PDPA amendments: what Malaysian organisations must have in place

Malaysia’s Personal Data Protection Act 2010 (PDPA) received its first major overhaul in more than a decade. The Personal Data Protection (Amendment) Act 2024 was passed in July 2024 and its changes came into force in stages during 2025, with the obligations on data protection officers, data breach notification and data portability starting on 1 June 2025.

If your organisation collects personal data from customers, employees or suppliers in Malaysia, this is what has changed and what you should have in place now.

What changed

• Higher penalties. The maximum penalty for breaching the personal data protection principles rose from RM300,000 and up to two years’ imprisonment to RM1 million and up to three years’ imprisonment.
• Data processors are now directly accountable. Service providers that process personal data on your behalf, such as payroll, IT or cloud providers, now have their own legal duty to keep that data secure, not only a contractual one.
• Biometric data is sensitive personal data. Fingerprints, facial recognition and similar data now need the stricter treatment that applies to sensitive data, including explicit consent.
• Mandatory breach notification. Data controllers must report personal data breaches to the Personal Data Protection Commissioner, and in some cases to the people affected.
• Data protection officers. Organisations that meet the thresholds in the Commissioner’s guideline must appoint a DPO.
• Data portability. Individuals can ask for their personal data to be transmitted to another data controller, where this is technically feasible.
• Cross-border transfers. The never-used “white list” of approved countries was removed. Transfers are allowed where the destination has comparable protection, or where another permitted basis applies.
• New terminology. “Data user” became “data controller”, in line with international usage.

Do you need a data protection officer?

Under the Commissioner’s Guideline on Appointment of Data Protection Officer, a DPO is required where an organisation, as controller or processor:

• processes the personal data of more than 20,000 individuals;
• processes sensitive personal data, including financial information, of more than 10,000 individuals; or
• carries out regular and systematic monitoring of personal data.

The DPO can be an employee or an outsourced provider. They must be proficient in Bahasa Melayu and English and be resident in Malaysia or easily contactable. The Commissioner must be notified of the DPO’s business contact details within 21 days of the appointment, and those details should be published, for example in your privacy notice.

Below the thresholds, a DPO is not mandatory, but someone should still own data protection, keep the records and handle requests and incidents.

Data breach notification in practice

The Guideline on Data Breach Notification expects a data controller to:

• notify the Commissioner as soon as practicable and within 72 hours of the breach, explaining any delay in writing;
• notify affected individuals without unnecessary delay, and within seven days of notifying the Commissioner, where the breach causes or is likely to cause significant harm, such as financial loss, identity fraud or the compromise of sensitive data;
• keep a register of breaches for at least two years;
• require its processors, by contract, to report incidents promptly and help with the response.

Seventy-two hours is not long. The organisations that meet it have decided in advance who assesses an incident, who decides whether it is notifiable, who drafts the notice and who speaks to customers.

A practical checklist

Know your data

• Map what personal data you hold, where it sits, who can access it and which third parties process it.
• Identify sensitive data, including biometric data from attendance or access systems, and confirm you have explicit consent for it.
• Count the individuals involved, so you know whether the DPO thresholds apply.

Fix your contracts and notices

• Update contracts with processors to cover security, breach reporting and assistance.
• Review your privacy notices in English and Bahasa Malaysia, including the DPO or contact details and the right to portability.
• Check the basis for any transfer of personal data outside Malaysia, including cloud services.

Prepare for incidents

• Write a short breach response plan with named roles and the 72-hour and seven-day steps.
• Set up the breach register.
• Run a tabletop exercise on a realistic scenario, such as a lost laptop or a compromised email account, and train the staff involved.

Assign ownership

• Appoint a DPO if the thresholds apply, and notify the Commissioner within 21 days.
• Report data protection risks and incidents to management or the board as part of your risk reporting.

Where reviews usually find gaps

• No data inventory, so nobody can say quickly what was affected when something goes wrong.
• Old supplier contracts that say nothing about security or incident reporting.
• Biometric attendance systems introduced without explicit consent or a retention rule.
• A breach plan that exists on paper only and has never been tested.

Next step

A PDPA compliance review compares your current practices with the amended Act and the Commissioner’s guidelines, rates the gaps by risk and gives you a practical plan to close them, from data mapping to breach readiness. It fits naturally into an internal audit or risk management programme.

This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.