HomeIco

Home

 InternalIco

Internal

 GlobalIco

Global

 ContactIco

Contact
de|en|it

We use cookies to personalise the website and offer you the greatest added value. They are, among other purposes, used to analyse visitor usage in order to improve the website for you. By using this website, you agree to their use. Further information can be found in our data privacy statement.



Malaysia: Amendments to Personal Data Protection Act 2010 and guidelines

PrintMailRate-it
​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​published on 22 July 2025 | reading time approx. 3 minutes


Personal Data Protection (Amendment) Act 2024 (“PDPA 2024”) was enacted on 1 January 2025 in an effort to align Malaysia’s data protection laws more closely with international standards and strengthen data protection in Malaysia. The PDPA 2024 is enforced in three phases, namely 1 January 2025, 1 April 2025 and 1 June 2025. 

The salient amendments from PDPA 2024 include: ​

​Subject
​Personal Data Protection Act 2010
​PDPA 2024
​Terminology for data user
​Data user
Data controller
​Cross border data transfer 
​Transfer of personal data out of Malaysia to whitelisted countries were allowed with the data subject´s consent. There was no list of whitelist countries
​The whitelist regime for cross border data transfer has been removed and replaced by a regime of permitted transfers based on certain grounds
​Penalties for breach of personal data protection principles
Penalties of up to RM 300,000 and/or imprisonment of 2 years
​Increased penalties of up to RM 1 million and/or imprisonment of 3 years
​Sensitive personal data
​Not addressed
​Biometric data is considered sensitive and are defined as data derived from the technical processing of physical, physiological and behavioral characteristics
​Right to data portability
​Not provided
​The right to data portability is granted, subject to technical feasibility and data format compatibility
​Personal data breach notification
​Not provided
​It is required to notify the Personal Data Protection Commissioner (“Commissioner”) as well as affected individuals if the breach causes or is likely to cause significant harm to the individuals
​Obligations of data processors
​Not provided
​Data processors must adhere to security requirements and are subject to penalties for breaches
​Appointment of Data Protection Officer (“DPO”)
​Not provided
​There is a new requirement to appoint a DPO if organizations meet certain thresholds

Following the PDPA 2024, the Commissioner issued the following guidelines to provide clarity on the new requirements: 

​Guideline
​Content 
​Cross Border Personal Data Transfer Guideline
  1. ​New conditions for cross-border transfer under PDPA 2024; 
  2. The adoption of Binding Corporate Rules; 
  3. Applicability of Standard Contractual Clauses; 
  4. Certification mechanism;
  5. Record-keeping obligations.​

​Implementation of Data Breach Notification Guideline
  1. ​The scope and threshold of notification to the Commissioner and affected data subjects; 
  2. Timeframe for notifications; 
  3. The manner and form of notifications;
  4. Management of breached personal data;
  5. The obligations of data controllers, including record-keeping obligations. ​

​Appointment of DPO Guideline
  1. The threshold for mandatory appointment of DPO; 
  2. Expertise, qualifications and residency requirement of DPO;  
  3. Key responsibilities of a DPO; 
  4. Notification of appointment of DPO;
  5. Obligations of data controller and data processor.​


The Commissioner is also set to publish a revised Personal Data Protection Standard which ensures security, storage and integrity and publish guidelines on for the following topics: 
  1. Data Protection Impact Assessments – a proactive process to help organizations assess the risks and impacts related to the processing of personal data to ensure compliance with legal requirements;
  2. Data Protection by Design and by Default - provides guidance to organizations on integrating data protection at every stage of system and process design;
  3. Automated Decision-Making & Profiling - Provides guidance on the regulation of data processing involving automated decision-making and profiling to ensure the protection of individual rights.

Further, the Commissioner has also launched the portal for the registration of a DPO for data controller and data processor that fulfils the requirements: 
  1. Processes personal data of more than 20,000 data subjects; 
  2. Processes sensitive personal data including financial information, biometric data or health data of more than 10,000 data subjects;
  3. Involve activities that required regular and systematic monitoring of personal data.  

As all changes contained in PDPA 2024 are now being enforced, data controllers and data processors are encouraged to carefully review and assess their compliance approach to ensure alignment with PDPA requirements and avoid potential non-compliance.

DATA PROTECTION BITES
​​​​​​​​​​Read all releases »​

author

Contact Person Picture

Felix Engelhardt

Manager

+60 3 2276 2755

Send inquiry

RÖDL & PARTNER Malaysia
Discover more about our offices in Malaysia. 
Skip Ribbon Commands
Skip to main content
Deutschland Weltweit Search Menu