Malaysia Personal Data Protection (Amendment) Act 2024

Amendments phased in during 2025: mandatory data protection officers, 72-hour breach notification to the Commissioner, a right to data portability, direct obligations on processors and higher penalties.

Analysis

The Malaysia Personal Data Protection (Amendment) Act 2024 substantially updates the PDPA by introducing mandatory DPO appointment, 72-hour breach notification, a right to data portability, direct obligations on processors, and higher penalties. The official amendment text and PDP Department materials confirm the staged implementation across 2025, with the regime fully in force by 1 June 2025.https://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-amendment-act-2024/https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdfhttps://www.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appointment-of-data-protection-officer-dpo-and-data-breach-notification/

Key Requirements

• Mandatory Data Protection Officer (DPO) appointment
• The amendment introduces a requirement for covered organizations to appoint a DPO, and the PDP Department issued guidelines and a circular on DPO appointment in May 2025.https://www.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appointment-of-data-protection-officer-dpo-and-data-breach-notification/https://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-guidelines-on-the-appointment-of-data-protection-officer-dpo/
• The DPO role is meant to support compliance, including advising on PDPA obligations, handling incidents, and serving as a contact point for the Commissioner.https://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-guidelines-on-the-appointment-of-data-protection-officer-dpo/https://www.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appointment-of-data-protection-officer-dpo-and-data-breach-notification/

• 72-hour breach notification
• The amended law requires notification to the Commissioner for notifiable personal data breaches, and the official breach-notification form asks whether the submission is within 72 hours after becoming aware of the breach.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/03/PDPC_DBN_Form_BI_07032025.pdfhttps://www.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appointment-of-data-protection-officer-dpo-and-data-breach-notification/
• The Commissioner’s guidance allows phased notification when information is incomplete and expects any delay to be justified and documented.https://www.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appointment-of-data-protection-officer-dpo-and-data-breach-notification/

• Right to data portability
• The amendment creates a new data portability right in Section 43A, allowing a data subject to request transmission of personal data to another controller, subject to technical feasibility and compatibility of the format.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/JPDP-FSB-190824-Data-Portability-PCP-ENG-TC.pdfhttps://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-amendment-act-2024/

• Direct obligations on processors
• The amendment shifts terminology and obligations from the old “data user” model to “data controller” and includes direct responsibilities on data processors.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdfhttps://www.deloitte.com/southeast-asia/en/services/consulting-risk/perspectives/my-pdpa-amendments.html

• Higher penalties
• The reform increases sanctions for non-compliance, and major advisory firms summarize the maximum penalty exposure as increased to RM 1,000,000 for certain offences.https://www.deloitte.com/southeast-asia/en/services/consulting-risk/perspectives/my-pdpa-amendments.htmlhttps://www.pwc.com/my/en/assets/publications/2024/pwc-my-pdpa-bills-key-consideration.pdf

• Cross-border transfer changes
• The amendment changed the cross-border transfer framework, replacing the older whitelist-style approach with a test focused on whether the destination provides a similar level of protection.https://www.deloitte.com/southeast-asia/en/services/consulting-risk/perspectives/my-pdpa-amendments.htmlhttps://www.mayerbrown.com/en/insights/publications/2025/07/from-legislative-reform-to-practical-guidance-key-amendments-to-malaysias-pdpa-and-the-launch-of-cross-border-transfer-guidelines

Compliance Challenges

• Mapping personal data and processing activities
• Organizations often struggle to identify where personal data resides, how it moves, and which systems or vendors touch it, which is foundational to DPO scoping, breach response, and portability requests.https://www.incorp.asia/guides/pdpa-compliance-malaysia-complete-guide/https://www.lhlow.com.my/data-protection-officer-in-malaysia/

• Meeting the 72-hour breach clock
• The practical challenge is discovering, validating, and triaging an incident fast enough to notify within the deadline while still determining scope and impact.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/03/PDPC_DBN_Form_BI_07032025.pdfhttps://www.shearndelamore.com/whats-new/publications/pdpa-malaysia-compliance-guide/
• Case-based commentary on the new process notes that phased notifications and delay justifications must be prepared in advance, or organizations risk late filings.https://www.cms.law/en/sgp/legal-updates/new-guidelines-on-mandatory-breach-notifications-under-malaysia-s-personal-data-protection-act-2010https://www.shearndelamore.com/whats-new/publications/pdpa-malaysia-compliance-guide/

• Operationalizing DPO independence
• A DPO must have enough authority, access, and support to function effectively, but many organizations lack clear reporting lines or sufficient staffing.https://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-guidelines-on-the-appointment-of-data-protection-officer-dpo/https://www.lhlow.com.my/data-protection-officer-in-malaysia/
• Industry commentary recommends internal liaisons across legal, IT, HR, and security to avoid a “paper DPO” with no practical control.https://lpplaw.my/insights/e-articles/dpo-malaysia-faq/https://www.deloitte.com/southeast-asia/en/services/consulting/perspectives/my-pdpa-dpo.html

• Vendor and processor contracting
• Because processors now carry direct obligations, organizations need updated data processing agreements, incident clauses, audit rights, and subprocessor controls.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdfhttps://www.deloitte.com/southeast-asia/en/services/consulting-risk/perspectives/my-pdpa-amendments.html

• Handling data portability requests
• Organizations need exportable data formats, identity verification steps, and response workflows; otherwise, they may fail the technical-feasibility test or miss prescribed timelines.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/JPDP-FSB-190824-Data-Portability-PCP-ENG-TC.pdfhttps://www.rsisinternational.org/journals/ijriss/articles/recent-reforms-to-the-personal-data-protection-act-2010-and-its-implications-for-business-organisations-in-malaysia/

Implementation Best Practices

• Perform a data inventory and flow map
• Build and maintain a register of systems, datasets, vendors, and cross-border transfers so you can identify DPO scope, breach pathways, and portability dependencies.https://www.incorp.asia/guides/pdpa-compliance-malaysia-complete-guide/https://www.lhlow.com.my/data-protection-officer-in-malaysia/

• Formalize the DPO charter
• Define reporting lines, authority, conflict-of-interest controls, and service levels for internal or outsourced DPO models.https://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-guidelines-on-the-appointment-of-data-protection-officer-dpo/https://lpplaw.my/insights/e-articles/dpo-malaysia-faq/

• Implement a breach-response runbook
• Pre-build intake forms, escalation trees, legal review, forensic preservation, regulator notification drafts, and customer communications to meet the 72-hour deadline.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/03/PDPC_DBN_Form_BI_07032025.pdfhttps://www.cms.law/en/sgp/legal-updates/new-guidelines-on-mandatory-breach-notifications-under-malaysia-s-personal-data-protection-act-2010

• Update contracts and vendor oversight
• Add processor obligations, security requirements, breach-reporting windows, and audit rights into DPAs and procurement templates.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdfhttps://www.deloitte.com/southeast-asia/en/services/consulting-risk/perspectives/my-pdpa-amendments.html

• Design portability workflows now
• Define request intake, eligibility checks, extraction formats, and secure transmission procedures for controller-to-controller transfers.https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/JPDP-FSB-190824-Data-Portability-PCP-ENG-TC.pdfhttps://www.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-amendment-act-2024/

• Use recognized frameworks and tools
• Align the program to ISO/IEC 27001 for security controls and NIST incident-response practices, while using official PDP Department forms and guidelines for Malaysia-specific compliance.https://www.iso.org/isoiec-27001-information-security.htmlhttps://csrc.nist.gov/pubs/sp/800/61/r2/finalhttps://www.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appointment-of-data-protection-officer-dpo-and-data-breach-notification/

Recent Updates

• 10 October 2024 / 17 October 2024
• The amendment received Royal Assent on **9

Recent developments

• 2026-09-01 — A compliance guide updated in early September 2026 says organizations now face a 72-hour breach notification obligation and must notify affected individuals as soon as practicable. It also reiterates the RM1 million penalty ceiling and expanded compliance duties. (source)
• 2026-08-27 — A 2026 compliance update says the Personal Data Protection (Amendment) Act 2024 is now fully rolled out, with no remaining grace periods. It highlights mandatory breach notification, higher penalties, processor liability, biometric data classification, and a risk-based cross-border transfer framework. (source)
• 2026-08-26 — Baker McKenzie reports that Malaysia’s Personal Data Protection Commissioner has issued new guidelines following 2025 consultations. The guidelines cover Data Protection Impact Assessments and Data Protection by Design, signaling continuing regulatory implementation of the amendment package. (source)
• 2026-08-20 — The 2026 Malaysia privacy guide repeats that the amended Section 129 took effect on 1 April 2025. It emphasizes the shift to an adequacy-style approach for overseas transfers. (source)
• 2026-08-18 — Chambers’ 2026 trends analysis says Section 129 was amended by the Act and came into effect on 1 April 2025. It also notes the removal of the prior cross-border transfer whitelist and the ministerial public-interest exception. (source)
• 2026-08-13 — A 2026 overview says the amendment introduced mandatory DPO appointments, a new transfer assessment approach, and fines up to RM1 million. It presents the changes as part of a broader move toward GDPR-like standards. (source)
• 2026-08-12 — The official PDPA site confirms the Act’s commencement is by ministerial notification in the Gazette and that different provisions may start on different dates. The page was updated in August 2026, indicating the regulator continues maintaining the Act’s official record. (source)
• 2026-08-09 — The official text of Act A1727 identifies the law as the Personal Data Protection (Amendment) Act 2024 and states it comes into operation on dates appointed by the Minister. This remains the authoritative source for the enacted amendments. (source)
• 2026-08-04 — A legal update notes the Act was enforced in three phases, with the final phase scheduled for July 1, 2025. The piece frames the amendment as a major modernization of Malaysia’s privacy regime. (source)
• 2026-08-04 — A legal analysis summarizes the Act’s key effects as stronger penalties and phased implementation beginning after the 2024 ministerial commencement announcements. It reflects the continuing industry focus on compliance readiness and operational impact. (source)

Related regulations

• Personal Data Protection Act 2010 (PDPA) — Malaysia, Active
• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
• Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
• New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01

Put it into practice

• Generate the policy: Malaysia PDPA policy generator (generatepolicy.com)
• Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
• Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates