Malaysia's Personal Data Protection Act 2010 changed from a principles-only regime into one with mandatory breach notification, mandatory data protection officers and direct security duties on processors when the Personal Data Protection (Amendment) Act 2024 came fully into operation on 1 June 2025. The Personal Data Protection Commissioner has since issued guidelines that set hard numbers: 72 hours to notify the Commissioner, 7 days to notify data subjects, a DPO at 20,000 data subjects, and transfer impact assessments valid for three years. This guide covers scope, the seven principles and the new duties, the phased commencement, penalties and enforcement, and what the amended Act means for AI agents and machine credentials. It is written for security, privacy and engineering leads at organisations processing personal data in Malaysia in commercial transactions.
Key takeaways
- Processors now carry the Security Principle directly: since 1 April 2025 a data processor that fails to take practical steps to protect personal data under section 9 faces the same criminal penalty as a controller, up to RM1,000,000 and three years' imprisonment.
- Breach notification is a two-step clock: notify the Commissioner as soon as practicable and within 72 hours where the breach causes or is likely to cause significant harm or affects more than 1,000 data subjects, then notify affected individuals within 7 days of that notice where significant harm is likely.
- A DPO is required at modest scale: more than 20,000 data subjects, more than 10,000 for sensitive or financial data, or regular and systematic monitoring, for controllers and processors alike, registered with the Commissioner within 21 days.
- The whitelist is gone: cross-border transfers now rest on section 129 tests, documented in a transfer impact assessment under the April 2025 guideline.
- AI is in the 2026 guidance: the April 2026 DPIA and automated decision-making guidelines treat AI-driven features as a high-risk factor and say AI should not be the sole basis for decisions about a data subject.
Scope: who and what is covered
The PDPA (Act 709) applies to personal data processed in respect of commercial transactions by a person established in Malaysia, or by a person not established in Malaysia who uses equipment in Malaysia for processing other than for transit. The Federal and State Governments are outside the Act. The 2024 amendments changed the vocabulary and the reach without changing that basic scope.
| Element | Position after the 2024 amendments | Change |
|---|---|---|
| Data controller | The person who processes or controls processing; replaces "data user" | Terminology, 1 April 2025 |
| Data processor | Processes solely on the controller's behalf; now directly bound by the Security Principle | New direct duty, 1 April 2025 |
| Sensitive personal data | Physical or mental health, political opinions, religious or similar beliefs, offences, and now biometric data | Biometric added, 1 April 2025 |
| Personal data breach | Newly defined term underpinning notification | New, 1 April 2025 |
| Deceased persons | Personal data of deceased individuals excluded | New exclusion, 1 April 2025 |
| Registration | Listed classes of controllers must register with the Commissioner | Unchanged |
Malaysia's sectoral rules still apply alongside the PDPA. Banks, for example, face the secrecy provision in section 133 of the Financial Services Act 2013, with penalties up to RM10 million.
Key obligations
The seven principles
| Principle | Section | What it means for security and engineering teams |
|---|---|---|
| General | s6 | Consent (explicit for sensitive data) or another listed ground; data adequate and not excessive |
| Notice and Choice | s7 | Written notice in Bahasa Malaysia and English; disclose automated decision-making and AI use under the 2026 guidance |
| Disclosure | s8 | No disclosure for other purposes or to other parties without consent, subject to exceptions |
| Security | s9 | Practical steps to protect data from loss, misuse, modification, unauthorised access or disclosure; now binds processors |
| Retention | s10 | Keep only as long as needed, then destroy or permanently delete |
| Data Integrity | s11 | Reasonable steps to keep data accurate, complete and up to date |
| Access | s12 | Data subjects can access and correct their data |
The Personal Data Protection Standard, issued in December 2015, sets minimum standards for security, retention and data integrity, including binding processors by contract; a revised Standard was at consultation stage at the time of writing. Compliance with the Security Principle is assessed against it, so treat it as the baseline control set and map it to your framework.
Data protection officers (section 12A)
- Triggers: processing personal data of more than 20,000 data subjects, sensitive personal data including financial information of more than 10,000, or regular and systematic monitoring such as CCTV, connected devices or profiling for behavioural advertising. The duty applies to controllers and processors.
- Who: an employee or an outsourced provider (a company provider must name the individual); part-time is allowed, other roles are allowed without conflict of interest; one DPO may serve several organisations if easily reachable.
- Competence: knowledge of the PDPA, the business, IT and data security, and governance; proficiency in Malay and English; resident in Malaysia (at least 180 days a year) or easily contactable. Separate DPO competency and training guidelines followed in July 2025.
- Registration: the controller registers the DPO through daftar.pdp.gov.my within 21 days of appointment and registers changes within 14 days, publishes business contact details, and runs a dedicated, monitored DPO mailbox.
- Liability stays put: appointing a DPO does not shift PDPA liability from the organisation.
Data breach notification (section 12B)
| Step | Requirement | Deadline |
|---|---|---|
| Preliminary investigation | Assess the security incident to establish whether a personal data breach has occurred | Immediately on becoming aware |
| Notify the Commissioner | Where the breach causes or is likely to cause significant harm, or is of significant scale (more than 1,000 data subjects); prescribed form, by email to [email protected] or hard copy | As soon as practicable, within 72 hours; full details within 30 days of the first notice |
| Late notice | Written reasons and evidence: incident timeline, internal communications, technical or external factors | With the late notice |
| Notify data subjects | Where significant harm is likely; individual and direct where practicable, clear language, separate from routine messages | Without unnecessary delay, within 7 days of notifying the Commissioner |
| Breach register | All breaches, including those below the thresholds, with root cause, systems, data types, counts, chronology and reasons for not notifying | Kept at least 2 years |
Significant harm means physical harm, financial loss, a negative effect on credit records, damage to or loss of property, misuse for illegal purposes, compromise of sensitive data, or a combination of data enabling identity fraud. Controllers must also contractually require processors to notify them promptly and assist, maintain breach management and response plans, and run periodic training and simulation exercises. See the Breach Notification Laws by Country Guide.
Data portability (section 43A)
From 1 June 2025 data subjects can ask a controller to transmit their personal data directly to another controller of their choice, subject to technical feasibility and format compatibility. A consultation paper on portability preceded the amendments, but practitioner reporting in 2026 said controllers were still waiting for the final portability guideline. Build a structured export that can serve both access and portability requests, and check pdp.gov.my for the guideline's status.
Cross-border transfers (section 129)
The amendments removed the Minister's whitelist. Transfers are permitted to a place with law substantially similar to the PDPA or an equivalent level of protection (section 129(2)), or under an exception in section 129(3), such as consent, performance of a contract, or vital interests. The Cross Border Personal Data Transfer Guidelines issued on 29 April 2025 expect a transfer impact assessment for the section 129(2) route, valid for up to three years and refreshed after significant legal change in the destination, and recognise binding corporate rules, contractual clauses (the ASEAN Model Contractual Clauses and EU standard contractual clauses are given as examples) and certifications such as APEC CBPR and PRP. See the International Data Transfers Map and the Standard Contractual Clauses (SCCs) Guide.
Timeline and current status
| Date | Event | Status |
|---|---|---|
| 15 November 2013 | PDPA 2010 in force | In force |
| December 2015 | Personal Data Protection Standard 2015 issued | In force; revision consulted on |
| 16 and 31 July 2024 | Amendment Bill passed by the Dewan Rakyat and Dewan Negara | Enacted |
| 1 January 2025 | Phase 1: electronic service of notices (administrative) | In operation |
| 25 February 2025 | DPO Appointment and Data Breach Notification guidelines issued | In effect |
| 1 April 2025 | Phase 2: data controller term, biometric data, breach definition, processor security duty, higher penalties, whitelist removed | In operation |
| 29 April 2025 | Cross Border Personal Data Transfer Guidelines issued | In effect |
| 1 June 2025 | Phase 3: DPO (s12A), breach notification (s12B), portability (s43A) | In operation |
| 21 July 2025 | DPO competency and training guidelines | In effect |
| 30 April 2026 | DPIA, Automated Decision Making and Profiling, and Data Protection by Design guidelines | Issued; DPbD stated as voluntary |
| Pending | Data portability guideline; amended PDP Regulations 2013; revised PDP Standard | Not confirmed as issued |
Enforcement and penalties
| Offence | Maximum penalty |
|---|---|
| Contravening a personal data protection principle (ss6-12), controllers and, for s9, processors | RM1,000,000 and/or 3 years' imprisonment (previously RM300,000 and 2 years) |
| Failing to notify the Commissioner of a breach (s12B) | RM250,000 and/or 2 years' imprisonment |
| Failing to comply with an enforcement notice | RM200,000 and/or 2 years' imprisonment |
| Banking secrecy breach (Financial Services Act 2013, s133) | RM10 million and/or 5 years' imprisonment |
PDPA penalties are criminal, and enforcement has historically used compounds and prosecutions rather than administrative fines. Practitioner reporting counts 33 data controllers paying compounds between 2017 and 2025, eight cases taken to court, and a highest public compound of RM108,000 for breaches of the General, Disclosure and Retention Principles. The Commissioner can also investigate and require breach records and reports. The new processor liability and the breach register mean an investigation now reaches the supplier as well as the controller.
What it means for AI agents and non-human identities
The Security Principle asks for practical steps against unauthorised access, and the breach register asks for affected systems and root cause. Both fail if the access that matters belongs to service accounts, API keys and AI agents no one owns.
- Processors with agents are directly liable: an AI or automation vendor processing client data is a processor bound by section 9. Its agents' credentials, scopes and logs are part of its own security duty, not only the client's.
- AI triggers a DPIA: the 2026 DPIA guideline lists innovative technologies, including AI-driven features, among the qualitative high-risk factors the DPO assesses. See the DPIA Guide.
- Automated decisions need disclosure and people: the ADMP guideline asks for privacy notices that describe automated decisions and AI scope, trained staff to review AI use, and no decisions based solely on AI. See the Human-in-the-Loop for AI Agents Guide.
- Sensitive data and agents: for automated processing of sensitive data the guidance recommends encryption, pseudonymisation and stricter access controls. Scope agent permissions to the minimum data set. See the AI Agent Authorisation Guide.
- Leaked machine credentials are breaches: an exposed API key with read access to a customer table is a security incident that needs the 72-hour assessment, and the register must name the system. Inventory and rotate keys. See the Service Account Security Guide.
Compliance steps
Framework mapping
| PDPA requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal obligations and principles | GV.OC-03 | PT-2, PT-3 | A.5.31, A.5.34 |
| Security Principle (s9): access | PR.AA-05 | AC-6, IA-5 | A.5.15, A.5.18, A.8.2 |
| Security Principle (s9): data protection and logging | PR.DS-01 | AU-2 | A.8.15, A.8.24 |
| Breach notification (s12B) | RS.CO-02, RS.CO-03 | IR-6 | A.5.24, A.5.26 |
| Processor contracts and duties | GV.SC-05 | SA-9, SR-3 | A.5.19, A.5.20 |
| Retention (s10) and data inventory | ID.AM-07 | SI-12 | A.5.33, A.8.10 |
| DPIA and ADMP guidelines | GV.OC-03 | RA-8 | A.5.34 |
Phased rollout
- Thresholds first (weeks 1 to 3): count data subjects per controller and processor entity, including sensitive and financial data, and decide on the DPO. Register the DPO within 21 days and set up the dedicated mailbox.
- Processor position (weeks 2 to 6): if you act as a processor, treat section 9 as your own duty: document your security measures against the PDP Standard and your customers' contracts. If you are a controller, add prompt breach notice and assistance terms to every processor contract.
- Breach process (month 2): write the preliminary investigation, harm and scale tests, Commissioner notice, 7-day data subject notice and register into the incident response plan; pre-fill the prescribed form fields. See the Incident Response Plan Template.
- Test (month 3): run a simulation exercise, which the guideline expects, using a processor-caused breach and a leaked API key, and measure the time to a notification decision.
- Transfers (months 3 to 5): complete transfer impact assessments for each destination relying on section 129(2), diarise the three-year review, and record the mechanism for the rest.
- AI and DPIA (month 4 onwards): screen projects against the 2026 DPIA thresholds, update privacy notices for automated decisions, and keep the last approved control baseline so a change that weakens a control can be rolled back.
Decision guidance
- Small organisations: below the DPO thresholds and without systematic monitoring, a DPO is not required, but the Security Principle, breach notification and the breach register still apply.
- Outsourced or in-house DPO: outsourcing suits organisations just over the threshold; in-house suits those with heavy monitoring or sensitive data where the DPO must join design reviews early.
- Transfer mechanism: a transfer impact assessment suits stable destinations; contractual clauses or binding corporate rules suit high-volume or group flows; consent suits only occasional, individual transfers.
- Regional programmes: align the Malaysian 72-hour step with Thailand's and the GDPR's, but keep the separate 7-day data subject deadline. See the Thailand PDPA Guide.
Detection and measurement
- Time from incident detection to the significant harm and scale decision, against 72 hours.
- Percentage of breaches, including sub-threshold ones, entered in the register with root cause and affected systems.
- Percentage of processor contracts with breach notice and assistance terms.
- Number of service accounts, API keys and agent identities with access to personal data and no named owner.
- Transfer impact assessments older than three years, trending to zero.
- High-risk projects screened against the DPIA thresholds before go-live.
Common failure patterns
- Processors assuming the client owns security: since April 2025 the processor is directly liable under section 9.
- Counting only customers: DPO and DPIA thresholds count data subjects, so employee, prospect and CCTV data add up.
- Registering the DPO late: the 21-day window starts at appointment, and changes have 14 days.
- Logging only notifiable breaches: the register must include breaches below the thresholds, kept for two years.
- Relying on the old whitelist: it no longer exists; transfers need a documented section 129 basis.
- Ownerless machine access: without owners and logs for service accounts and keys, the root cause and affected systems fields cannot be completed in time.
Practitioner checklist
- Count data subjects per entity against the 20,000 and 10,000 thresholds and the monitoring test.
- Appoint, register (21 days) and publish the DPO, with a monitored mailbox.
- Map the Security Principle and PDP Standard to your control framework, as controller and as processor.
- Add breach notice and assistance terms to every processor contract.
- Document the 72-hour Commissioner and 7-day data subject steps, with the 30-day completion rule.
- Keep a breach register covering all breaches for at least two years.
- Complete transfer impact assessments and diarise three-year reviews.
- Give every service account, API key and AI agent an owner, a minimum scope and logged access.
- Screen AI and profiling projects against the 2026 DPIA and ADMP guidelines.
- Check pdp.gov.my for the portability guideline and the revised PDP Standard.
Standards and references
- Personal Data Protection Department (JPDP), Malaysia: official portal
- DFDL: Malaysia implementation of the Personal Data Protection (Amendment) Act 2024
- Baker McKenzie: Malaysia Q&A on appointment of DPO and data breach notification
- DLA Piper: Malaysia guidelines issued on data breach notification and DPO appointment
- Mayer Brown: Key amendments to Malaysia's PDPA and the cross-border transfer guidelines
- Allen and Gledhill: PDP Commissioner launches DPIA, ADMP and DPbD guidelines
- Rahmat Lim: Personal Data Protection (Amendment) Bill 2024 passed by Parliament
- Chambers: Data Protection and Privacy 2026, Malaysia
This guide summarises Malaysia's Personal Data Protection Act 2010 as amended by the Personal Data Protection (Amendment) Act 2024, and the Commissioner's guidelines, as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Thailand PDPA Guide · International Data Transfers Map · Data Breach Notification Checklist