments for high-risk projects, especially biometrics, large-scale monitoring, profiling, and new AI-enabled workflows; map control design to ISO 27001 risk treatment and ISO 42001 AI risk management where applicable.
  7. Train and test: Run periodic training for legal, IT, procurement, HR, and customer support teams, then rehearse breach notifications, access requests, portability requests, and deletion workflows.
  8. Audit and evidence: Keep signed policies, DPO appointment records, training logs, vendor assessments, and transfer analyses ready for inspection or internal audit.

Related Regulations

  • Singapore PDPA: Similar governance and breach-notification concepts make it a useful benchmark for regional operations, but the Malaysian transfer and penalty structure is distinct.
  • EU GDPR: The PDPA now more closely resembles the GDPR on breach notification, DPOs, and portability, but it remains a separate statute with different thresholds and lawful-basis architecture.
  • Thailand PDPA: Overlap is strongest on processor obligations and breach handling, but Malaysia’s amended transfer test and penalty levels differ.
  • Personal Data Protection Act 2004 (Philippines): Useful for regional comparisons on breach notification and accountability, though the legal triggers and regulator powers differ.
  • Malaysia sector rules: Telecommunications, banking, health, and public-sector requirements can overlap with the PDPA and may impose stricter controls or separate retention rules.

FAQ

Does Malaysia’s PDPA apply to companies outside Malaysia?

Yes, if they process personal data in connection with Malaysian commercial activity or act as a processor for a Malaysian controller.[1][6] Cross-border transfers also trigger compliance obligations even when the transferor or transferee is offshore.[5][6]

When did the 2024 amendment take effect?

The amendment received royal assent on 9 October 2024 and was brought into force in three phases on 1 January 2025, 1 April 2025, and 1 June 2025.[2][5][11] The important operational obligations—DPOs, breach notification, and data portability—started on 1 June 2025.[1][5][15]

Do processors now have direct legal duties?

Yes. From 1 April 2025, processors must comply with the security principle and implement practical safeguards for personal data they handle.[5][12] This is a major shift because processor obligations are now expressly embedded in the statute rather than left mainly to contract.[6]

Is biometric data treated as sensitive personal data?

Yes, after the 2025 commencement of the relevant amendment provisions, biometric data is included in the sensitive personal data category.[5][6] That means biometric projects require tighter governance, stronger security, and careful purpose limitation.[5][14]

What is the maximum penalty under the PDPA?

For certain principle breaches, the maximum penalty is RM 1,000,000 and/or imprisonment up to 3 years.[5][6][12] Separate offences can attract additional fines or sanctions depending on the contravention and the specific section engaged.[1][3][4]

Is there any delay to the 2025–2026 rollout?

The current materials indicate the key 2025 commencement dates were already designated and live, and the commissioner’s 2025–2026 circulars show ongoing implementation rather than delay.[1][3][4][5] If any further guidelines remain pending, that affects operational detail, not the fact that the main amendment duties have already commenced.[6][14]

Sources

Put it into practice

More compliance guides