Malaysia. Data localisation / cross-border. Guidelines
Malaysia CBPDT GuidelinesCross Border Personal Data Transfer Guidelines (Guideline No. 03/2025)
In force
§1Summary
- Synopsis
Explains the amended transfer rule, requiring a transfer impact assessment when relying on destination law and recognising BCRs, standard clauses and certifications.
- Key themes
- Unique features
Mirrors GDPR-style tools within a non-adequacy framework.
- SaaS relevance
Sets how SaaS customers in Malaysia may lawfully export data to overseas cloud hosting.
§2Obligations
- Cross-border transfers
- TIA / BCR / SCC / certification / exceptions
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text pdp.gov.my
- English text pdp.gov.my
- Authority
- Personal Data Protection Commissioner (JPDP)
§5Where it applies
- Domestic law of
- Malaysia
§6Sources and verification
- Sources consulted
- Verification
High confidence.
[Link: official BM and English JPDP PDFs]