Seventh Intelligence
Take the check
Seventh Intelligence

Index

Not legal advice. We prepare compliance work for your review; we do not give legal advice.

Malaysia

PDPA 2010, as amended

Personal Data Protection Act 2010 (Act 709), as amended by Act A1727 (2024)

Take the free readiness check
In force
Amendments in force 1 January, 1 April and 1 June 2025
Regulator
Personal Data Protection Commissionerhttps://www.pdp.gov.my

Read the lawArchived copy, 18 October 2026As of 21 Oct 2026

Who needs a data protection officer (DPO)

Required where you hold data on more than 20,000 people, more than 10,000 for sensitive data including financial information, or for regular and systematic monitoring. Register within 21 days of appointment.

As of 21 Oct 2026

When a breach must be reported

A breach likely to cause significant harm: to the Commissioner within 72 hours (the guideline says "from the occurrence"; its examples count from awareness or confirmation), then to the people affected within 7 days after that.

As of 21 Oct 2026

Penalties

Up to RM1,000,000, up to 3 years' imprisonment, or both, for breaching a data protection principle (since 1 April 2025).

As of 21 Oct 2026

Also worth knowing

  • Access and correction requests answered within 21 days.
  • Data portability on request, since 1 June 2025, where technically feasible.
  • Processors bound by the Security Principle, since 1 April 2025.
  • Privacy notices in Bahasa Melayu and English.
  • "Significant harm" includes a breach affecting more than 1,000 people (for notifying the Commissioner, not for telling individuals).
  • Transfers out of Malaysia: a substantially similar law or adequate protection at the destination, or another ground the Act lists, such as consent; the Minister's whitelist is gone.
  • Since 1 April 2025 the Act says "data controller", not "data user".

As of 21 Oct 2026

Sources

Take the free readiness check

Not legal advice.