Malaysia. Comprehensive data protection. Act

PDPA (Malaysia)Personal Data Protection Act 2010 (Act 709)

In force

Partly verified

Medium confidence. Penalty level and 72h figure from general knowledge; third commencement phase not identified in sources.

§1Summary

Synopsis

Regulates processing of personal data in commercial transactions through seven data protection principles. The 2024 amendments add breach notification, DPO appointment, data portability and direct security duties for processors, and replace the whitelist with an adequacy-style transfer test.

Key themes

seven principles
commercial transactions
registration of certain sectors
DPO
breach notification
data portability
processor security duty
cross-border

Unique features

Excludes federal and state governments; certain sectors must register with the Commissioner; directors personally liable.

SaaS relevance

SaaS processors for Malaysian clients now owe a direct Security Principle duty and may need a DPO.

§2Obligations

Extraterritorial: Limited
Breach notification: Commissioner as soon as practicable (guideline: within 72h) where significant harm; individuals without unnecessary delay
DPO: Conditional
Cross-border transfers: Substantially similar law/adequate protection, or exceptions (consent, contract, due diligence); TIA per 2025 guidelines
Maximum penalty: RM1m and/or 3 years' imprisonment (raised by 2024 amendment)

§3Dates

Key dates

Adopted 2 June 2010
In force 15 November 2013
Amended by Act A1727 (2024), phased in 2025: cross-border 2025-04-01; DPO and breach notification 2025-06-01

§4Text and authority

Text

Authoritative text pdp.gov.my

Authority

Personal Data Protection Commissioner (JPDP)

§5Where it applies

Domestic law of: Malaysia

§6Sources and verification

Sources consulted

Verification

Medium confidence.

Partly verified

Medium confidence. Penalty level and 72h figure from general knowledge; third commencement phase not identified in sources.