Malaysia Privacy & Data Protection Laws

Section 2 applies the PDPA to a person established in Malaysia processing personal data (including where processing happens abroad, if the data is intended to be further processed in Malaysia), and to a person not established in Malaysia who uses equipment in Malaysia for processing otherwise than for mere transit — an equipment/establishment test, not a GDPR targeting test, so the trigger below is modeled on established presence only. Section 3 excludes the federal and state governments and processing outside Malaysia not intended for further processing in Malaysia. The Personal Data Protection (Amendment) Act 2024 was the first substantial overhaul since 2010, phased in across the first half of 2025: mandatory data-protection officer appointment (notified to the Commissioner) for qualifying controllers, mandatory breach notification to the Commissioner within 72 hours (and to affected individuals where significant harm is likely), a new data-portability right, direct statutory obligations on data processors, and the relabeling of 'data user' as 'data controller'. Supporting guidelines on DPO appointment, breach notification, and cross-border transfers followed in 2025.

Malaysia removed its whitelist. The old s. 129 let the Minister gazette permitted destination countries; the 2024 amendment repealed that mechanism outright — and, with it, the public-interest limb the Minister could invoke — replacing it with a conditions-based test. A transfer is now permitted where the destination has a law in force that is substantially similar to the PDPA, or otherwise ensures an adequate level of protection at least equivalent to the PDPA's, or where one of the other prescribed conditions is satisfied. The Commissioner's Guidelines on Cross Border Personal Data Transfer, issued April 29, 2025, set out how the assessment is expected to be run. Marked 'check': this is a recent structural change and the guidelines are the operative document — read them rather than the bare statute.

Malaysia had no mandatory breach notification at all until the 2024 amendment commenced on June 1, 2025. The regime it introduced: notify the Commissioner within 72 hours of becoming aware, with written reasons required if that is missed, and notify affected individuals within seven days where the breach causes or is likely to cause significant harm. Controllers must also maintain a data breach register for at least two years recording the nature of the breach, the data affected, and remedial steps. Marked 'check': the amendment is recent, and the Commissioner's implementing guidelines should be read alongside the statute for the operative definitions of 'significant harm' and the register's required contents.