Sources
Every fact, with its source.
Each regulation fact on this site, the provision behind it, a link to the law or guideline itself, and the date we last checked it.
Malaysia
Personal Data Protection Act 2010 (Act 709), as amended by Act A1727 (2024)
The Commissioner's site, pdp.gov.my, is under maintenance, so its links may not open for now. Archived copies of the documents:
On the Regulations pages
Amendments in force 1 January, 1 April and 1 June 2025.
Provision: P.U.(B) 522/2024. As of 21 Oct 2026.
Required where you hold data on more than 20,000 people, more than 10,000 for sensitive data including financial information, or for regular and systematic monitoring. Register within 21 days of appointment.
Provision: PDPA s.12A, inserted by Act A1727 s.6; Data Protection Officer (DPO) Guideline paras 4.2 and 7.1. As of 21 Oct 2026.
A breach likely to cause significant harm: to the Commissioner within 72 hours (the guideline says "from the occurrence"; its examples count from awareness or confirmation), then to the people affected within 7 days after that.
Provision: PDPA s.12B, inserted by Act A1727 s.6; Breach Notification Guideline paras 5.1, 6.1, 6.2, 8.1, 8.2 and 9.1. As of 21 Oct 2026.
Up to RM1,000,000, up to 3 years' imprisonment, or both, for breaching a data protection principle (since 1 April 2025).
Provision: PDPA s.5(2), as amended by Act A1727 s.4(b)(ii); P.U.(B) 522/2024 para (b). As of 21 Oct 2026.
Access and correction requests answered within 21 days.
Provision: PDPA ss.31(1) and 35(1)-(3). As of 21 Oct 2026.
Data portability on request, since 1 June 2025, where technically feasible.
Provision: PDPA s.43A(1)-(2); P.U.(B) 522/2024 para (c). As of 21 Oct 2026.
Processors bound by the Security Principle, since 1 April 2025.
Provision: PDPA s.5(1A), inserted by Act A1727 s.4; P.U.(B) 522/2024 para (b). As of 21 Oct 2026.
Privacy notices in Bahasa Melayu and English.
Provision: PDPA s.7(3); Federal Constitution art. 152(1); the Commissioner's notice guide. As of 21 Oct 2026.
"Significant harm" includes a breach affecting more than 1,000 people (for notifying the Commissioner, not for telling individuals).
Provision: Breach Notification Guideline paras 5.2, 5.3 and 8.2. As of 21 Oct 2026.
Transfers out of Malaysia: a substantially similar law or adequate protection at the destination, or another ground the Act lists, such as consent; the Minister's whitelist is gone.
Provision: PDPA s.129(2)-(3); Act A1727 s.12; P.U.(B) 522/2024 para (b). As of 21 Oct 2026.
Since 1 April 2025 the Act says "data controller", not "data user".
Provision: Act A1727 s.2; P.U.(B) 522/2024 para (b). As of 21 Oct 2026.
On the home page
A DPO is required once you hold data on more than 20,000 people, or sensitive data, including financial information, on more than 10,000.
Provision: DPO Guideline para 4.2. As of 21 Oct 2026.
The DPO is registered with the Commissioner within 21 days of appointment.
Provision: DPO Guideline para 7.1. As of 21 Oct 2026.
A breach likely to cause significant harm goes to the Personal Data Protection Commissioner (the Commissioner) as soon as practicable and within 72 hours.
Provision: PDPA s.12B; Breach Notification Guideline paras 5.1 and 6.1. As of 21 Oct 2026.
The people affected are told without unnecessary delay, and within 7 days after the Commissioner is notified.
Provision: Breach Notification Guideline paras 8.1 and 9.1. As of 21 Oct 2026.
Access requests are answered within 21 days.
Provision: PDPA s.31(1). As of 21 Oct 2026.
People can ask you to send their data to another organisation.
Provision: PDPA s.43A, in force 1 Jun 2025. As of 21 Oct 2026.
Singapore
Personal Data Protection Act 2012
Every organisation designates at least one individual responsible for compliance (often called the DPO) and publishes a business contact for one of them.
Provision: PDPA 2012 s.11(3) and (5). As of 21 Oct 2026.
To the Personal Data Protection Commission (PDPC) no later than 3 calendar days after assessing a breach as notifiable; to affected individuals on or after that, where the breach is likely to cause them significant harm.
Provision: PDPA 2012 s.26C(2) and s.26D(1)-(2). As of 21 Oct 2026.
Administrative fines up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, otherwise up to S$1 million.
Provision: PDPA 2012 s.48J(3). As of 21 Oct 2026.
Vietnam
Law on Personal Data Protection No. 91/2025/QH15, with Decree 356/2025/ND-CP
In force: 1 January 2026.
Provision: Law No. 91/2025/QH15 art. 38(1); Decree 356/2025/ND-CP art. 42(1). As of 21 Oct 2026.
Every organisation designates a capable data-protection unit or staff, or hires a provider. Small enterprises and startups may defer this for 5 years and micro-businesses are exempt, unless they sell data-processing services, process sensitive data, or process data on 100,000 or more people.
Provision: Law art. 33(2) and art. 38(2)-(3); Decree 356 art. 41. As of 21 Oct 2026.
A violation that may harm national defence, national security or public order and safety, or a person's life, health, honour, dignity or property: report to the agency no later than 72 hours after discovering it.
Provision: Law art. 23(1). As of 21 Oct 2026.
Administrative fines up to 5% of the previous year's revenue for cross-border transfer violations; 10 times the proceeds for trading in personal data; up to VND 3 billion for other violations.
Provision: Law art. 8(3)-(6). As of 21 Oct 2026.
Thailand
Personal Data Protection Act B.E. 2562 (2019)
Required for public authorities as the Committee prescribes; where collecting, using or disclosing data requires regular monitoring of personal data or systems because of a large amount of data, as the Committee prescribes; and where the core activity is processing sensitive data.
Provision: PDPA s.41(1)-(3). As of 21 Oct 2026.
To the Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights; to the people affected without delay if the risk is high.
Provision: PDPA s.37(4). As of 21 Oct 2026.
Administrative fines up to THB 1 million, 3 million or 5 million per offence, depending on the provision.
Provision: PDPA ss.82-87. As of 21 Oct 2026.
Indonesia
Law No. 27 of 2022 on Personal Data Protection
Compliance required from 17 October 2024.
Provision: Law 27/2022 art. 74. As of 21 Oct 2026.
The data protection agency the law requires had not been established as of 27 July 2026; the ministry carries the function meanwhile.
Provision: Constitutional Court, case 236/PUU-XXIV/2026, hearing of 27 Jul 2026. As of 21 Oct 2026.
An officer is required for public-service processing, for core activities needing regular, systematic, large-scale monitoring, and for core activities processing specific (sensitive) personal data, or data on criminal offences, at large scale.
Provision: Law 27/2022 art. 53(1). As of 21 Oct 2026.
Written notice to the people affected and to the agency within 3 × 24 hours.
Provision: Law 27/2022 art. 46(1). As of 21 Oct 2026.
Administrative fines up to 2% of annual income or revenue relating to the violation.
Provision: Law 27/2022 art. 57(3). As of 21 Oct 2026.
Philippines
Data Privacy Act of 2012 (Republic Act 10173)
Every controller designates someone accountable for compliance. With 250 or more employees, sensitive data on 1,000 or more people, or risky processing, register the DPO and processing systems with the National Privacy Commission (NPC) within 20 days.
Provision: RA 10173 s.21(b); Implementing Rules and Regulations (IRR) s.26(a); NPC Circular 2022-04 ss.5 and 7. As of 21 Oct 2026.
For breaches that meet the notification conditions: the NPC and the people affected within 72 hours of knowing or reasonably believing it happened; the full report within 5 days.
Provision: NPC Circular 16-03 ss.11, 17(A), 17(C) and 18(A). As of 21 Oct 2026.
Administrative fines up to PHP 5 million per act: 0.5–3% of annual gross income for grave violations and 0.25–2% for major ones.
Provision: NPC Circular 2022-01. As of 21 Oct 2026.
What we do not claim.
- We do not guarantee compliance, and nothing here makes a company 100% compliant.
- We hold no certification, and show no badges: no International Organization for Standardization (ISO) certificate, no Data Protection Trustmark (DPTM), no System and Organization Controls 2 (SOC 2) report.
- The Personal Data Protection Commissioner has not approved, endorsed or recognised us or our work.
- We have no clients, case studies or track record yet, so this site shows no logos, testimonials or metrics.
- The work is not fully automated: a human reviewer signs every output, and the AI agents do not replace your DPO.
Links go to the regulator's or the government's own files, except the Philippine Act, which links to a reproduction on lawphil.net: the Official Gazette page did not load when we checked.
Not legal advice. Laws change; every fact shows the date we last checked it.